AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ283

Network Design

A company has established connectivity between its on-premises data center in Paris, France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection to a transit gateway hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs attached to the transit gateway.

The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company must migrate the workloads from the Tokyo office to AWS. These workloads must be able to access the company’s existing workloads in Paris. The company must also establish connectivity between the Tokyo office building and the Paris data center.

In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migrating the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet.

Which set of steps should a network engineer take to meet these requirements?

  • A
    1. Create public subnets in the Tokyo VPC to migrate the workloads into.2. Configure an internet gateway for the Tokyo office to reach the Tokyo VPC.3. Configure security groups on the Tokyo workloads to only allow traffic from the Tokyo office and the Paris workloads.4. Create peering connections between the Tokyo VPC and the Paris VPCs.5. Configure a VPN connection between the Paris data center and the Tokyo office by using existing routers.
  • B
    1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway.3. Set up a new Direct Connect connection from the Tokyo office to the Tokyo transit gateway.4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
  • C
    1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC.2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway.3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target.4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
  • D
    1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway.2. Create an association between the Paris transit gateway and the Tokyo VPC.3. Configure routing on the Paris transit gateway to allow data to flow between sites and the VPC.
Explanation

An AWS Site-to-Site VPN can provide the rapidly deployable private connection from the Tokyo office to a Tokyo transit gateway. Attaching the Tokyo VPC to that transit gateway and peering it with the Paris transit gateway enables routing between the Tokyo VPN and VPC, and the Paris transit gateway’s VPC and Direct Connect attachments. Transit gateway peering supports routing traffic between the peer gateways’ attachments when the required routes are configured. This design keeps the migrated workloads in private subnets without direct internet access.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!