Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

An enterprise manages an AWS Organization with fifteen VPCs in a single AWS Region: five Production VPCs, five Development VPCs, and five Shared Services VPCs. The enterprise has established an AWS Direct Connect connection to its on-premises data center. The network design must satisfy the following requirements:

* Production and Development VPCs must be completely isolated from each other.
* Both Production and Development VPCs must be able to communicate with the Shared Services VPCs.
* Only Production VPCs and Shared Services VPCs are permitted to communicate with the on-premises data center.
* Administrative overhead and routing table complexity must be minimized.

The enterprise deploys an AWS Transit Gateway and connects it to a Direct Connect Gateway using a transit virtual interface (Transit VIF).

Which TWO actions should the Solutions Architect take to configure the Transit Gateway routing to meet these requirements? (Select TWO.)

  1. Create three distinct Transit Gateway route tables designated for Production, Development, and Hybrid/Shared Services. Associate the Production VPC attachments, Development VPC attachments, and the Direct Connect Gateway attachment with their corresponding route tables.Cevap
  2. Configure route propagations such that the Production route table propagates Shared Services and Direct Connect Gateway attachments; the Development route table propagates only Shared Services attachments; and the Hybrid/Shared Services route table propagates Production, Shared Services, and Direct Connect Gateway attachments.Cevap
  3. C
    Configure a single, shared Transit Gateway route table for all attachments. Implement network isolation by associating a Route 53 Private Hosted Zone only with the Production and Shared Services VPCs, using DNS resolution restrictions to block the Development VPC's access to the on-premises network.
  4. D
    Configure a single, shared Transit Gateway route table. Route all cross-VPC and hybrid traffic through a single NAT Gateway deployed in the Shared Services VPC to manage network access lists and traffic filtering centrally.

Cevap

Create three distinct Transit Gateway route tables for Production, Development, and Hybrid/Shared Services VPCs. Associate each attachment with its respective route table, and configure route propagations so that routes are shared only between allowed destinations, keeping Production and Development isolated while selectively enabling hybrid connectivity.
To achieve the required network isolation and selective hybrid connectivity, the Solutions Architect must implement a Transit Gateway hub-and-spoke model with multiple route tables. Creating three separate route tables (Production, Development, and Hybrid/Shared Services) creates isolated routing domains. The Production route table associates with Production VPCs and propagates Shared Services and Direct Connect Gateway attachments, enabling connectivity to those destinations. The Development route table associates with Development VPCs and propagates only Shared Services VPCs, preventing communication with Production VPCs and the on-premises network. The Hybrid/Shared Services route table associates with Shared Services and Direct Connect Gateway attachments, and propagates Production, Shared Services, and Direct Connect Gateway attachments. This ensures that on-premises traffic can only route to Production and Shared Services VPCs, while Shared Services VPCs can communicate with all environments.

Adım Adım Çözüm

1
Identify the network segmentation and routing requirements.
Production and Development must be isolated; both need Shared Services access; only Production and Shared Services need hybrid access.
This establishes the necessary boundaries for configuring AWS Transit Gateway route tables and association domains.
2
Design route table associations for Transit Gateway attachments.
Associate Production VPC attachments to a Production route table, Development VPC attachments to a Development route table, and Shared Services and Direct Connect Gateway attachments to a Hybrid/Shared Services route table.
Associating attachments to separate route tables defines which routing table is looked up when traffic originates from those attachments.
3
Design route propagations to dynamically share routes.
Propagate Shared Services and Direct Connect Gateway attachments into the Production route table; propagate only Shared Services into the Development route table; propagate Production, Shared Services, and Direct Connect Gateway attachments into the Hybrid/Shared Services route table.
This ensures that traffic from the Production and Development VPCs can reach Shared Services, but they cannot reach each other. Furthermore, only Production and Shared Services VPCs can route to and from the Direct Connect Gateway.

Anahtar Kavram

Transit Gateway route table association and propagation properties allow for fine-grained routing segmentation and isolation in a multi-account AWS environment.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru