Examkin

Soru

Zorluk: Çok zorAWS VPN, Direct Connect, and Transit Gateway Management

A company connects several VPCs to an on-premises datacenter (CIDR 192.168.0.0/16192.168.0.0/16) using an AWS Transit Gateway. The Transit Gateway has two attachments: an AWS Direct Connect Gateway (associated with a Transit VIF) and an AWS Site-to-Site VPN. Both attachments are configured to dynamically propagate routes to the Transit Gateway route table using BGP. During an operational review, a SysOps Administrator discovers that all outbound traffic from the VPCs to the on-premises network is traversing the Site-to-Site VPN connection instead of the Direct Connect path, despite the Direct Connect connection being fully operational and active. Which of the following is the most likely cause of this routing behavior?

  1. A
    The dynamic BGP routes advertised over the Site-to-Site VPN have a shorter AS-Path length than those advertised over the Direct Connect Gateway, causing the Transit Gateway to prefer the VPN path.
  2. B
    The VPC subnet route tables do not contain a route pointing to the Transit Gateway for the 192.168.0.0/16192.168.0.0/16 prefix, which defaults the outbound traffic to the VPN path.
  3. A static route for 192.168.0.0/16192.168.0.0/16 pointing to the Site-to-Site VPN attachment is configured in the Transit Gateway route table.Cevap
  4. D
    The Transit Gateway route table is using a route evaluation order where dynamically propagated routes from VPN attachments take precedence over propagated routes from Direct Connect Gateway attachments.

Cevap

A static route for 192.168.0.0/16192.168.0.0/16 pointing to the Site-to-Site VPN attachment is configured in the Transit Gateway route table.
The correct answer identifies that a static route configured in a Transit Gateway route table always takes precedence over dynamically propagated routes. Since the static route targets the VPN attachment, it overrides the dynamic BGP route propagated by the Direct Connect Gateway, forcing all traffic to use the VPN connection.

Adım Adım Çözüm

1
Analyze the Transit Gateway route table evaluation logic for prefix length matches.
Confirm that both paths advertise the same destination CIDR of 192.168.0.0/16192.168.0.0/16, meaning longest prefix match does not differentiate them.
Longest prefix match is the primary rule for routing decisions.
2
Evaluate the precedence between static and dynamic (propagated) routes in the Transit Gateway route table.
Determine that static routes always take precedence over dynamic/propagated routes.
If a static route exists pointing to the VPN attachment for the target prefix, it overrides any dynamically learned BGP routes.
3
Confirm the default preference for dynamic BGP routes when no static routes override them.
Direct Connect Gateway attachments are preferred over VPN attachments when routing dynamic prefixes of equal length.
Understanding this default dynamic preference rules out AS-Path or other BGP attributes from shifting the preference to VPN if dynamic propagation is working normally.

Anahtar Kavram

Transit Gateway Route Evaluation Priority
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

AWS VPN, Direct Connect, and Transit Gateway Management

Bu konudan daha fazla soru