Examkin

Soru

Zorluk: ZorAWS Network Services

A financial company is designing a multi-VPC architecture on AWS consisting of 1212 VPCs that all require full interconnection with each other. At the same time, the security team needs to block all inbound traffic from a specific external IP address range (198.51.100.0/24198.51.100.0/24) at the subnet boundary of their web tier. Which AWS networking design should the company use to meet these requirements with the least administrative complexity?

  1. A
    Establish a full mesh of VPC Peering connections between all VPCs, and implement a Network Access Control List (Network ACL) with a deny rule at the web tier subnet boundary.
  2. Use AWS Transit Gateway to interconnect the VPCs, and implement a Network Access Control List (Network ACL) with a deny rule at the web tier subnet boundary.Cevap
  3. C
    Use AWS Transit Gateway to interconnect the VPCs, and configure an inbound deny rule on the web tier Security Groups to block the IP range.
  4. D
    Establish a full mesh of VPC Peering connections between all VPCs, and configure a Security Group with an inbound deny rule at the web tier subnet boundary.

Cevap

Use AWS Transit Gateway to interconnect the VPCs, and implement a Network Access Control List (Network ACL) with a deny rule at the web tier subnet boundary.
Using AWS Transit Gateway simplifies the architecture by acting as a central hub to connect all 12 VPCs, removing the need to configure and manage 66 individual VPC Peering connections. To meet the security requirement, a Network Access Control List (Network ACL) is used because it operates at the subnet boundary and supports explicit deny rules to block traffic from the specified IP range (198.51.100.0/24198.51.100.0/24).

Adım Adım Çözüm

1
Evaluate the complexity of interconnecting 12 VPCs using VPC Peering versus AWS Transit Gateway.
A full mesh using VPC Peering requires 12×112=66\frac{12 \times 11}{2} = 66 point-to-point connections, which is complex to manage. AWS Transit Gateway acts as a centralized cloud router, requiring only 12 attachments (one per VPC).
To identify the service that minimizes administrative overhead for multi-VPC routing.
2
Determine the correct firewall mechanism to block a specific external IP range at the subnet level.
Network ACLs are stateless, apply at the subnet boundary, and support explicit deny rules. Security Groups are stateful, apply at the instance level, and support only allow rules.
To satisfy the security requirement of blocking inbound traffic from a specific IP block before it reaches the instances in the subnet.

Anahtar Kavram

Multi-VPC routing scaling and subnet-level firewall rules
Bu soruyu puanla

Konular

AWS Network Services

Bu konudan daha fazla soru