Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A gaming company has deployed 1515 VPCs in the `us-west-2` Region across multiple AWS accounts managed under AWS Organizations. The company requires hybrid connectivity to its on-premises data center using an existing 10 Gbps10\text{ Gbps} AWS Direct Connect connection. The architecture must support VPC-to-VPC routing, provide a highly available backup path over the public internet, and minimize administrative overhead. Which solution should a solutions architect recommend?

  1. Deploy an AWS Transit Gateway in the region, attach the 1515 VPCs, and connect it to a Direct Connect Gateway using a transit virtual interface (VIF). Establish an AWS Site-to-Site VPN connection to the Transit Gateway over the public internet to serve as the redundant path, using Border Gateway Protocol (BGP) for dynamic routing.Cevap
  2. B
    Associate all 1515 VPCs directly with a single Direct Connect Gateway using private virtual interfaces (VIFs). Establish an AWS Site-to-Site VPN connection directly from the on-premises data center to each of the 1515 VPCs over the public internet to serve as the backup path.
  3. C
    Deploy an AWS Transit Gateway in the region, attach the 1515 VPCs, and connect it to a Direct Connect Gateway using a private virtual interface (VIF). Establish an AWS Site-to-Site VPN connection to a single NAT Gateway deployed in a central transit VPC to route backup traffic over the public internet.
  4. D
    Establish VPC peering connections in a full-mesh configuration across all 1515 VPCs. Configure a central VPC with a Direct Connect connection using a private virtual interface (VIF) and associate a Route 5353 Private Hosted Zone with the central VPC to handle all hybrid DNS and traffic routing without associating it with the other VPCs.

Cevap

Deploy an AWS Transit Gateway in the region, attach the 1515 VPCs, and connect it to a Direct Connect Gateway using a transit virtual interface (VIF). Establish an AWS Site-to-Site VPN connection to the Transit Gateway over the public internet to serve as the redundant path, using Border Gateway Protocol (BGP) for dynamic routing.
The correct solution leverages AWS Transit Gateway to connect the 1515 VPCs and route traffic transitively. Connecting the Transit Gateway to a Direct Connect Gateway via a transit virtual interface (VIF) allows high-throughput hybrid connectivity. Configuring an AWS Site-to-Site VPN connection to the Transit Gateway over the public internet provides a dynamically routed backup path that can automatically failover using BGP routing.

Adım Adım Çözüm

1
Consolidate multi-account networking using AWS Transit Gateway.
Creates a centralized hub that can attach all 1515 spoke VPCs, enabling spoke-to-spoke routing and reducing point-to-point connections.
Managing individual peerings or VPNs for 1515 VPCs creates excessive administrative overhead.
2
Configure AWS Direct Connect Gateway with a Transit VIF.
Allows the Transit Gateway to connect to the 10 Gbps10\text{ Gbps} Direct Connect connection.
Transit VIF is the required virtual interface type for connecting Direct Connect to an AWS Transit Gateway.
3
Create an AWS Site-to-Site VPN attachment on the Transit Gateway.
Establishes a backup path over the public internet to the same centralized hub.
Attaching the VPN to the Transit Gateway ensures all 1515 VPCs can failover to the VPN backup seamlessly.
4
Configure BGP dynamic routing.
Ensures automatic failover to the VPN connection if the Direct Connect link goes down.
Dynamic routing enables path selection and automatic failover without manual route table updates.

Anahtar Kavram

AWS Transit Gateway serves as a regional network transit hub to interconnect VPCs and on-premises networks, integrating with Direct Connect Gateway via Transit VIFs and supporting VPN failover via dynamic BGP routing.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru