Examkin

Soru

Zorluk: ZorHigh-Performing and Scalable Network Architectures

A company is designing a hybrid network architecture to connect its on-premises data center to three VPCs in the us-east-1 Region. The connection must support a database replication traffic load that peaks at 3.2 Gbps3.2\text{ Gbps}. The company's security policy dictates that all traffic traversing this hybrid connection must be encrypted in transit using IPsec. Which network architecture will meet these requirements while providing the highest performance and scalability?

  1. Create an AWS Transit Gateway and enable Equal-Cost Multi-Path (ECMP) routing. Establish multiple AWS Site-to-Site VPN connections from the on-premises data center to the Transit Gateway, and configure dynamic routing using Border Gateway Protocol (BGP) to distribute the traffic across the active VPN tunnels.Cevap
  2. B
    Establish a single AWS Site-to-Site VPN connection from the on-premises data center to a Virtual Private Gateway attached to each VPC. Configure dynamic routing to allow the VPN connection to automatically scale its throughput to meet the peak demand of 3.2 Gbps3.2\text{ Gbps}.
  3. C
    Deploy an AWS Direct Connect connection with a public virtual interface (VIF). Configure an AWS Site-to-Site VPN backup connection. Use Amazon Route 53 with latency-based routing to dynamically distribute the database replication traffic between the Direct Connect path and the VPN path to prevent bottlenecks.
  4. D
    Configure a 10 Gbps AWS Direct Connect connection with a transit virtual interface (transit VIF) connected to an AWS Transit Gateway. Set up a Site-to-Site VPN over the Direct Connect connection, and modify the subnet-level Network ACLs to be stateful, allowing return traffic to scale dynamically across both VPN tunnels.

Cevap

The correct architecture is to create an AWS Transit Gateway with ECMP enabled, establish multiple AWS Site-to-Site VPN connections from the on-premises data center to the Transit Gateway, and configure dynamic routing using BGP to distribute the traffic across the active VPN tunnels.
The correct option provides a highly scalable and performant design. By deploying an AWS Transit Gateway and enabling Equal-Cost Multi-Path (ECMP) routing, multiple AWS Site-to-Site VPN connections can be combined. Since each VPN tunnel is capped at 1.25 Gbps1.25\text{ Gbps}, using ECMP to route traffic across at least three active tunnels allows the architecture to exceed the limit and support the required 3.2 Gbps3.2\text{ Gbps} peak database replication traffic while ensuring all traffic is encrypted with IPsec.

Adım Adım Çözüm

1
Analyze the business requirements and constraints.
The solution requires IPsec encryption, connection to three VPCs, and a minimum peak throughput of 3.2 Gbps3.2\text{ Gbps}.
This establishes the boundaries for acceptable architectures.
2
Evaluate standard VPN throughput limits.
A single AWS Site-to-Site VPN tunnel is limited to 1.25 Gbps1.25\text{ Gbps}.
To support 3.2 Gbps3.2\text{ Gbps}, multiple VPN tunnels must be aggregated.
3
Select the aggregation and routing mechanism.
AWS Transit Gateway can aggregate multiple VPN tunnels using Equal-Cost Multi-Path (ECMP) routing with BGP.
ECMP enables load sharing of traffic across multiple active tunnels, providing scale and high performance.

Anahtar Kavram

AWS Transit Gateway supports ECMP routing to aggregate the throughput of multiple AWS Site-to-Site VPN tunnels, enabling hybrid networks to exceed the 1.25 Gbps1.25\text{ Gbps} single-tunnel limit.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

High-Performing and Scalable Network Architectures

Bu konudan daha fazla soru