ANS-C01 Question 200
Select 3You are designing a hybrid cloud architecture where your on-premises data center is connected to an AWS VPC using AWS Direct Connect. Your on-premises network uses VLANs to segment traffic, and you want to ensure that traffic from different VLANs is routed appropriately within the VPC. Which of the following steps must be taken to achieve this?
- A
Create subnets in the VPC and associate them with specific VLANs using a custom route table.
- B
Configure a Virtual Private Gateway (VGW) on the VPC and establish a BGP session with your on-premises router.
- C
Use AWS Direct Connect with VLAN tagging (802.1Q) to map on-premises VLAN traffic to specific VPC subnets.
- D
Enable routing between the VLANs using a layer 3 device such as a router or firewall in your on-premises network.
- E
Create a Transit Gateway and attach both the Direct Connect Gateway and the VPC to centralize routing.
Show answer and explanation
Correct answers: B, C, D
Explanation
To connect an on-premises network using VLANs to an AWS VPC, you need to use AWS Direct Connect with VLAN tagging (802.1Q) to map the layer 2 VLANs to the layer 3 constructs in AWS. A Virtual Private Gateway (VGW) is essential for managing the connection and enabling dynamic routing with BGP. Routing between VLANs must be handled by a layer 3 device on-premises before traffic is sent over the Direct Connect link. A Transit Gateway is not needed unless the architecture involves multiple VPCs or additional on-premises connections.
- A. Incorrect.
Incorrect. Subnets in VPCs do not directly associate with VLANs. Subnets are layer 3 constructs in AWS, and VLAN tagging happens at layer 2. You cannot map a subnet to a VLAN directly.
- B. Correct.
Correct. A Virtual Private Gateway (VGW) is required to establish the connection between the VPC and your on-premises network. BGP sessions allow dynamic routing and exchange of prefixes between the two networks.
- C. Correct.
Correct. AWS Direct Connect supports VLAN tagging (802.1Q), which is essential for mapping VLAN traffic from your on-premises network to specific VPC layer 3 constructs.
- D. Correct.
Correct. Routing between VLANs must be handled by a layer 3 device, such as a router or firewall, on the on-premises side before traffic is transmitted over Direct Connect to the VPC.
- E. Incorrect.
Incorrect. A Transit Gateway is not required in this scenario. While Transit Gateway can centralize routing for multiple VPCs or on-premises connections, it is not necessary for Direct Connect with a single VPC setup.