ANS-C01 · Question #227
A company has established connectivity between its on-premises data center in Paris. France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects…
The correct answer is C. 1. Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway. Explanation Option C is correct because it establishes a Tokyo transit gateway peered with the Paris transit gateway (inter-region transit gateway peering), allowing seamless connectivity between the Tokyo VPC and existing Paris workloads, while using an AWS Site-to-Site VPN…
Question
A company has established connectivity between its on-premises data center in Paris. France, and the AWS Cloud by using an AWS Direct Connect connection. The company uses a transit VIF that connects the Direct Connect connection with a transit gateway that is hosted in the Europe (Paris) Region. The company hosts workloads in private subnets in several VPCs that are attached to the transit gateway. The company recently acquired another corporation that hosts workloads on premises in an office building in Tokyo, Japan. The company needs to migrate the workloads from the Tokyo office to AWS. These workloads must have access to the company's existing workloads in Paris. The company also must establish connectivity between the Tokyo office building and the Paris data center. In the Asia Pacific (Tokyo) Region, the company creates a new VPC with private subnets for migration of the workloads. The workload migration must be completed in 5 days. The workloads cannot be directly accessible from the internet. Which set of steps should a network engineer take to meet these requirements?
Options
- A
- Create public subnets in the Tokyo VPC to migrate the workloads into.
- B
- Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway
- C
- Configure a transit gateway in the Asia Pacific (Tokyo) Region. Associate this transit gateway
- D
- Configure an AWS Site-to-Site VPN connection from the Tokyo office to the Paris transit
How the community answered
(41 responses)- A7% (3)
- B29% (12)
- C49% (20)
- D15% (6)
Explanation
Explanation
Option C is correct because it establishes a Tokyo transit gateway peered with the Paris transit gateway (inter-region transit gateway peering), allowing seamless connectivity between the Tokyo VPC and existing Paris workloads, while using an AWS Site-to-Site VPN from the Tokyo office to the Tokyo transit gateway - a solution that can be deployed within the 5-day window without requiring physical Direct Connect provisioning (which takes weeks).
Why the distractors are wrong:
- Option A is wrong because migrating workloads to public subnets violates the requirement that workloads must not be directly accessible from the internet.
- Option B is likely wrong because it either uses an incorrect connectivity method (such as Direct Connect for the Tokyo office, which cannot be provisioned in 5 days) or misorders the association steps.
- Option D is wrong because routing a Site-to-Site VPN from Tokyo all the way to the Paris transit gateway introduces unnecessary latency, complexity, and poor architecture, rather than establishing a local Tokyo gateway that peers with Paris.
Memory Tip: Think "Local Gateway + Peer + VPN" - always anchor VPN connections to the nearest regional transit gateway, then use inter-region TGW peering to bridge continents. If time is short, VPN is your friend; Direct Connect takes weeks!
Topics
Community Discussion
No community discussion yet for this question.