Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network architecture for 15 AWS accounts, each containing a VPC in the eu-west-1 Region. The VPCs need to communicate with each other and with an on-premises data center. The primary connection must be an AWS Direct Connect link, and a Site-to-Site VPN must serve as the backup connection. Both connections will use BGP. The architecture must ensure path symmetry, automatic failover, and minimize administrative overhead. Which configuration meets these requirements?

  1. Attach the Direct Connect Gateway and the Site-to-Site VPN to an AWS Transit Gateway. Advertise the same on-premises IP prefixes via BGP over both paths. Configure the customer gateway to assign a higher BGP local preference for routes received over the Direct Connect connection, and rely on the Transit Gateway's default path selection to prefer the Direct Connect Gateway over the VPN.Cevap
  2. B
    Connect the Direct Connect Gateway to each spoke VPC using private virtual interfaces, and configure the Site-to-Site VPN to terminate on the AWS Transit Gateway. Set up static routes in the spoke VPC route tables pointing to the Direct Connect Gateway as primary and the Transit Gateway as backup.
  3. C
    Attach the Direct Connect Gateway and the Site-to-Site VPN to the AWS Transit Gateway. Associate the on-premises Route 53 Private Hosted Zone directly with the Transit Gateway to resolve on-premises domain names from the spoke VPCs.
  4. D
    Attach the Direct Connect Gateway to the AWS Transit Gateway. Terminate the backup Site-to-Site VPN connection on a single NAT Gateway located in a centralized services VPC to consolidate outbound internet-bound and VPN failover traffic.

Cevap

Attach the Direct Connect Gateway and the Site-to-Site VPN to an AWS Transit Gateway. Advertise the same on-premises IP prefixes via BGP over both paths. Configure the customer gateway to assign a higher BGP local preference for routes received over the Direct Connect connection, and rely on the Transit Gateway's default path selection to prefer the Direct Connect Gateway over the VPN.
The correct configuration uses AWS Transit Gateway to centralize connection management for the 15 accounts. By advertising identical prefixes over both BGP sessions, failover is managed dynamically. Traffic from AWS to the data center automatically prefers the Direct Connect Gateway over VPN because AWS Transit Gateway's route evaluation rules prioritize Direct Connect over VPN for matching prefix lengths. Traffic from the data center to AWS is kept symmetric by configuring the customer gateway to prefer the Direct Connect path (typically using a higher BGP local preference).

Adım Adım Çözüm

1
Consolidate multi-account connections by attaching the AWS Direct Connect Gateway (using a transit virtual interface) and the AWS Site-to-Site VPN to an AWS Transit Gateway.
This establishes a hub-and-spoke topology where all 15 spoke VPCs can access both hybrid paths through a centralized gateway.
Reduces administrative overhead by avoiding point-to-point connections between each VPC and the data center.
2
Enable dynamic routing by advertising the same on-premises IP prefixes via BGP over both the Direct Connect and the VPN paths.
Dynamic routing tables are populated on both AWS and on-premises sides, enabling automatic failover if one path becomes unavailable.
Avoids the administrative overhead of managing static routes across multiple VPCs and accounts.
3
Configure the customer gateway router with BGP local preference to favor the Direct Connect path for outbound traffic.
On-premises outbound traffic will utilize the Direct Connect connection under normal conditions, failing over to VPN only if the Direct Connect link goes down.
Ensures routing symmetry and control over outbound traffic from the on-premises data center.
4
Rely on AWS Transit Gateway's default BGP route evaluation order.
When Transit Gateway receives the same prefix from both DXGW (transit VIF) and VPN, it automatically prefers the DXGW path.
Ensures AWS-to-on-premises traffic prefers the higher-bandwidth Direct Connect path without manual intervention.

Anahtar Kavram

AWS Transit Gateway simplifies hybrid connectivity for multi-account environments. When routing identical prefixes advertised via BGP, Transit Gateway automatically prioritizes Direct Connect Gateway (transit VIF) attachments over VPN attachments. For the reverse path, customer gateways must be configured with BGP metrics (such as local preference) to ensure routing symmetry.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru