AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ63

Network Design

A company runs infrastructure services in multiple VPCs across multiple accounts in the us-west-2 Region. The VPC CIDR blocks are non-overlapping. The company needs to connect the VPCs to its data centers by using AWS Site-to-Site VPN tunnels.

The connections must be encrypted in transit. In addition, each data center’s connection must route to the nearest AWS edge location. The connections must be highly available and support automatic failover.

Which solution meets these requirements?

  • A Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.
  • B Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure BGP peering.
  • C Deploy a transit gateway. Share the transit gateway with each of the other accounts by using AWS Resource Access Manager (AWS RAM). Create VPC attachments to the transit gateway from each service account. Add routes to the on-premises subnet in each of the service VPC route tables by using the attachment as the gateway. Create Site-to-Site VPN tunnel attachments with dynamic routing to the transit gateway. Enable the acceleration feature for the Site-to-Site VPN connection. Configure the VPN tunnels on the on-premises equipment. Configure static routing.
  • D Deploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on each account. Add routes to the on-premises subnet in each of the service VPC route tables. Use the VPNs as the gateway. Configure the VPN tunnels on the on-premises equipment. Configure static routing.
Explanation

An accelerated AWS Site-to-Site VPN uses AWS Global Accelerator to route traffic from the on-premises network through the AWS edge location nearest the customer gateway device. Acceleration is supported only for Site-to-Site VPN connections attached to a Transit Gateway, not virtual private gateways. A Transit Gateway shared through AWS RAM provides centralized connectivity for VPCs in other accounts, while IPsec VPN tunnels encrypt traffic. Dynamic routing with BGP enables routing exchange and supports automated failover over the redundant VPN tunnels.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!