Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A company has 1515 AWS accounts in an AWS Organization, with each account containing a single VPC in the `us-east-1` Region. The company wants to establish hybrid connectivity between these VPCs and its on-premises data center using an existing 10 Gbps10\text{ Gbps} AWS Direct Connect connection. The architecture must meet the following requirements:

- Spoke VPCs must be able to send and receive traffic to and from the on-premises data center.
- Spoke VPCs must be strictly isolated from one another at the network routing level.
- The solution must minimize administrative overhead as new VPCs are added.

Which configuration meets these requirements?

  1. Configure an AWS Transit Gateway (TGW) and attach all spoke VPCs. Attach a Direct Connect Gateway (DXGW) to the TGW using a transit virtual interface. Create two TGW route tables. Associate the spoke VPC attachments with the first TGW route table and configure a route pointing to the DXGW attachment. Associate the DXGW attachment with the second TGW route table and propagate the spoke VPC routes to it.Cevap
  2. B
    Associate all 1515 spoke VPCs directly to a single Direct Connect Gateway using private virtual interfaces. In the Direct Connect Gateway settings, disable route propagation between the associated VPCs to enforce network isolation.
  3. C
    Configure an AWS Transit Gateway (TGW) and attach all spoke VPCs and the Direct Connect Gateway (DXGW) attachment. Use the default TGW route table to associate and propagate all attachments, allowing full routing. In each spoke VPC, configure security groups to block inbound and outbound traffic originating from the CIDR ranges of all other spoke VPCs.
  4. D
    Establish VPC peering connections between each spoke VPC and a centralized Transit VPC. Connect the Transit VPC to the on-premises data center using a Direct Connect Gateway. Configure the route tables in the Transit VPC to route traffic between the spoke VPCs and the on-premises environment.

Cevap

Configure an AWS Transit Gateway (TGW) with two route tables. Associate the spoke VPC attachments with the first TGW route table, and add a static route pointing to the Direct Connect Gateway (DXGW) attachment. Associate the DXGW attachment with the second TGW route table, and enable route propagation from the spoke VPCs to this second table.
The correct architecture uses AWS Transit Gateway route domains. By creating two TGW route tables, you can isolate routing. Spoke VPC attachments associate with the first route table and have a route only to the Direct Connect Gateway (DXGW) attachment, preventing them from seeing each other's routes. The DXGW attachment associates with the second route table, which gets populated with the spoke VPC routes via propagation, enabling bidirectional hybrid connectivity with on-premises while maintaining isolation.

Adım Adım Çözüm

1
Deploy AWS Transit Gateway (TGW) in the central network account and share it with the spoke accounts using AWS Resource Access Manager (RAM).
The TGW is available for attachments in all spoke accounts.
Centralizing the transit hub reduces administrative overhead and enables multi-account connectivity.
2
Attach all 1515 spoke VPCs to the TGW and associate the Direct Connect Gateway (DXGW) with the TGW via a transit virtual interface (transit VIF).
Network attachments are established between the TGW, the spoke VPCs, and the on-premises environment.
Allows physical routing paths to be defined between all endpoints.
3
Create two Transit Gateway route tables. Associate the spoke VPC attachments with the first table and add a route to the DXGW. Associate the DXGW attachment with the second table and enable propagation from the spoke VPCs.
The spoke VPCs can only resolve routes to the DXGW (on-premises), while the DXGW can resolve routes to all spoke VPCs.
This establishes route domain isolation, preventing spoke VPCs from routing traffic to each other while ensuring bidirectional communication with the on-premises data center.

Anahtar Kavram

AWS Transit Gateway Route Table Isolation (Route Domains) for Hybrid Connectivity
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru