Q28 — AWS SAA-C03 Ch.16

Question 28 of 100 | ← Chapter 16

Q1228. A company needs to establish a connection from its on-premises data center to AWS. The company needs to connect all of its VPCs that are located in different AWS Regions with transitive routing capabilities between VPC networks.The company also must reduce network outbound traffic costs,increase bandwidth throughput, and provide a consistent network experience for end users.Which solution will meet these requirements?

Correct Answer: B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.

Explanation

To meet the requirements of connecting an on-premises data center to AWS with transitive routing capabilities between VPCs across different regions, reducing network outbound traffic costs, increasing bandwidth throughput, and providing a consistent network experience for end users, let's analyze the options:Key Requirements:Transitive Routing Between VPCs: The solution must allow VPCs in different regions to communicate with each other (transitive routing).Reduced Outbound Traffic Costs: The solution should minimize costs associated with outbound traffic (e.g., avoiding VPN over internet for high-volume traffic). Increased Bandwidth Throughput: The solution should support high-bandwidth connections. Consistent Network Experience: The solution should provide low-latency, reliable connectivity.Solution Analysis:AWS Site-to-Site VPN:VPN connections are encrypted tunnels over the public internet. They are cost-effective but have lower bandwidth and higher latency compared to Direct Connect. VPNs do not scale well for high-throughput or transitive routing across multiple regions.AWS Direct Connect:Direct Connect provides a dedicated, private network connection between on-premises and AWS, offering higher bandwidth, lower latency, and more consistent performance than VPN. It is ideal for reducing outbound traffic costs and increasing throughput.Transit Virtual Interface (VIF): Allows traffic to be routed to multiple VPCs across regions. Direct Connect Gateway: Enables connectivity to VPCs in multiple regions. Transit Gateway: A network transit hub that simplifies networking between VPCs, on-premises networks, and remote networks. It supports transitive routing and can be used with Direct Connect for global connectivity.VPC Peering:VPC peering allows direct communication between two VPCs, but it does not support transitive routing (i.e., VPC A cannot route traffic to VPC C via VPC B unless explicitly configured, which is not scalable).Evaluating the Options:Option A: Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Create VPC peering connections that initiate from the central VPC to all other VPCs. Incorrect: VPN has lower bandwidth and higher latency. VPC peering does not support transitive routing well, and this solution would not scale for multiple regions. Option B: Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region. Correct: This solution uses Direct Connect for high-bandwidth, low-latency connectivity. The transit VIF and Direct Connect gateway enable connectivity to VPCs in multiple regions. The transit gateway in each region supports transitive routing between VPCs.Option C: Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Use a transit gateway with dynamic routing. Connect the transit gateway to all other VPCs. Incorrect: VPN is not suitable for high-bandwidth or global transitive routing. While a transit gateway can help with routing, the VPN connection is a bottleneck.Option D: Create an AWS Direct Connect connection between the on-premises data center and AWS. Establish an AWS Site-to-Site VPN connection between all VPCs in each Region. Create VPC peering connections that initiate from the central VPC to all other VPCs. Incorrect: This solution is overly complex and inefficient. Using VPN between VPCs is not scalable, and VPC peering does not support transitive routing well. Direct Connect is underutilized here.Final Answer:B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.This solution provides high-bandwidth, low-latency connectivity with transitive routing capabilities between VPCs across regions, meeting all the requirements.