SAP-C02 · Question #705
A software as a service (SaaS) company provides a media software solution to customers. The solution is hosted on 50 VPCs across various AWS Regions and AWS accounts. One of the VPCs is designated…
The correct answer is A. Create a transit gateway. Attach all the company's VPCs and relevant subnets to the transit C. Create a Network Load Balancer (NLB) that points to the compute resource for license validation. Establish full mesh communication between 50+ VPCs across regions/accounts and one-way access from customer VPCs to a management VPC for license validation, with minimal operational overhead and scalability for growth.
Question
A software as a service (SaaS) company provides a media software solution to customers. The solution is hosted on 50 VPCs across various AWS Regions and AWS accounts. One of the VPCs is designated as a management VPC. The compute resources in the VPCs work independently. The company has developed a new feature that requires all 50 VPCs to be able to communicate with each other. The new feature also requires one-way access from each customer's VPC to the company's management VPC. The management VPC hosts a compute resource that validates licenses for the media software solution. The number of VPCs that the company will use to host the solution will continue to increase as the solution grows. Which combination of steps will provide the required VPC connectivity with the LEAST operational overhead? (Choose two.)
Options
- ACreate a transit gateway. Attach all the company's VPCs and relevant subnets to the transit
- BCreate VPC peering connections between all the company's VPCs.
- CCreate a Network Load Balancer (NLB) that points to the compute resource for license validation.
- DCreate a VPN appliance in each customer's VPC. Connect the company's management VPC to
- ECreate a VPC peering connection between the company's management VPC and each
How the community answered
(41 responses)- A63% (26)
- B5% (2)
- D22% (9)
- E10% (4)
Why each option
Establish full mesh communication between 50+ VPCs across regions/accounts and one-way access from customer VPCs to a management VPC for license validation, with minimal operational overhead and scalability for growth.
AWS Transit Gateway simplifies network topology by acting as a central hub for all VPCs (including those in different accounts and regions), allowing full mesh communication with significantly less operational overhead than managing numerous peering connections as the number of VPCs grows.
Creating VPC peering connections between all 50 VPCs would result in a complex full-mesh configuration (n*(n-1)/2 connections), leading to significant operational overhead and management challenges as the number of VPCs increases, making it unsuitable for 'least operational overhead'.
Creating a Network Load Balancer (NLB) in the management VPC and pointing it to the license validation compute resource enables one-way, secure, and scalable access from customer VPCs to the management VPC without requiring complex network routing or exposing the underlying compute directly.
Deploying and managing a VPN appliance in each customer's VPC, then connecting to the management VPC, introduces considerable operational overhead, complexity, and cost, especially for 50+ VPCs.
Creating individual VPC peering connections between the management VPC and each customer VPC addresses one-way communication but does not solve the requirement for all 50 VPCs to communicate with each other in a full mesh.
Concept tested: Scalable multi-VPC connectivity with Transit Gateway and NLB for services
Source: https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html AND https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html
Community Discussion
No community discussion yet for this question.