Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A media streaming company is migrating its operations to AWS and establishing a multi-account structure with 8 spoke VPCs in the ap-northeast-1 Region. The company needs to design a hybrid connectivity solution to connect these VPCs to an on-premises data center. The design must support direct VPC-to-VPC communication, enable secure access to shared on-premises resources with automatic failover, and resolve internal DNS names hosted in a centralized private hosted zone. Which of the following architectures meets these requirements with the least operational complexity?

  1. A
    Associate a Virtual Private Gateway (VGW) in each spoke VPC to a shared Direct Connect Gateway (DXGW) to route both hybrid traffic and inter-VPC traffic transitively through the DXGW, bypassing Transit Gateway deployment.
  2. B
    Deploy an AWS Transit Gateway (TGW) to connect the spoke VPCs and attach it to a Direct Connect Gateway. Create a centralized Route 53 Private Hosted Zone in a shared services VPC and rely on default VPC DNS resolution without associating the private hosted zone with the other spoke VPCs.
  3. Deploy an AWS Transit Gateway (TGW) to interconnect the spoke VPCs. Connect the TGW to a Direct Connect Gateway associated with an AWS Direct Connect connection for primary hybrid connectivity, and set up an AWS Site-to-Site VPN to the TGW as a backup. Associate the centralized Route 53 Private Hosted Zone with all spoke VPCs across the accounts.Cevap
  4. D
    Deploy an AWS Transit Gateway (TGW) to connect the spoke VPCs. Route all outbound traffic through a single, centralized egress VPC containing one NAT Gateway deployed in a single Availability Zone to route internet-bound traffic, while using a backup AWS Site-to-Site VPN as the primary path.

Cevap

Deploy an AWS Transit Gateway to interconnect the spoke VPCs, connect it to a Direct Connect Gateway with a backup Site-to-Site VPN, and associate the centralized Private Hosted Zone with all spoke VPCs.
The correct design utilizes an AWS Transit Gateway to act as a centralized hub for inter-VPC and hybrid traffic. A Direct Connect Gateway connected to the Transit Gateway provides high-bandwidth primary connectivity to the data center, while a Site-to-Site VPN connected directly to the Transit Gateway serves as an automated backup. Associating the centralized Private Hosted Zone (PHZ) with all VPCs ensures seamless cross-account DNS resolution.

Adım Adım Çözüm

1
Evaluate routing requirements for inter-VPC and hybrid network traffic.
Identify that AWS Transit Gateway is required to act as the central hub to support both VPC-to-VPC and VPC-to-on-premises transitive routing.
Direct Connect Gateway alone does not support routing between attached VPCs, making a Transit Gateway necessary.
2
Configure the primary and backup hybrid connections with automated failover.
Connect the Transit Gateway to a Direct Connect Gateway for high-speed primary access, and attach a Site-to-Site VPN to the Transit Gateway for backup path failover.
This establishes physical redundancy and path failover using industry-standard BGP routing.
3
Address DNS resolution requirements for the multi-account structure.
Associate the Route 53 Private Hosted Zone (PHZ) in the central account with all consumer spoke VPCs in the organization.
Private Hosted Zones must be explicitly associated with each VPC in order to resolve queries across different accounts.

Anahtar Kavram

AWS Transit Gateway acts as a cloud router to support transitive routing between multiple VPCs and on-premises networks, integrated with Direct Connect Gateway and Site-to-Site VPN for high availability.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru