AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ286

Network Design

A network engineer is designing a hybrid networking environment to link a company’s corporate network with the company’s AWS environment. The AWS environment includes 30 VPCs across 3 AWS Regions.

The network engineer must implement a solution that centrally filters traffic by using a firewall approved by the company’s security team. The solution must allow every VPC to connect to every other VPC. Connectivity between AWS and the corporate network must satisfy a minimum bandwidth requirement of 2 Gbps.

Which solution meets these requirements?

  • A Deploy an IPsec VPN connection between the corporate network and a new transit gateway. Connect all VPCs to the transit gateway. Associate the approved firewall with the transit gateway.
  • B Deploy a single 10 Gbps AWS Direct Connect connection between the corporate network and virtual private gateway of each VPC. Connect the virtual private gateways to a Direct Connect gateway. Build an IPsec tunnel to a new transit VPC. Deploy the approved firewall to the transit VPC.
  • C Deploy two 1 Gbps AWS Direct Connect connections in different Direct Connect locations to connect to the corporate network. Build a transit VIF on each connection to a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway for each Region. Configure the VIFs to use equal-cost multipath (ECMP) routing. Connect all the VPCs in the three Regions to the transit gateway. Configure the transit gateway route table to route traffic to an inspection VPDeploy the approved firewall to the inspection VPC.
  • D Deploy four 1 Gbps AWS Direct Connect connections in different Direct Connect locations to connect to the corporate network. Build a transit VIF on each connection to a Direct Connect gateway. Associate the Direct Connect gateway with a new transit gateway for each Region. Connect the transit gateways by using a transit gateway peering attachment. Configure the VIFs to use equal-cost multipath (ECMP) routing. Configure transit gateway route tables to route traffic to an inspection VPC. Deploy the approved firewall to the inspection VPC.
Explanation

AWS Transit Gateway is a Regional service; transit gateway peering attachments provide the required routing between transit gateways in different Regions so VPCs attached in all three Regions can communicate. Routing transit gateway traffic through an inspection VPC centralizes firewall inspection. Direct Connect transit VIFs attached to a Direct Connect gateway can connect the corporate network to associated transit gateways, and ECMP across the Direct Connect connections provides the necessary aggregate bandwidth.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!