Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A logistics company is designing a hybrid network to connect 2020 spoke VPCs in the `us-east-1` Region to its on-premises data center. The architecture must enable all spoke VPCs to communicate with each other and with the on-premises network. The connectivity to the on-premises data center must be redundant, using a 10 Gbps10\text{ Gbps} AWS Direct Connect connection as the primary path and an AWS Site-to-Site VPN connection over the internet as the backup path. The solution must minimize routing complexity, support automatic failover, and minimize administrative overhead. Which two configuration steps should the Solutions Architect implement to achieve this goal? (Select TWO.)

  1. Attach the 2020 spoke VPCs, the Direct Connect Gateway (DXGW) using a transit virtual interface (VIF), and the Site-to-Site VPN to a central AWS Transit Gateway.Cevap
  2. Enable BGP route propagation for both the Direct Connect Gateway attachment and the Site-to-Site VPN attachment in the Transit Gateway route table associated with the spoke VPCs.Cevap
  3. C
    Establish VPC peering connections between all 2020 spoke VPCs, and associate the Direct Connect Gateway directly with the Virtual Private Gateways of each spoke VPC to route hybrid traffic.
  4. D
    Create a Route 53 Private Hosted Zone (PHZ) containing on-premises records in a centralized Shared Services VPC, and associate the PHZ directly with the AWS Transit Gateway to enable domain resolution for all spoke VPCs.
  5. E
    Deploy a single centralized NAT Gateway in a Shared Services VPC, and configure the spoke VPC route tables to route all hybrid traffic to this NAT Gateway to handle failover between the Direct Connect and VPN connections.

Cevap

Attach the spoke VPCs, the Direct Connect Gateway via a transit virtual interface, and the Site-to-Site VPN to a central AWS Transit Gateway, and enable BGP route propagation for both hybrid attachments in the Transit Gateway route table.
The correct architecture uses a central AWS Transit Gateway to interconnect the 2020 spoke VPCs and handle hybrid connectivity. By attaching both the Direct Connect Gateway (using a transit VIF) and the Site-to-Site VPN to the Transit Gateway and enabling BGP route propagation, the Transit Gateway dynamically learns routes to the on-premises network. When identical prefixes are propagated over both paths, AWS Transit Gateway's default route selection logic prioritizes the Direct Connect Gateway attachment over the VPN attachment, ensuring that the primary path is used and that traffic automatically fails over to the VPN if the Direct Connect link drops.

Adım Adım Çözüm

1
Consolidate spoke VPC and hybrid connections into AWS Transit Gateway.
Created a central Transit Gateway with attachments for all 2020 spoke VPCs, the Direct Connect Gateway (using a transit VIF), and the Site-to-Site VPN connection.
Transit Gateway acts as a cloud router, enabling any-to-any communication and centralizing connection points to reduce administrative overhead compared to VPC peering meshes.
2
Enable dynamic routing via BGP propagation.
Propagated on-premises routes from both the Direct Connect Gateway and the VPN attachments into the Transit Gateway route table.
By propagating both paths via BGP, the Transit Gateway automatically applies path selection algorithms. Direct Connect Gateway attachments are prioritized over VPN attachments by default when identical prefixes are received, facilitating automatic failover without manual route table changes.

Anahtar Kavram

AWS Transit Gateway path selection behavior for BGP-propagated routes automatically prefers Direct Connect Gateway over Site-to-Site VPN, enabling dynamic and automatic failover.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru