QuestionQ241

Network Design

A retail company is moving its on-premises application to the AWS Cloud. At present, the company operates two on-premises data center locations. One data center is on the east coast of the United States, and the other is on the west coast.

Each data center runs four database systems. The largest database system contains 500 GB of data. The data centers are linked by two 10 GbE circuits for data synchronization. Each data center has two independent 1 GbE upstream internet connections. The company plans to use eight total VPCs to support its multiple business units. Four VPCs will be in the us-east-1 Region, and four VPCs will be in the us-west-2 Region.

A network engineer must design a connectivity solution that enables VPC-to-VPC connectivity. The solution must also provide secure connections between the on-premises data centers and AWS during the migration. The company anticipates traffic spikes between the VPCs during database synchronization. The company wants to execute the migration during one weekend and as quickly as technically possible. The company also wants to reduce long-term operational and human-resources costs.

Which combination of steps meets these requirements?

Choose two
  • A Deploy one transit gateway and attach all VPCs to it. Update the transit gateway and VPC route tables to allow any VPC to connect to any other VPC.
  • B Configure VPC peering between all the VPCs. Update the VPC route tables to allow connectivity.
  • C Provision two AWS Direct Connect connections from two Direct Connect locations that serve us-east-1 and us-west-2 to provide connectivity between the data centers and AWS.
  • D Provision one transit gateway VPN attachment for each data center to build connectivity between the on-premises data centers and AWS VPCs.
  • E Provision one AWS Site-to-Site VPN connection for each data center and for each VPC to build connectivity between the on-premises data centers and AWS VPCs.
Explanation

A single transit gateway with all eight VPCs attached (and inter-Region peering) provides any-to-any VPC connectivity with far less long-term operational overhead than a full VPC-peering mesh (option B), which scales poorly across two Regions. For on-premises connectivity that can be stood up in a single weekend, Direct Connect (option C) is disqualified because provisioning a new Direct Connect connection takes weeks. One transit gateway VPN attachment per data center (option D) can be established immediately, is highly available (dual tunnels), and leaves only two attachments to operate. Option E provisions a VPN per data center per VPC (sixteen connections), which is the opposite of low operational cost.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!