ANS-C01 Question 156
Select 2You are designing a connectivity strategy for an organization with multiple AWS accounts managed under AWS Organizations. The organization requires connectivity between VPCs in different AWS Regions while maintaining isolation for specific workloads. The connectivity should be cost-efficient, scalable, and resilient. Which combination of solutions would best meet these requirements?
- A
Use AWS Transit Gateway to establish inter-VPC connectivity and enable inter-Region peering for traffic between Regions.
- B
Set up a fully meshed VPC peering architecture between all the VPCs across Regions.
- C
Leverage AWS Direct Connect with a Direct Connect Gateway to provide centralized connectivity to on-premises resources and interconnect VPCs across Regions.
- D
Use VPC sharing to allow accounts to share subnets and route tables for inter-account connectivity across Regions.
- E
Configure AWS Site-to-Site VPN connections between all VPCs to establish secure connectivity across Regions.
Show answer and explanation
Correct answers: A, C
Explanation
To design a cost-efficient, scalable, and resilient connectivity strategy for an organization with multiple AWS accounts and Regions, AWS Transit Gateway and AWS Direct Connect with Direct Connect Gateway are the optimal solutions. Transit Gateway simplifies inter-VPC and inter-Region connectivity, while Direct Connect provides a dedicated, high-bandwidth connection for both on-premises resources and cross-Region VPCs. These solutions together meet the requirements for scalability, resilience, and workload isolation.
- A. Correct.
Using AWS Transit Gateway allows centralized routing and simplifies inter-VPC and inter-Region connectivity. It supports inter-Region peering, which is cost-efficient and scalable compared to managing multiple VPC peering connections.
- B. Incorrect.
A fully meshed VPC peering architecture is not scalable for multiple VPCs and Regions due to the exponential increase in the number of peering connections required, leading to complex management and higher costs.
- C. Correct.
AWS Direct Connect with a Direct Connect Gateway provides a centralized and efficient method for connecting VPCs across Regions and on-premises environments, making it a scalable and resilient option.
- D. Incorrect.
VPC sharing is designed for intra-Region connectivity within shared subnets and is not suitable for inter-Region routing or maintaining workload isolation as required by the scenario.
- E. Incorrect.
Using AWS Site-to-Site VPN connections for all VPCs would result in significant complexity and cost, as it requires managing multiple VPN tunnels and does not scale well for large multi-Region architectures.