Examkin

Soru

Zorluk: OrtaHigh-Performing and Scalable Network Architectures

A logistics company is designing a hybrid network architecture to connect its on-premises warehouse management system to a VPC in the `us-east-1` Region. The connection must support a continuous data sync throughput of 2 Gbps2\text{ Gbps}. To secure the database instances inside the VPC, the security team requires stateless traffic filtering at the subnet boundaries, ensuring that return traffic must be explicitly defined. Additionally, the company is deploying a backup application in the `us-west-2` Region and wants to route client requests to the secondary Region if the primary Region becomes unhealthy.

Which two options should the solutions architect select to satisfy these requirements?

  1. Configure an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing and establish multiple AWS Site-to-Site VPN connections.Cevap
  2. Configure Network Access Control Lists (NACLs) at the subnet level to explicitly define rules for both inbound and outbound traffic.Cevap
  3. C
    Establish a single AWS Site-to-Site VPN connection directly to the VPC to handle the continuous throughput.
  4. D
    Configure stateful Security Groups at the subnet boundary to track and filter all incoming and outgoing database traffic.
  5. E
    Implement Amazon Route 53 Latency routing policy as the sole mechanism to failover client traffic during a regional outage.

Cevap

Configure an AWS Transit Gateway with Equal-Cost Multi-Path (ECMP) routing and establish multiple AWS Site-to-Site VPN connections, and configure Network Access Control Lists (NACLs) at the subnet level to explicitly define rules for both inbound and outbound traffic.
To support 2 Gbps2\text{ Gbps} of throughput, multiple VPN tunnels are required because a single tunnel caps out at 1.25 Gbps1.25\text{ Gbps}. Enabling ECMP on the Transit Gateway allows traffic to be distributed across these multiple tunnels. Additionally, Network ACLs are the correct mechanism for subnet-level stateless traffic filtering because they require explicit rules for both inbound and outbound traffic.

Adım Adım Çözüm

1
Analyze the bandwidth requirement.
The continuous data sync requires 2 Gbps2\text{ Gbps} of throughput.
Since a single VPN tunnel is limited to 1.25 Gbps1.25\text{ Gbps}, multiple VPN tunnels must be aggregated using AWS Transit Gateway and ECMP to scale past this limit.
2
Evaluate the security and filtering requirements.
Identify that subnet-boundary stateless traffic filtering requires Network ACLs.
Security Groups are stateful and operate at the instance level. Network ACLs operate at the subnet boundary and are stateless, requiring both inbound and outbound rules to be defined explicitly.
3
Address the disaster recovery routing requirement.
Discard using latency routing alone as a failover mechanism.
Route 53 Latency routing only directs traffic based on lowest network latency and does not monitor resource health or execute failovers without health check associations.

Anahtar Kavram

High-performing hybrid network scalability using AWS Transit Gateway and ECMP, combined with stateless subnet filtering via Network ACLs.
Bu soruyu puanla

Konular

High-Performing and Scalable Network Architectures

Bu konudan daha fazla soru