ANS-C01 Question 453
Select 4Your company operates in a highly regulated industry and needs to design a multi-VPC architecture that adheres to strict security and compliance requirements. The architecture must ensure that traffic between VPCs is inspected for compliance, no VPC has direct public internet access, and centralized management of security policies is enforced. Which combination of options would best meet these requirements?
- A
Use AWS Transit Gateway to route traffic between VPCs and attach a centralized inspection VPC with a third-party firewall.
- B
Establish peering connections between all VPCs and use a NAT Gateway for public internet access.
- C
Deploy a centralized egress VPC with a NAT Gateway and route all outbound traffic through it.
- D
Use VPC Endpoints for private connectivity to AWS services, avoiding public internet exposure.
- E
Enable VPC Flow Logs to monitor and log all network traffic for compliance auditing.
Show answer and explanation
Correct answers: A, C, D, E
Explanation
To meet the security and compliance requirements, the solution must ensure centralized traffic inspection, avoid public internet exposure, and enable auditing capabilities. AWS Transit Gateway provides scalable and centralized routing between VPCs while supporting inspection via a centralized inspection VPC. A centralized egress VPC ensures secure outbound internet access. VPC Endpoints prevent public internet exposure when accessing AWS services, and VPC Flow Logs offer the necessary logging for compliance auditing. VPC peering alone does not scale or support centralized inspection and is therefore unsuitable for this scenario.
- A. Correct.
Correct: AWS Transit Gateway allows centralized routing between VPCs while enabling the inclusion of a centralized inspection VPC for compliance, ensuring that traffic is inspected efficiently.
- B. Incorrect.
Incorrect: VPC peering does not scale well for multi-VPC environments and lacks centralized inspection capabilities. Additionally, using a NAT Gateway alone does not meet the compliance requirement for traffic inspection.
- C. Correct.
Correct: A centralized egress VPC ensures that all outbound traffic is routed through a controlled environment, supporting strict compliance and security requirements.
- D. Correct.
Correct: VPC Endpoints enable secure, private communication with AWS services without exposing traffic to the public internet, which is essential for meeting security and compliance needs.
- E. Correct.
Correct: VPC Flow Logs provide visibility into network traffic and are a critical tool for compliance auditing and security monitoring.