SAP-C02 · Question #605
A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The…
The correct answer is A. Create a transit gateway in an AWS account. Share the transit gateway across accounts by using C. Setup transit gateway route tables. Associate the VPCs and VPNs with the route tables. E. Configure attachments between the VPCs and VPNs. To connect hundreds of AWS VPCs to an on-premises network with granular inter-VPC communication control and minimal operational effort, implement an AWS Transit Gateway, share it via AWS RAM, create attachments for all VPCs and VPNs, and configure Transit Gateway route tables.
Question
A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to control which VPCs can communicate with other VPCs. Which combination of steps will achieve this level of control with the LEAST operational effort? (Choose three.)
Options
- ACreate a transit gateway in an AWS account. Share the transit gateway across accounts by using
- BConfigure attachments to all VPCs and VPNs.
- CSetup transit gateway route tables. Associate the VPCs and VPNs with the route tables.
- DConfigure VPC peering between the VPCs.
- EConfigure attachments between the VPCs and VPNs.
- FSetup route tables on the VPCs and VPNs.
How the community answered
(26 responses)- A62% (16)
- B23% (6)
- D12% (3)
- F4% (1)
Why each option
To connect hundreds of AWS VPCs to an on-premises network with granular inter-VPC communication control and minimal operational effort, implement an AWS Transit Gateway, share it via AWS RAM, create attachments for all VPCs and VPNs, and configure Transit Gateway route tables.
Creating and sharing a Transit Gateway across accounts using AWS Resource Access Manager (AWS RAM) provides a scalable and central hub for connecting hundreds of VPCs to on-premises networks efficiently.
This option is a partial duplicate of option E and does not encompass the full solution for controlling communication and managing operational effort.
Transit Gateway route tables allow for fine-grained control over which VPCs and VPNs can communicate with each other through explicit route table associations and propagations, minimizing operational overhead compared to managing individual VPC peering routes.
VPC peering connects two VPCs directly and does not scale well for hundreds of VPCs, making it high operational effort to manage routing and connectivity across a large number of connections.
Configuring attachments for all VPCs and VPNs to the Transit Gateway is essential for establishing the connectivity paths required for both inter-VPC and hybrid cloud communication.
Setting up route tables on each VPC and VPN directly would require immense operational effort for hundreds of VPCs, as individual route table management for inter-VPC communication is not scalable.
Concept tested: AWS Transit Gateway, cross-account networking, routing control
Source: https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html
Community Discussion
No community discussion yet for this question.