Examkin

Soru

Zorluk: ZorHybrid and Multi-Account Network Connectivity Design

An enterprise is implementing a multi-account AWS environment across the `us-east-1` and `us-west-2` regions. Each region contains multiple spoke VPCs in separate AWS accounts. The spoke VPCs in each region are connected to a regional AWS Transit Gateway. The enterprise requires secure, highly available connectivity to its on-premises datacenter. They have established an AWS Direct Connect (DX) connection with a Transit Virtual Interface (VIF) terminating at a Direct Connect Gateway, and a backup AWS Site-to-Site VPN connection. The architecture must route all traffic destined for the on-premises datacenter via the DX connection as the primary path and automatically fail over to the Site-to-Site VPN. Additionally, traffic between the spoke VPCs must be strictly blocked, and the solution must minimize administrative overhead. Which TWO configurations must the solutions architect implement to meet these requirements?

  1. Associate the spoke VPC attachments with a dedicated Spoke Transit Gateway route table, and enable route propagation from both the Direct Connect Gateway and the Site-to-Site VPN attachments to this route table while keeping spoke VPC route propagation disabled.Cevap
  2. Associate the Direct Connect Gateway and Site-to-Site VPN attachments with a dedicated Hybrid Transit Gateway route table, and enable route propagation from all spoke VPC attachments to this route table.Cevap
  3. C
    Connect the Direct Connect Gateway directly to each spoke VPC using Virtual Private Gateways in each account to enable transitive routing and failover between the VPCs without using Transit Gateway.
  4. D
    Associate a single Route 53 Private Hosted Zone for on-premises DNS resolution with a shared services VPC, and rely on Transit Gateway routing to automatically forward DNS queries from all spoke VPCs without associating the zone with those VPCs.
  5. E
    Deploy a single NAT Gateway in one availability zone of a centralized egress VPC in `us-east-1` to route all outbound internet traffic from both regions to minimize NAT Gateway costs.

Cevap

Associate the spoke VPC attachments with a dedicated Spoke Transit Gateway route table, propagating only the hybrid connections (Direct Connect and VPN) routes to it. Also, associate the hybrid connections with a dedicated Hybrid Transit Gateway route table, propagating the spoke VPC routes to it.
To achieve path redundancy and traffic isolation, the architecture uses separate Transit Gateway route tables. The Spoke Transit Gateway route table is associated with the spoke VPCs and only propagates routes from the Direct Connect Gateway and VPN attachments. This allows the spokes to route traffic to the on-premises datacenter without learning routes to other spoke VPCs. The Hybrid Transit Gateway route table is associated with the Direct Connect Gateway and VPN attachments and propagates routes from the spoke VPCs, allowing return traffic to reach the spokes. BGP path selection automatically prefers the Direct Connect path over the VPN path for identical prefix advertisements.

Adım Adım Çözüm

1
Analyze the spoke-to-spoke isolation requirement.
Identify that spoke VPCs must not route traffic to one another, requiring segregation of routing tables on the Transit Gateways.
Standard route propagation in a single route table would allow all VPCs to communicate with each other.
2
Design the Spoke Transit Gateway route table configuration.
Associate all spoke VPC attachments with the Spoke route table and propagate only the Direct Connect Gateway and VPN attachments to this table.
This allows the spokes to learn routes to on-premises while keeping spoke VPC CIDRs out of their routing tables, preventing spoke-to-spoke communication.
3
Design the Hybrid Transit Gateway route table configuration.
Associate the Direct Connect Gateway and VPN attachments with a Hybrid route table and propagate the spoke VPC attachments to this table.
This allows traffic originating from the on-premises network to be correctly routed back to the spoke VPCs.
4
Verify routing preference and failover behavior.
BGP dynamically advertises routes over both Direct Connect (Transit VIF) and Site-to-Site VPN. AWS Transit Gateway prefers the Direct Connect Gateway path over the VPN path for identical prefix advertisements, ensuring automatic failover.
AWS Transit Gateway path selection natively prefers Direct Connect Gateway attachments over VPN attachments for the same prefix.

Anahtar Kavram

AWS Transit Gateway route table association and propagation separation for network isolation (Hub-and-Spoke pattern).
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru