An enterprise is designing a hybrid network architecture to connect spoke VPCs in a single AWS Region to its on-premises data center. The primary connectivity must be established over a AWS Direct Connect connection, with a backup AWS Site-to-Site VPN connection over the public internet. All outbound internet traffic from the spoke VPCs must be routed through a centralized egress VPC for security inspection. The solution must minimize routing complexity, avoid single points of failure, and support transitive routing between the VPCs.
Which of the following configuration steps should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Attach the Direct Connect Gateway (DXGW) to an AWS Transit Gateway using a Transit Virtual Interface (Transit VIF), and configure a backup AWS Site-to-Site VPN connection attached directly to the Transit Gateway.Cevap
- In the Transit Gateway route table associated with the spoke VPCs, add a route for pointing to the egress VPC attachment, and configure the spoke VPC subnet route tables with a default route pointing to the Transit Gateway.Cevap
- CConfigure the Direct Connect Gateway (DXGW) to route traffic transitively between the spoke VPCs, and configure an AWS Site-to-Site VPN connection to a Virtual Private Gateway (VGW) in each spoke VPC.
- DAssociate the internal Route 53 Private Hosted Zones with the egress VPC only, and configure a public virtual interface (VIF) on the Direct Connect connection to handle private multi-account VPC-to-VPC routing.
- EDeploy a single NAT Gateway in a single Availability Zone within the egress VPC, and update the spoke VPC subnet route tables to target the NAT Gateway directly for outbound traffic.
Cevap
Attach the Direct Connect Gateway (DXGW) to an AWS Transit Gateway using a Transit Virtual Interface (Transit VIF), configure a backup AWS Site-to-Site VPN connection attached directly to the Transit Gateway, add a route for in the Transit Gateway route table pointing to the egress VPC attachment, and configure spoke VPC subnet route tables to route default traffic to the Transit Gateway.
The correct solution involves deploying AWS Transit Gateway to handle both transitive VPC-to-VPC routing and centralized egress. The Direct Connect Gateway attaches to the Transit Gateway using a Transit VIF to scale hybrid bandwidth, while a backup AWS Site-to-Site VPN connection attaches directly to the Transit Gateway to provide a redundant path. Outbound internet traffic is centralized by directing spoke VPC default routes () to the Transit Gateway, and configuring the Transit Gateway's route tables to forward all traffic to the egress VPC attachment.
Adım Adım Çözüm
Anahtar Kavram
AWS Transit Gateway acts as a centralized cloud router that simplifies hybrid connectivity by supporting Transit VIFs on Direct Connect Gateways and Site-to-Site VPNs, and enables centralized egress architecture by routing default routes () across VPC attachments.
Tahmini Süre:2m 0s