Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A digital media platform is designing a network architecture to connect 1010 spoke VPCs in a single AWS Region. The architecture must enable these VPCs to communicate with one another for database replication and share a centralized egress point for internet traffic. Additionally, all VPCs must have access to a shared on-premises development server via an existing AWS Direct Connect connection. The provider wants to minimize the number of point-to-point connections and simplify routing management.

Which solution should a solutions architect recommend?

  1. Deploy an AWS Transit Gateway to interconnect all spoke VPCs. Create a centralized egress VPC containing a redundant NAT Gateway pool and attach it to the Transit Gateway. Connect the Transit Gateway to an AWS Direct Connect Gateway that is associated with the on-premises Direct Connect connection. Configure Transit Gateway route tables to route inter-spoke traffic, on-premises traffic, and internet-bound traffic to their respective attachments.Cevap
  2. B
    Associate all spoke VPCs directly with a single Direct Connect Gateway connected to the on-premises environment. Configure the Direct Connect Gateway to route traffic transitively between the spoke VPCs and to direct outbound internet traffic to a NAT Gateway deployed in a shared services VPC.
  3. C
    Interconnect all spoke VPCs using a full mesh of VPC Peering connections. Deploy a single NAT Gateway in one of the spoke VPCs to handle centralized internet egress for all VPCs, and connect that same VPC to the on-premises environment using an AWS Site-to-Site VPN.
  4. D
    Deploy an AWS Transit Gateway to connect the spoke VPCs. Associate a Route 53 Private Hosted Zone containing the on-premises server DNS records with the Transit Gateway directly, and rely on the Transit Gateway to automatically forward DNS queries from all spoke VPCs to the on-premises DNS servers.

Cevap

Deploy an AWS Transit Gateway to interconnect all spoke VPCs, create a centralized egress VPC with a NAT Gateway pool, and associate the Transit Gateway with a Direct Connect Gateway for hybrid connectivity.
The correct solution uses AWS Transit Gateway to establish a hub-and-spoke topology, which supports transitive routing between all attached spoke VPCs and a centralized egress VPC containing NAT Gateways. It also associates the Transit Gateway with a Direct Connect Gateway to enable on-premises connectivity for all spokes. This minimizes administrative overhead and scales efficiently.

Adım Adım Çözüm

1
Interconnect the VPCs using a hub-and-spoke model.
Deploy an AWS Transit Gateway and attach all 10 spoke VPCs to it. This enables full mesh transitive routing between all spokes while keeping connections to a minimum.
Transit Gateway natively supports routing traffic between attached VPCs without requiring point-to-point peering connections.
2
Establish the hybrid network connection to the on-premises environment.
Connect the Transit Gateway to an AWS Direct Connect Gateway (DXGW) associated with the on-premises Direct Connect virtual interface.
Direct Connect Gateway supports attaching to Transit Gateways across accounts and regions, enabling all attached spoke VPCs to route traffic to the on-premises network.
3
Centralize internet egress traffic.
Deploy a dedicated egress VPC with NAT Gateways in multiple Availability Zones, attach this VPC to the Transit Gateway, and configure the route tables of the spoke VPCs to point default route (0.0.0.0/0) traffic to the Transit Gateway.
This centralizes public egress management, reduces the cost of maintaining NAT Gateways in every spoke VPC, and avoids the transitive routing limitations of VPC Peering.

Anahtar Kavram

AWS Transit Gateway transitive routing and hybrid connectivity limits
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru