ANS-C01 practice question 9 of 35

An Australian ecommerce company hosts all of its services in the AWS Cloud and wants to expand its customer base to the United States (US). The…

An Australian ecommerce company hosts all of its services in the AWS Cloud and wants to expand its customer base to the United States (US). The company is targeting the western US for the expansion. The company’s existing AWS architecture consists of four AWS accounts with multiple VPCs deployed in the ap-southeast-2 Region. All VPCs are attached to a transit gateway in ap-southeast-2. There are dedicated VPCs for each application service. The company also has VPCs for centralized security features such as proxies, firewalls, and logging. The company plans to duplicate the infrastructure from ap-southeast-2 to the us-west-1 Region. A network engineer must establish connectivity between the various applications in the two Regions. The solution must maximize bandwidth, minimize latency and minimize operational overhead. Which solution will meet these requirements?

Answer options

A: Create VPN attachments between the two transit gateways. Configure the VPN attachments to use BGP routing between the two transit gateways.

B: Peer the transit gateways in each Region. Configure routing between the two transit gateways for each Region's IP addresses. Correct answer

C: Create a VPN server in a VPC in each Region. Update the routing to point to the VPN servers for the IP addresses in alternate Regions.

D: Attach the VPCs in us-west-1 to the transit gateway in ap-southeast-2.

Correct Answer:

B. Peer the transit gateways in each Region. Configure routing between the two transit gateways for each Region's IP addresses.

Explanation

Transit gateway peering provides a direct, private, and high-bandwidth connection between two transit gateways in different AWS Regions. This connection utilizes the AWS global network backbone, which is designed for low latency and high throughput, thus meeting the performance requirements. Peering is a native feature that simplifies inter-region connectivity, requiring only a peering request and acceptance, along with route table updates. This minimizes the operational overhead compared to managing VPN connections or self-managed solutions.

Why Incorrect

A. A VPN connection between transit gateways would work, but it has lower bandwidth limits and potentially higher latency compared to a direct peering connection.
C. Creating and managing VPN servers on EC2 instances introduces significant operational overhead and is less scalable and performant than the native TGW peering solution.
D. A VPC can only be attached to a transit gateway in the same AWS Region. Attaching a VPC from us-west-1 to a TGW in ap-southeast-2 is not possible.

References

1. AWS Documentation, "Transit gateway peering attachments". It states, "You can create a peering attachment between your transit gateways... Traffic between the transit gateways is encrypted and travels over the AWS global network."

2. AWS Documentation, "Building a global network using AWS Transit Gateway Inter-Region peering". This AWS blog post details the benefits: "Transit Gateway Inter-Region peering provides a simple and cost-effective way to share resources between AWS Regions... All traffic flows over the AWS global network".

3. AWS Documentation, "Transit gateway attachments". The section on "VPC attachments" specifies that the VPC and the transit gateway must be in the same Region.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test