Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

An enterprise is planning to migrate its workloads to AWS and has deployed 8 VPCs across two AWS accounts in the eu-west-1 region. The company requires a hybrid network design to connect these VPCs to its corporate office. The primary connection must be a 1 Gbps AWS Direct Connect connection, with a backup IPsec VPN connection over the internet. The solution must allow all VPCs to communicate with each other and with the corporate office, while minimizing configuration and routing management overhead. Which two options should the solutions architect select to meet these requirements? (Select TWO.)

  1. Deploy an AWS Transit Gateway, attach the 8 VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway connected to the Direct Connect connection.Cevap
  2. Configure an AWS Site-to-Site VPN connection terminated on the AWS Transit Gateway, configuring Border Gateway Protocol (BGP) routing with path prepending to prefer the Direct Connect path.Cevap
  3. C
    Associate the Direct Connect Gateway directly with the 8 VPCs using Virtual Private Gateways to enable VPC-to-VPC routing.
  4. D
    Establish VPC peering connections between all 8 VPCs and use a Direct Connect Gateway associated with all Virtual Private Gateways for on-premises access.
  5. E
    Create a Route 53 Private Hosted Zone in one account and associate it with the Direct Connect Gateway to enable DNS resolution across all VPCs.

Cevap

Deploy an AWS Transit Gateway, attach the 8 VPCs to it, and associate the Transit Gateway with a Direct Connect Gateway connected to the Direct Connect connection; and configure an AWS Site-to-Site VPN connection terminated on the AWS Transit Gateway, configuring Border Gateway Protocol (BGP) routing with path prepending to prefer the Direct Connect path.
The correct answer combines AWS Transit Gateway to enable transitive VPC-to-VPC communication and simplifies routing configuration. Associating the Transit Gateway with a Direct Connect Gateway allows the on-premises environment to access all VPCs via a single Direct Connect connection. Attaching an AWS Site-to-Site VPN to the Transit Gateway and configuring BGP with AS path prepending ensures that the VPN acts as a standby backup connection and traffic is routed through it only if the primary Direct Connect connection fails.

Adım Adım Çözüm

1
Analyze the transitive connectivity requirement.
Determined that all 8 VPCs must communicate with each other and on-premises, which requires a hub-and-spoke model to avoid the high administrative overhead of a full mesh of VPC peering connections.
VPC peering does not scale easily, and Direct Connect Gateway alone does not support transitive routing between attached VPCs.
2
Select the core routing component.
AWS Transit Gateway is selected to act as the regional cloud router, interconnecting all 8 VPCs via Transit Gateway attachments.
Transit Gateway simplifies the architecture by reducing the network complexity to a single hub connection per VPC.
3
Integrate hybrid connectivity and configure failover.
Associate the Transit Gateway with a Direct Connect Gateway for the primary path. Attach an AWS Site-to-Site VPN to the same Transit Gateway as the backup path, configuring BGP with AS path prepending on the VPN connection.
This establishes a reliable active/passive hybrid network topology where the VPN carries traffic only if the Direct Connect link is unavailable.

Anahtar Kavram

AWS Transit Gateway facilitates transitive routing between multiple VPCs and centralizes hybrid connectivity through Direct Connect Gateways and VPNs.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru