AWS Certified Solutions Architect Professional · Free Practice Question Hard
Question 26
A Solutions Architect must design a solution for providing private connectivity from a company’s WAN network to multiple AWS Regions. The company has offices around the world and has its main data center in New York. The company has mandated that traffic must not traverse the public internet at any time. The solution must also be highly available.
How can the Solutions Architect meet these requirements?
-
A
Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use an AWS transit VPC solution to access data in other AWS Regions.
-
B
Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use inter-region VPC peering to access the data in other AWS Regions.
-
C
Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use Direct Connect Gateway to access data in other AWS Regions.
-
D
Create an AWS Direct Connect connection from the New York data center to all AWS Regions the company uses. Configure the company WAN to send traffic via the New York data center and on to the respective DX connection to access AWS.
Reveal correct answer
Correct answer: C
Explanation
This is a great use case for DX gateway which allows you to connect either a transit gateway, or a virtual private gateway. The DX gateway will then allow you to establish connections to multiple AWS Regions. For high availability this solution should have two DX connections from the New York data center and the WAN should then be configured through BGP to forwarded connections to AWS across the DX connections.
CORRECT: "Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use Direct Connect Gateway to access data in other AWS Regions" is the correct answer.
INCORRECT: "Create an AWS Direct Connect connection from the New York data center to all AWS Regions the company uses. Configure the company WAN to send traffic via the New York data center and on to the respective DX connection to access AWS" is incorrect. You would not want to connect multiple AWS Regions to a single data center using DX connections as this would be very expensive and is not necessary. It’s better to connect to a local Region and then use DX gateway / transit gateway for connectivity from there.
INCORRECT: "Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use inter-region VPC peering to access the data in other AWS Regions" is incorrect. Inter-region VPC peering becomes very complex to setup when you have many Regions to connect in a transitive relationship (no transitive peering).
INCORRECT: "Create two AWS Direct Connect connections from the New York data center to an AWS Region. Configure the company WAN to send traffic over the DX connection. Use an AWS transit VPC solution to access data in other AWS Regions" is incorrect. A transit VPC is a VPC configured to perform routing to other VPCs in a hub and spoke model. This has largely been replaced by transit gateways. In this case, we are using multiple Regions so the DX gateway must be used to connect across Regions.
References:
https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
