SCS-C02 Question 219
Single answerYour organization has deployed multiple VPCs across different AWS Regions to separate environments such as development, testing, and production. You are tasked with enabling secure, scalable, and centralized inter-VPC connectivity without exposing traffic to the public internet. Which solution would best meet these requirements?
- A
Set up VPC peering between each pair of VPCs in all regions.
- B
Use AWS Transit Gateway to interconnect all VPCs in a hub-and-spoke model.
- C
Leverage VPC endpoints to establish connectivity between the VPCs.
- D
Create an internet gateway for each VPC and route traffic through the public internet.
Show answer and explanation
Correct answer: B
Explanation
The best solution for secure, scalable, and centralized inter-VPC connectivity is AWS Transit Gateway. It simplifies network management by acting as a central hub that enables VPCs and on-premises networks to communicate with one another. It supports transitive routing, ensuring efficient traffic flow across multiple VPCs and regions without exposing traffic to the public internet. Other options, such as VPC peering or VPC endpoints, either lack scalability or are not designed for inter-VPC connectivity.
- A. Incorrect.
This option is not scalable for environments with many VPCs, as it requires creating and managing a large number of VPC peering connections. Additionally, VPC peering does not support transitive routing, which limits its effectiveness for centralized connectivity.
- B. Correct.
AWS Transit Gateway provides a scalable, centralized hub-and-spoke model for interconnecting multiple VPCs across different regions. It supports transitive routing, ensuring efficient and secure traffic flow without exposing it to the public internet.
- C. Incorrect.
VPC endpoints are designed for private connectivity to AWS services and do not enable inter-VPC connectivity. This option does not meet the requirements of the scenario.
- D. Incorrect.
Routing traffic through the public internet is not secure and does not meet the requirement of keeping traffic private. This solution is not recommended for inter-VPC connectivity.