Examkin

Soru

Zorluk: Çok zorAWS Network Services

A company is designing a network architecture on AWS to connect 20 Virtual Private Clouds (VPCs) across different AWS Regions to their on-premises data center using AWS Direct Connect. They also need to implement a security control that blocks traffic from specific external IP addresses at the subnet boundary before it reaches any resources. Which two AWS configurations or services should the company implement to meet these requirements? (Select two.)

  1. AWS Transit Gateway to act as a centralized hub for routing traffic between the multiple VPCs and the on-premises networkCevap
  2. Stateless Network Access Control Lists (NACLs) associated with the subnets to block the specific malicious IP addressesCevap
  3. C
    A full mesh of VPC Peering connections between all 20 VPCs to allow direct traffic routing between them
  4. D
    Stateful Security Groups applied at the subnet level to filter and block traffic from the specified IP addresses
  5. E
    Stateless Network Access Control Lists (NACLs) attached directly to the elastic network interfaces of individual EC2 instances

Cevap

AWS Transit Gateway and stateless Network Access Control Lists (NACLs) associated with subnets
The correct answer combines AWS Transit Gateway and stateless Network Access Control Lists (NACLs) associated with subnets. AWS Transit Gateway is designed to act as a centralized router to connect multiple VPCs and on-premises networks, eliminating the complexity of a full mesh VPC peering topology. Network Access Control Lists (NACLs) are stateless and function at the subnet boundary, making them the appropriate tool to block specific external IP addresses before traffic reaches any EC2 instances within the subnet.

Adım Adım Çözüm

1
Identify the service that simplifies interconnecting multiple VPCs (20 VPCs) across different regions and on-premises networks.
AWS Transit Gateway acts as a cloud router, serving as a centralized hub to connect multiple VPCs and on-premises networks, replacing the need for complex mesh configurations.
VPC Peering does not scale well for 20 VPCs and does not natively support transitive routing.
2
Determine the network security component capable of blocking traffic from specific IP addresses at the subnet boundary.
Network Access Control Lists (NACLs) operate at the subnet level and are stateless, allowing explicit deny rules to block specific IP addresses before traffic reaches any EC2 instance.
Security Groups operate at the instance level and do not apply at the subnet boundary.

Anahtar Kavram

AWS Transit Gateway acts as a central hub to simplify multi-VPC routing, while Network Access Control Lists (NACLs) provide stateless filtering at the subnet boundary.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

AWS Network Services

Bu konudan daha fazla soru