Examkin

Question

Difficulty: MediumAWS VPN, Direct Connect, and Transit Gateway Management

A company is using an AWS Transit Gateway to connect three VPCs: VPC A, VPC B, and VPC C. The company also has an on-premises data center connected to the Transit Gateway via an AWS Site-to-Site VPN.

A SysOps Administrator must configure Transit Gateway routing to meet the following requirements:
1. Network traffic must flow freely between VPC A and VPC B.
2. VPC C must be able to communicate with the on-premises data center.
3. VPC C must be completely isolated from VPC A and VPC B.

Which two actions should the SysOps Administrator take to configure the Transit Gateway routing? (Select TWO.)

  1. Create a Transit Gateway route table for VPC C, associate it with the VPC C attachment, and propagate only the Site-to-Site VPN attachment route into this route table.Answer
  2. Create a Transit Gateway route table for the VPN, associate it with the Site-to-Site VPN attachment, and propagate the VPC A, VPC B, and VPC C attachment routes into this route table.Answer
  3. C
    In the VPC subnet route tables of VPC C, add a route for the on-premises network CIDR block pointing to the Internet Gateway attached to VPC C.
  4. D
    Associate the VPC C attachment with the Transit Gateway route table used by VPC A and VPC B, and configure a Network ACL in VPC C that blocks all outbound traffic to ephemeral ports.
  5. E
    Create a Gateway VPC Endpoint in VPC C, and associate it with the VPC C subnet route tables to direct the hybrid traffic to the Transit Gateway.

Answer

Create a Transit Gateway route table for VPC C, associate it with the VPC C attachment, and propagate only the Site-to-Site VPN attachment route into this route table; and create a Transit Gateway route table for the VPN, associate it with the Site-to-Site VPN attachment, and propagate the VPC A, VPC B, and VPC C attachment routes into this route table.
To achieve the desired routing and isolation, separate Transit Gateway (TGW) route tables must be created and associated with the respective attachments. By creating a dedicated TGW route table for VPC C, associating it with VPC C, and propagating only the VPN route, VPC C can communicate with on-premises but is isolated from VPC A and VPC B. Similarly, a dedicated TGW route table for the VPN attachment with propagations for all three VPCs ensures that return traffic from the on-premises network can reach any of the VPCs.

Step-by-Step Solution

1
Analyze the routing isolation requirements for VPC C, VPC A, VPC B, and the on-premises network connected via VPN.
VPC C needs to route traffic only to the VPN. VPC A and VPC B need to route traffic to each other and the VPN. The VPN needs to route traffic to VPC A, VPC B, and VPC C.
Understanding the required traffic paths is necessary to design the Transit Gateway route tables.
2
Configure the Transit Gateway route table for VPC C.
A separate Transit Gateway route table is created, associated with VPC C, and the VPN route is propagated into it. VPC A and VPC B routes are not propagated into this route table.
This isolates VPC C from VPC A and VPC B at the Transit Gateway level while permitting traffic to the VPN.
3
Configure the Transit Gateway route table for the Site-to-Site VPN attachment.
A Transit Gateway route table is created, associated with the VPN, and VPC A, VPC B, and VPC C routes are propagated into it.
This ensures that traffic originating from the on-premises network can find routes back to all three VPCs.

Key Concept

AWS Transit Gateway route table association and propagation rules for isolating VPC traffic.
Rate this question

Topics

AWS VPN, Direct Connect, and Transit Gateway Management

More questions from this topic