Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network connectivity solution to connect its 25 spoke VPCs in a single AWS Region with its on-premises corporate network. The design requires a highly available, transit hub architecture where spoke VPCs can communicate with each other and with the on-premises network. The primary hybrid connection must use an AWS Direct Connect (DX) connection, and a Site-to-Site VPN connection must serve as a backup path. The system must automatically fail over to the backup VPN path if the DX connection becomes unavailable, without adding unnecessary routing tables or manual intervention.

Which TWO actions should the solutions architect take to implement this architecture?

  1. Deploy an AWS Transit Gateway, attach all spoke VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway using a transit virtual interface (transit VIF) on the DX connection.Cevap
  2. Propagate the on-premises network routes into the Transit Gateway route table from both the Direct Connect Gateway and the Site-to-Site VPN attachments, allowing the Transit Gateway to prefer the Direct Connect path.Cevap
  3. C
    Attach a Virtual Private Gateway (VGW) to each spoke VPC, associate them with the Direct Connect Gateway, and configure VPC peering between all spoke VPCs to allow VPC-to-VPC routing.
  4. D
    Configure static routes for the on-premises IP ranges in the Transit Gateway route table pointing to the Site-to-Site VPN attachment, and propagate the same ranges from the Direct Connect Gateway attachment.
  5. E
    Associate the Route 53 Private Hosted Zone for on-premises DNS resolution directly with the Transit Gateway to automatically enable DNS resolution for all attached VPCs.

Cevap

The solutions architect should deploy an AWS Transit Gateway, attach all spoke VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway using a transit virtual interface. Additionally, they should propagate the on-premises network routes into the Transit Gateway route table from both the Direct Connect Gateway and the Site-to-Site VPN attachments, relying on the Transit Gateway's default route selection logic to prefer the Direct Connect path.
Deploying a Transit Gateway and associating it with a Direct Connect Gateway using a transit VIF establishes a scalable, centralized hub for the spoke VPCs. When the same on-premises prefixes are propagated via BGP from both the Direct Connect Gateway and Site-to-Site VPN attachments, Transit Gateway automatically prefers the Direct Connect Gateway path due to its default route evaluation order (Direct Connect Gateway prefix is preferred over VPN prefix for matching paths). This achieves automatic failover to the VPN if the Direct Connect link fails.

Adım Adım Çözüm

1
Select a centralized transit hub architecture.
Identify AWS Transit Gateway as the standard hub-and-spoke solution to interconnect multiple VPCs and connect them to on-premises networks.
Transit Gateway simplifies configuration by consolidating connections and route tables compared to individual Virtual Private Gateways.
2
Establish the primary path via AWS Direct Connect.
Associate the Transit Gateway with a Direct Connect Gateway using a transit virtual interface (transit VIF).
A transit VIF is required to carry traffic between a Direct Connect Gateway and a Transit Gateway.
3
Establish the backup path and configure routing.
Attach a Site-to-Site VPN to the Transit Gateway and configure BGP propagation for both attachments.
By propagating the same routes via both paths, Transit Gateway uses its default evaluation logic to prioritize Direct Connect over VPN, enabling automated failover.

Anahtar Kavram

AWS Transit Gateway routing evaluation order and hybrid connectivity failover design.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru