ANS-C01 · Question #209
A company hosts infrastructure services in multiple VPCs across multiple accounts in the us- west-2 Region. The VPC CIDR blocks do not overlap. The company wants to connect the VPCs to its data…
The correct answer is A. Deploy a transit gateway. Share the transit gateway with each of the other accounts by using. Explanation Option A is correct because a Transit Gateway with AWS Global Accelerator enabled provides a centralized hub to connect multiple VPCs across multiple accounts (via Resource Access Manager sharing), while accelerated VPN connections route traffic through the nearest…
Question
A company hosts infrastructure services in multiple VPCs across multiple accounts in the us- west-2 Region. The VPC CIDR blocks do not overlap. The company wants to connect the VPCs to its data centers by using AWS Site-to-Site VPN tunnels. The connections must be encrypted in transit. Additionally, the connection from each data center must route to the closest AWS edge location. The connections must be highly available and must accommodate automatic failover. Which solution will meet these requirements?
Options
- ADeploy a transit gateway. Share the transit gateway with each of the other accounts by using
- BDeploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on
- CDeploy a transit gateway. Share the transit gateway with each of the other accounts by using
- DDeploy VPN gateways to each account. Enable the acceleration feature for VPN gateways on
How the community answered
(38 responses)- A76% (29)
- B8% (3)
- C13% (5)
- D3% (1)
Explanation
Explanation
Option A is correct because a Transit Gateway with AWS Global Accelerator enabled provides a centralized hub to connect multiple VPCs across multiple accounts (via Resource Access Manager sharing), while accelerated VPN connections route traffic through the nearest AWS edge location, ensuring low latency, encryption in transit, and built-in high availability with automatic failover through dual tunnels.
Why the distractors are wrong:
- Option B is incorrect because deploying individual VPN gateways per account creates a complex, decentralized architecture that lacks a unified routing mechanism for multiple VPCs and accounts - it does not scale efficiently.
- Option C appears similar to A but likely omits the acceleration feature, meaning traffic would not be guaranteed to route to the closest AWS edge location, failing that specific requirement.
- Option D is incorrect for the same reason as B - individual VPN gateways per account are difficult to manage at scale, and without a transit gateway, inter-VPC routing across accounts becomes unmanageable.
Memory Tip
Think "Transit Gateway = Central Hub" - whenever a question involves multiple VPCs + multiple accounts + VPN connectivity, Transit Gateway with accelerated VPN (Global Accelerator) is the go-to solution. The keywords "closest edge location" and "automatic failover" are direct hints pointing to the acceleration feature.
Topics
Community Discussion
No community discussion yet for this question.