SAA-C03 · Question #433
A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set u
The correct answer is B. Create a Direct Connect gateway and a transit gateway in the central network account. Attach the D. Share the transit gateway with other accounts. Attach VPCs to the transit gateway. F. Provision only private subnets. Open the necessary route on the transit gateway and customer. For a large-scale multi-account AWS environment with many VPCs and centralized Direct Connect, AWS recommends using a Transit Gateway (TGW) architecture combined with a Direct Connect gateway (DXGW). This setup allows scalable, centralized connectivity between on- premises and mu
Question
A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connect connection in a central network account. The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to route its cloud resources to the internet through its on-premises data center. Which combination of steps will meet these requirements? (Select THREE.)
Options
- ACreate a Direct Connect gateway in the central account. In each of the accounts, create an
- BCreate a Direct Connect gateway and a transit gateway in the central network account. Attach the
- CProvision an internet gateway. Attach the internet gateway to subnets. Allow internet traffic
- DShare the transit gateway with other accounts. Attach VPCs to the transit gateway.
- EProvision VPC peering as necessary.
- FProvision only private subnets. Open the necessary route on the transit gateway and customer
How the community answered
(70 responses)- A14% (10)
- B44% (31)
- C9% (6)
- E33% (23)
Explanation
For a large-scale multi-account AWS environment with many VPCs and centralized Direct Connect, AWS recommends using a Transit Gateway (TGW) architecture combined with a Direct Connect gateway (DXGW). This setup allows scalable, centralized connectivity between on- premises and multiple VPCs across accounts. Step B: Creating a Direct Connect gateway and Transit Gateway in a central network account and connecting them via a transit VIF enables the on-premises network to access all connected Step D: Sharing the transit gateway with other accounts via AWS Resource Access Manager (RAM) allows the central TGW to attach VPCs in multiple accounts, simplifying multi-account Step F: To route cloud resources' internet traffic back through the on-premises data center (for centralized egress), provisioning only private subnets and routing outbound internet traffic through NAT or firewall services in the data center is necessary. This requires configuring transit gateway and customer gateway routes appropriately. Option A is partially correct in the use of Direct Connect gateway but association proposals are not scalable for hundreds of VPCs and accounts compared to transit gateway. Option C (internet gateway) is irrelevant here as traffic egress is required via on-premises data center, not directly to the internet. Option E (VPC peering) is not scalable for hundreds of VPCs.
Community Discussion
No community discussion yet for this question.