Examkin

Soru

Zorluk: OrtaHigh-Performing and Scalable Network Architectures

An enterprise hosts a high-frequency market data API on Amazon EC2 instances behind an Application Load Balancer (ALB) in the us-east-1 Region. Financial clients located globally in Europe and Asia require the lowest possible latency and must avoid routing traffic over the public internet. Additionally, the security team requires that a dynamic blacklist of malicious IP addresses be blocked at the subnet boundary before reaching the ALB.

Which network architecture will meet these requirements?

  1. A
    Configure Amazon Route 53 with latency-based routing to resolve the API hostname to the ALB. Apply stateless Network Access Control Lists (NACLs) to the ALB subnets to block the blacklisted IP addresses.
  2. B
    Establish a single AWS Site-to-Site VPN connection to route all client traffic securely into the VPC. Apply stateless Network Access Control Lists (NACLs) to the ALB subnets to block the blacklisted IP addresses.
  3. Configure AWS Global Accelerator in front of the ALB to onboard client traffic onto the AWS global network at the nearest edge location. Apply stateless Network Access Control Lists (NACLs) to the ALB subnets to block the blacklisted IP addresses.Cevap
  4. D
    Configure AWS Global Accelerator in front of the ALB to onboard client traffic onto the AWS global network. Apply stateful Security Groups to the ALB subnets to deny traffic from the blacklisted IP addresses.

Cevap

Configure AWS Global Accelerator in front of the ALB to onboard client traffic onto the AWS global network at the nearest edge location. Apply stateless Network Access Control Lists (NACLs) to the ALB subnets to block the blacklisted IP addresses.
AWS Global Accelerator uses Anycast IP addresses to route traffic over the high-speed AWS global network from the nearest edge location to the destination ALB, bypassing the public internet and reducing TCP connection establishment time. Using stateless Network Access Control Lists (NACLs) at the subnet level is the correct way to enforce explicit deny rules at the subnet boundary.

Adım Adım Çözüm

1
Identify the primary network optimization requirement.
Since global clients require the lowest possible latency and must avoid routing traffic over the public internet, the solution must route traffic over the private AWS backbone.
AWS Global Accelerator routes TCP/UDP traffic over the AWS global network from the nearest edge location, whereas standard DNS routing (Route 53) still directs traffic over the public internet.
2
Evaluate the security and traffic-filtering requirement.
A blacklist of malicious IP addresses must be blocked at the subnet boundary.
Network Access Control Lists (NACLs) are stateless, operate at the subnet boundary, and support explicit deny rules, making them the correct tool for blocking specific IP addresses before they reach the ALB. Security Groups do not operate at the subnet boundary and do not support deny rules.

Anahtar Kavram

Optimizing global application latency using AWS Global Accelerator and enforcing subnet-level traffic filtering using Network ACLs.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

High-Performing and Scalable Network Architectures

Bu konudan daha fazla soru