ANS-C01 practice question 7 of 35

A company has established connectivity between its on-premises data center in Paris, France, and the AWS Cloud by using an AWS Direct Connect…

Full set: 291 questions
A company has established connectivity between its on-premises data center in Paris, France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway. The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center. In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet. Which set of steps should a network engineer take to meet these requirements?
Answer options
A: 1. Create public subnets in the Tokyo VPC to migrate the workloads into. 2. Configure an internet gateway for the Tokyo office to reach the Tokyo VPC. 3. Configure security groups on the Tokyo workloads to only allow traffic from the Tokyo office and the Paris workloads. 4. Create peering connections between the Tokyo VPC and the Paris VPCs. 5. Configure a VPN connection between the Paris data center and the Tokyo office by using existing routers.
B: 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC. 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Set up a new Direct Connect connection from the Tokyo office to the Tokyo transit gateway. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
C: 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC. 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs. Correct answer
D: 1. Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit gateway. 2. Create an association between the Paris transit gateway and the Tokyo VPC. 3. Configure routing on the Paris transit gateway to allow data to flow between sites and the VPCs.
Correct Answer:
C. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway with the Tokyo VPC. 2. Create peering connections between the Tokyo transit gateway and the Paris transit gateway. 3. Configure an AWS Site-to-Site VPN connection from the Tokyo office. Set the Tokyo transit gateway as the target. 4. Configure routing on both transit gateways to allow data to flow between sites and the VPCs.
Explanation

This solution addresses all requirements effectively. Given the 5-day timeline, provisioning a new AWS Direct Connect connection is not feasible, making an AWS Site-to-Site VPN the appropriate choice for connecting the Tokyo office. Creating a new transit gateway in the Tokyo Region and peering it with the existing Paris transit gateway establishes a scalable, high-bandwidth, inter-region backbone using AWS's global network. Attaching the new Tokyo VPC to the Tokyo transit gateway and configuring routing on both transit gateways enables seamless communication between all locations: Tokyo office, Tokyo VPC, Paris VPCs, and the Paris data center.

Why Incorrect

A. This is incorrect because it uses public subnets, violating the security requirement. It also suggests VPC peering, which is less scalable than a transit gateway solution.
B. This is incorrect because ordering and provisioning a new Direct Connect connection cannot be completed within the required 5-day timeframe.
D. This is technically invalid. A VPC in one AWS Region (Tokyo) cannot be attached to a transit gateway in a different Region (Paris). Attachments are region-specific.

References

1. AWS Documentation, AWS Site-to-Site VPN User Guide, "What is AWS Site-to-Site VPN?". This service allows for the quick establishment of secure connections between on-premises networks and AWS.

2. AWS Documentation, AWS Transit Gateway Guide, "Transit gateway peering". This explains how to connect transit gateways in different AWS Regions to enable inter-region communication.

3. AWS Documentation, AWS Transit Gateway Guide, "Transit gateway attachments", Section: "VPC attachments". This documentation confirms that a VPC and its transit gateway attachment must be in the same AWS Region.

4. AWS Documentation, AWS Direct Connect User Guide, "Prerequisites for AWS Direct Connect". The process described, including ordering a cross-connect, implies a timeline longer than 5 days.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other ANS-C01 practice questions

Scroll to Top