AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ291

Network Design

A company plans to migrate its critical workloads from an on-premises data center to Amazon EC2 instances. The plan includes a new 10 Gbps AWS Direct Connect dedicated connection from the on-premises data center to a VPC attached to a transit gateway. The migration must take place over encrypted paths between the on-premises data center and the AWS Cloud.

Which solution satisfies these requirements while delivering the HIGHEST throughput?

  • A Configure a public VIF on the Direct Connect connection. Configure an AWS Site-to-Site VPN connection to the transit gateway as a VPN attachment.
  • B Configure a transit VIF on the Direct Connect connection. Configure an IPsec VPN connection to an EC2 instance that is running third-party VPN software.
  • C Configure MACsec for the Direct Connect connection. Configure a transit VIF to a Direct Connect gateway that is associated with the transit gateway.
  • D Configure a public VIF on the Direct Connect connection. Configure two AWS Site-to-Site VPN connections to the transit gateway. Enable equal-cost multi-path (ECMP) routing.
Explanation

MACsec provides Layer 2 encryption on supported 10 Gbps dedicated Direct Connect connections, avoiding the lower per-tunnel throughput constraints of IPsec Site-to-Site VPN. A transit virtual interface connected to a Direct Connect gateway associated with a transit gateway provides the required Direct Connect path to the VPCs reachable through that transit gateway.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!