Q95 — AWS SAA-C03 Ch.15

Question 95 of 100 | ← Chapter 15

Q1195. A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to control which VPCs can communicate with other VPCs.Which combination of steps will achieve this level of control with the LEAST operational effort? (Select THREE.)

Correct Answer: A. Create a transit gateway in an AWS account. Share the transit gateway across accounts by using AWS Resource Access Manager (AWS RAM)., B. Configure attachments to all VPCs and VPNs., C. Set up transit gateway route tables.Associate the VPCs and VPNs with the route tables.

Explanation

To achieve the goal of connecting AWS accounts to an on-premises network while controlling which VPCs can communicate with each other with the least operational effort, the following combination of steps is most suitable:A. Create a transit gateway in an AWS account. Share the transit gateway across accounts by using AWS Resource Access Manager (AWS RAM).Why: A transit gateway acts as a central hub for routing traffic between VPCs and on-premises networks. By creating a transit gateway in one AWS account and sharing it across accounts using AWS RAM, you can centralize the management of network connectivity and reduce operational overhead.B. Configure attachments to all VPCs and VPNs.Why: To connect VPCs and VPNs to the transit gateway, you need to create attachments. This allows the transit gateway to route traffic between these resources. Configuring these attachments is a necessary step to enable communication between the VPCs and the on-premises network. C. Set up transit gateway route tables. Associate the VPCs and VPNs with the route tables.Why: Transit gateway route tables control how traffic is routed between the attached VPCs and VPNs. By setting up these route tables and associating the VPCs and VPNs with them, you can precisely control which VPCs can communicate with each other and with the on-premises network. This provides the necessary granularity for network traffic management.Why the Other Options Are Not Suitable:D. Configure VPC peering between the VPCs.Why Not: VPC peering allows direct communication between two VPCs but does not scale well for hundreds of VPCs. Managing peering connections for a large number of VPCs would be complex and operationally intensive. Additionally, VPC peering does not inherently provide a way to control communication between VPCs and an on-premises network in a centralized manner.E. Configure attachments between the VPCs and VPNs.Why Not: Direct attachments between VPCs and VPNs would not leverage the transit gateway's centralized routing capabilities. This would require managing individual connections for each VPC and VPN, increasing operational complexity and effort.F. Set up route tables on the VPCs and VPNs.Why Not: While setting up route tables on VPCs and VPNs is necessary for routing traffic, it does not provide the centralized control and management that a transit gateway offers. Managing route tables on hundreds of VPCs and VPNs would be complex and error-prone.Conclusion:The combination of steps A, B, and C leverages the transit gateway's centralized routing capabilities and AWS RAM's resource sharing features to achieve the desired level of control with the least operational effort. This approach simplifies network management and provides the necessary granularity for traffic routing.