Examkin

Soru

Zorluk: Çok zorAWS Network Services

An enterprise is expanding its cloud infrastructure to include 1212 Virtual Private Clouds (VPCs) across multiple AWS accounts. To simplify routing, they need a central hub to interconnect all VPCs with their on-premises data center. At the same time, the security team requires the ability to block inbound traffic from a specific set of known malicious public IP addresses at the boundary of each subnet. Which combination of AWS services and security features should the cloud practitioner recommend to meet these requirements?

  1. Deploy AWS Transit Gateway as a centralized router to connect all VPCs and the on-premises network, and use Network Access Control Lists (NACLs) to deny the malicious IP addresses at the subnet level.Cevap
  2. B
    Deploy AWS Transit Gateway as a centralized router to connect all VPCs and the on-premises network, and use Security Groups to deny the malicious IP addresses at the instance level.
  3. C
    Establish point-to-point VPC Peering connections between all VPC pairs, and use Network Access Control Lists (NACLs) to deny the malicious IP addresses at the subnet level.
  4. D
    Establish point-to-point VPC Peering connections between all VPC pairs, and use Security Groups to deny the malicious IP addresses at the instance level.

Cevap

Deploy AWS Transit Gateway as a centralized router to connect all VPCs and the on-premises network, and use Network Access Control Lists (NACLs) to deny the malicious IP addresses at the subnet level.
Deploying AWS Transit Gateway acts as a cloud router, simplifying the network topology by connecting multiple VPCs and on-premises networks to a central hub instead of managing a complex web of point-to-point peering connections. Network Access Control Lists (NACLs) are stateless and operate at the subnet boundary, allowing explicit deny rules to block specific IP addresses before traffic reaches the instances.

Adım Adım Çözüm

1
Determine the routing architecture needed to connect 1212 VPCs and an on-premises network.
Identify AWS Transit Gateway as the optimal hub-and-spoke solution, reducing connection complexity from n(n−1)2\frac{n(n-1)}{2} (which is 6666 peering connections for 1212 VPCs) to 1212 VPC attachments plus one VPN/Direct Connect attachment.
VPC Peering does not support transitive routing and becomes administratively complex as the number of VPCs grows.
2
Determine the security control required to block inbound traffic from specific malicious public IP addresses at the subnet boundary.
Identify Network Access Control Lists (NACLs) as the correct choice since they are stateless, operate at the subnet level, and support explicit deny rules.
Security Groups are stateful, operate at the instance level, and only support allow rules, making them incapable of explicitly blocking specific IP addresses.

Anahtar Kavram

AWS Transit Gateway for centralized routing and Network ACLs for subnet-level stateless IP blocking.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS Network Services

Bu konudan daha fazla soru