A financial analytics firm is deploying virtual private clouds (VPCs) across multiple AWS accounts to isolate different customer datasets. The firm requires a simplified, central routing hub to enable communication between all VPCs. Furthermore, the security team needs to enforce traffic filtering at the boundary of each subnet to explicitly reject incoming requests from a list of known malicious IP ranges.
Which two AWS network services or configuration components should the firm implement to meet these requirements? (Select TWO.)
- AWS Transit Gateway to act as a centralized router for interconnecting the VPCsCevap
- Network Access Control Lists (Network ACLs) configured with deny rules for the malicious IP rangesCevap
- CVPC Peering connections configured in a full mesh network to connect all VPCs
- DSecurity Groups configured with deny rules to block the malicious IP ranges at the subnet boundary
- EAWS Site-to-Site VPN connections between all VPCs to route internal traffic
Cevap
AWS Transit Gateway to act as a centralized router, and Network Access Control Lists (Network ACLs) configured with deny rules
AWS Transit Gateway simplifies the network topology by acting as a central hub that routes traffic between all VPCs, avoiding the need for a complex full mesh of point-to-point connections. Network ACLs operate at the subnet boundary and support explicit deny rules, which allows the security team to block traffic from the specified malicious IP ranges before it reaches any resources in the subnet.
Adım Adım Çözüm
Anahtar Kavram
Centralized multi-VPC routing using AWS Transit Gateway and subnet-level traffic filtering using stateless Network ACLs.
Tahmini Süre:2m 0s