Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A biotechnology company has eight spoke VPCs split across two AWS accounts in a single AWS Region, and one shared services VPC in a third account. The company requires all spoke VPCs to access resources in the shared services VPC and an on-premises data center, but spoke VPCs must be strictly prevented from communicating with one another. The hybrid connection to the data center is established using an AWS Direct Connect (DX) connection. Which design should a Solutions Architect recommend to meet these requirements with the least operational overhead?

  1. A
    Create a Direct Connect Gateway and associate all eight spoke VPCs, the shared services VPC, and the on-premises Direct Connect virtual interface directly to the Direct Connect Gateway. Use Direct Connect Gateway routing policies to control traffic propagation between the VPCs.
  2. Deploy an AWS Transit Gateway. Create two Transit Gateway route tables: one for the spoke VPCs and one for the shared services VPC and the Direct Connect Gateway. Associate the spoke VPC attachments with the spoke route table, propagating routes only to the shared services VPC and the Direct Connect Gateway. Associate the shared services VPC and Direct Connect Gateway attachments with the second route table, propagating routes to all spoke VPCs.Cevap
  3. C
    Deploy an AWS Transit Gateway. Create a single Transit Gateway route table and associate all VPC attachments and the Direct Connect Gateway with it. To resolve DNS queries for on-premises resources, deploy a Route 53 Private Hosted Zone in the shared services account without associating it with the spoke VPCs.
  4. D
    Deploy an AWS Transit Gateway and set up a single Transit Gateway route table. Attach all spoke VPCs and the shared services VPC to the Transit Gateway. Route all internet-bound and on-premises traffic through a single NAT Gateway deployed in one Availability Zone of the shared services VPC to centralize routing.

Cevap

Deploy an AWS Transit Gateway and configure two distinct Transit Gateway route tables to isolate the spoke VPCs from each other while permitting routing to the shared services VPC and the Direct Connect Gateway.
The correct design utilizes AWS Transit Gateway with two distinct route tables to create separate routing domains. The spoke route table is associated with the spoke VPC attachments and only contains routes for the shared services VPC and the on-premises network via the Direct Connect Gateway. Because it does not contain routes to other spoke VPCs, spoke-to-spoke communication is prevented. The shared services and Direct Connect Gateway attachments are associated with a second route table that contains routes to all spoke VPCs, allowing bidirectional traffic to those destinations.

Adım Adım Çözüm

1
Determine the traffic isolation and transit routing requirements between the spoke VPCs, shared services VPC, and on-premises data center.
Identify that spoke VPCs must be isolated from one another but must be able to reach the shared services VPC and the on-premises network.
This establishes the logical traffic separation and routing paths required for the network design.
2
Create separate routing domains using AWS Transit Gateway route tables.
Define one Transit Gateway route table for spoke VPCs and a separate route table for the shared services VPC and the Direct Connect Gateway.
Separating the route tables allows route advertisements and associations to be configured independently per attachment group.
3
Associate and propagate routes across the Transit Gateway route tables.
Associate spoke VPC attachments with the spoke route table, and only propagate routes from the shared services VPC and the Direct Connect Gateway. Associate the shared services and Direct Connect Gateway attachments with their own route table, propagating routes to all spoke VPCs.
This configuration ensures that spoke VPCs have no paths to reach other spokes, achieving isolation, while allowing bidirectional communication to the hub resources.

Anahtar Kavram

AWS Transit Gateway route tables can be used to establish isolated routing domains (VRFs) to control spoke-to-spoke communication in multi-account networks.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru