ANS-C01 Question 183
Select 3A company has a hybrid cloud architecture with resources deployed on-premises and in AWS. The on-premises network is connected to AWS using an AWS Direct Connect connection. To improve fault tolerance and ensure high availability, the company wants to implement a backup connection using a VPN. Which combination of steps should they take to achieve this objective?
- A
Create a Site-to-Site VPN connection and attach it to the virtual private gateway (VGW) in the VPC.
- B
Configure Equal-Cost Multi-Path (ECMP) routing between the Direct Connect and the VPN to load balance traffic.
- C
Configure BGP on both the Direct Connect and the VPN to advertise the on-premises routes.
- D
Enable static routing for the VPN connection to simplify the configuration.
- E
Assign a higher BGP local preference to the Direct Connect connection than the VPN connection.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement a fault-tolerant connection with AWS, the company needs to configure a Site-to-Site VPN as a backup to the Direct Connect connection. BGP must be configured for both connections to dynamically advertise routes between AWS and the on-premises environment. Additionally, the Direct Connect connection should have a higher BGP local preference to prioritize it over the VPN. Static routing and ECMP are not suitable in this scenario, as they either lack flexibility or are not supported for this use case.
- A. Correct.
Correct: A Site-to-Site VPN connection is required to provide a backup connection to the AWS environment in case the Direct Connect connection fails.
- B. Incorrect.
Incorrect: ECMP is not applicable in this scenario because AWS Direct Connect and VPN connections cannot share traffic simultaneously. The VPN is intended to act as a backup, not for load balancing.
- C. Correct.
Correct: Configuring BGP is essential for dynamically advertising and learning routes between the on-premises network and AWS. This ensures failover functionality.
- D. Incorrect.
Incorrect: Static routing is not recommended in this scenario because dynamic route advertisement using BGP provides better failover and flexibility.
- E. Correct.
Correct: Assigning a higher BGP local preference to the Direct Connect path ensures that it is the preferred route, while the VPN acts as a backup.