Examkin

Question

Difficulty: MediumData Transfer Cost Optimization

A company has a VPC with private subnets in the us-west-2 Region. Amazon EC2 instances in these subnets transfer 15 TB15\text{ TB} of backup data monthly to an on-premises storage system. To reduce data transfer costs, the company establishes an AWS Direct Connect connection and configures a private virtual interface (VIF) associated with a Virtual Private Gateway (VGW) attached to the VPC. However, the SysOps administrator notices that the monthly bill still reflects high NAT Gateway data processing charges and standard internet data transfer out (DTO) fees for this backup traffic. Which action should the SysOps administrator take to resolve this issue and minimize costs?

  1. Enable route propagation on the private subnets' route tables to dynamically populate the on-premises routes from the Virtual Private Gateway.Answer
  2. B
    Modify the NAT Gateway's route table to add a route for the on-premises network CIDR pointing to the Virtual Private Gateway.
  3. C
    Create an S3 Gateway VPC Endpoint to redirect the transfer traffic, but omit associating it with the private subnets' route tables.
  4. D
    Apply billing tags to the NAT Gateway and activate them as cost allocation tags in the AWS Billing console.

Answer

Enable route propagation on the private subnets' route tables to dynamically populate the on-premises routes from the Virtual Private Gateway.
Enabling route propagation on the private subnets' route tables automatically updates the route tables with routes advertised by the on-premises network via BGP over the Direct Connect VIF. Because a more specific route now exists for the on-premises network compared to the default route (0.0.0.0/00.0.0.0/0), the EC2 instances bypass the NAT Gateway and send the backup traffic directly to the Virtual Private Gateway. This eliminates the NAT Gateway data processing charges and utilizes the cheaper Direct Connect Data Transfer Out (DTO) rates.

Step-by-Step Solution

1
Analyze the current traffic path and routing configuration.
Identify that the private subnet route table only has a default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway, forcing the backup traffic destined for the on-premises network to route through the NAT Gateway and egress over the internet.
To understand why NAT Gateway charges and standard internet DTO fees are still being incurred despite having a Direct Connect connection.
2
Determine the correct target for the on-premises network traffic.
The Virtual Private Gateway (VGW) attached to the VPC connects to the Direct Connect private virtual interface (VIF), which is the correct destination for routing on-premises traffic privately and cost-effectively.
Direct Connect offers significantly lower Data Transfer Out (DTO) rates and avoids NAT Gateway processing fees when accessed directly.
3
Implement the routing change using route propagation.
Enable route propagation on the private subnets' route tables. This dynamically adds the BGP-advertised routes from the on-premises network pointing to the VGW.
This ensures the private subnet route table has a more specific route for the on-premises network than the default 0.0.0.0/00.0.0.0/0 route, causing the traffic to bypass the NAT Gateway and route directly over the Direct Connect connection.

Key Concept

Routing propagation over Virtual Private Gateway for Direct Connect cost optimization
Estimated Time:1m 30s
Rate this question

Topics

Data Transfer Cost Optimization

More questions from this topic