Examkin

Soru

Zorluk: ZorHybrid and Multi-Account Network Connectivity Design

A financial services company is designing a hybrid network architecture for its multi-account environment on AWS. The environment contains 3535 spoke VPCs in a single AWS Region: 1515 Production VPCs and 2020 Development VPCs. The company's on-premises infrastructure consists of a corporate headquarters connected via AWS Direct Connect and a backup recovery center connected via an IPsec VPN.

The network design must satisfy the following requirements:
- All spoke VPCs must have bi-directional connectivity with the corporate headquarters and the recovery center.
- Production VPCs must be able to communicate with each other.
- Development VPCs must be completely isolated from each other and from the Production VPCs.
- Administrative overhead for routing configuration must be minimized.

Which network architecture and routing configuration should the solutions architect implement?

  1. A
    Create an AWS Transit Gateway with the default route table and default route propagation enabled. Attach all Production VPCs, Development VPCs, the Direct Connect gateway, and the VPN to the Transit Gateway. Implement Network Access Control Lists (NACLs) in all Development VPC subnets to explicitly deny traffic from the CIDR blocks of all other Development and Production VPCs.
  2. B
    Create an AWS Direct Connect gateway and associate it with virtual private gateways in all 3535 spoke VPCs to enable hybrid connectivity. To implement VPC-to-VPC communication, establish a full mesh of VPC peering connections among the 1515 Production VPCs. For the 2020 Development VPCs, do not establish any VPC peering connections to ensure their isolation from each other.
  3. Create an AWS Transit Gateway. Create three Transit Gateway route tables: Production, Development, and Hybrid. Associate the Production VPC attachments with the Production route table, and enable route propagation from the Production VPCs, the Direct Connect gateway, and the VPN. Associate the Development VPC attachments with the Development route table, and enable route propagation only from the Direct Connect gateway and the VPN. Associate the Direct Connect gateway and VPN attachments with the Hybrid route table, and enable route propagation from all Production and Development VPCs.Cevap
  4. D
    Create an AWS Transit Gateway. Create two Transit Gateway route tables: Spoke and Hybrid. Associate all Production and Development VPC attachments with the Spoke route table, and enable route propagation for all VPC and hybrid attachments. Associate the Direct Connect gateway and VPN attachments with the Hybrid route table, and enable route propagation from the Production VPCs only. Configure security groups in the Development VPCs to deny inbound traffic from other Development VPC CIDR ranges.

Cevap

Create an AWS Transit Gateway with three separate route tables (Production, Development, and Hybrid) to separate routing domains, thereby ensuring proper network isolation and hybrid connectivity.
The correct configuration uses an AWS Transit Gateway with three separate route tables to isolate traffic domains. The Production route table enables local VPC-to-VPC communication and hybrid routing. The Development route table does not propagate the Development VPCs, which prevents them from routing traffic to each other. The Hybrid route table propagates all VPCs to allow return traffic from the on-premises networks back to all spoke VPCs.

Adım Adım Çözüm

1
Identify the connectivity and isolation requirements for the spoke VPCs and on-premises endpoints.
There are 1515 Production VPCs that need inter-communication and hybrid access, 2020 Development VPCs that need hybrid access but absolute isolation from each other and from Production, and corporate/recovery networks that need access to all VPCs.
Understanding the required traffic paths is necessary to design the routing domains.
2
Evaluate scale limitations of Direct Connect Gateway and VPC peering.
Direct Connect Gateway only supports up to 1010 Virtual Private Gateway associations, and full-mesh VPC peering for 1515 Production VPCs requires 105105 peering connections, making both options unsuitable.
This rules out direct Direct Connect Gateway association and manual VPC peering at this scale.
3
Design Transit Gateway route tables for spoke isolation and hybrid routing.
Create three route tables: Production (associated with Production VPCs, propagating Production and hybrid paths), Development (associated with Development VPCs, propagating only hybrid paths to prevent spoke-to-spoke routing), and Hybrid (associated with hybrid connections, propagating all spoke VPCs so the hybrid network can route replies back).
This utilizes Transit Gateway route domain separation to meet the isolation and connectivity requirements with minimal administrative overhead.

Anahtar Kavram

AWS Transit Gateway route domain separation using multiple route tables to enforce traffic isolation in a multi-account spoke VPC architecture.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru