Architect network connectivity strategies

Dunmore Analytics has a gateway VPC endpoint for Amazon S3 in its analytics VPC in us-west-2. On-premises Hadoop servers connect to the VPC over AWS Direct Connect through a virtual private gateway, and they must now write data to S3 buckets in us-west-2 privately, without traversing the internet or a public virtual interface.

What should the solutions architect do?

1. AAdd the on-premises CIDR range to the gateway endpoint policy and add a route to the gateway endpoint on the on-premises router.Gateway endpoints work through VPC route table prefix list entries and can be used only by resources inside that VPC. They cannot be reached from on premises, peered VPCs or VPN connections.
2. BCreate an interface VPC endpoint for Amazon S3 in the analytics VPC and configure the on-premises applications to use the endpoint-specific DNS names.Interface endpoints for S3 place ENIs with private IP addresses in the VPC, and those addresses are reachable over Direct Connect, so on-premises clients can reach S3 privately.
3. CDeploy a NAT gateway in the analytics VPC and route on-premises S3 traffic through it.A NAT gateway does not forward traffic that arrives from a virtual private gateway to the internet in this way, and it would send traffic to S3 public endpoints rather than providing a private path.
4. DEnable S3 Transfer Acceleration on the buckets and send the data to the accelerate endpoint.Transfer Acceleration uses edge locations and the public internet to speed long-distance uploads. It does not provide private connectivity over Direct Connect.

Ashgrove Pharma has 80 VPCs in 25 accounts attached to a transit gateway in eu-central-1. After an audit, the security team must prove on a recurring schedule that no network path exists from any internet gateway to subnets tagged tier=restricted in any VPC. Separately, the network team needs to see the source and destination IP addresses, byte counts and accept or drop decisions for traffic crossing the transit gateway, so it can find which attachments generate unexpected flows.

Which two AWS capabilities should the architect use? Each correct answer presents part of the solution.

1. AAmazon VPC Network Access Analyzer with a Network Access Scope that matches internet gateways as sources and restricted subnets as destinations.Network Access Analyzer evaluates all possible paths that match a scope, such as any internet gateway to any resource in specific subnets, and reports findings. It suits recurring compliance verification.
2. BVPC Reachability Analyzer, running one path analysis from each internet gateway to each restricted subnet.Reachability Analyzer checks a specific source-destination pair. Enumerating every gateway and subnet pair across 80 VPCs is impractical for proving the absence of any path.
3. CTransit Gateway Flow Logs published to Amazon S3 and queried with Amazon Athena.Transit Gateway Flow Logs capture IP traffic metadata, including attachment IDs, addresses, bytes and packet drop reasons, for traffic passing through the transit gateway.
4. DVPC Traffic Mirroring sessions from every elastic network interface to a central Network Load Balancer.Traffic Mirroring copies full packets for deep inspection and must be configured per source ENI. It is costly and heavy compared with flow metadata from the transit gateway.
5. EAWS CloudTrail data events for the transit gateway, delivered to an organization trail.CloudTrail records API calls, not packet flows through the transit gateway, so it cannot show which attachments generate traffic.

Kestrel Mutual has 45 application accounts in AWS Organizations, each with VPCs in us-east-1 attached to a shared transit gateway. Applications must resolve names in the on-premises domain corp.kestrel.internal, which is served by DNS servers at 172.16.10.10 and 172.16.10.11 in the data center reached over Direct Connect. The network team owns a network-hub account and wants a solution that does not require running DNS servers on EC2 and that new application accounts inherit with the least operational overhead.

Which solution should the solutions architect recommend?

1. AIn each application VPC, set the DHCP options set to use the on-premises DNS servers as the domain name servers.This sends all DNS queries, including AWS service and private hosted zone names, to on premises, which breaks AWS name resolution and must be configured in every VPC.
2. BIn the network-hub account, create a Route 53 Resolver outbound endpoint and a forwarding rule for corp.kestrel.internal that targets the on-premises DNS servers, share the rule with the organization through AWS RAM, and associate the shared rule with each application VPC.The outbound endpoint lives in one VPC, but a shared forwarding rule can be associated with VPCs in other accounts. Queries for the domain from those VPCs are forwarded through the central outbound endpoint to the on-premises servers.
3. CIn each application account, create a Route 53 Resolver inbound endpoint and point the on-premises DNS servers at it.Inbound endpoints let on-premises resolvers query AWS, which is the opposite direction from what is needed. Creating endpoints in every account also adds cost and overhead.
4. DCreate a Route 53 private hosted zone named corp.kestrel.internal in the network-hub account, copy the on-premises records into it, and associate it with all application VPCs.Copying records creates two sources of truth that drift as on-premises records change, and it requires an ongoing synchronization process.

Pemberton Federal Credit Union is ordering new AWS Direct Connect capacity from its Columbus data center to a transit gateway in us-east-2. Security policy requires that all traffic between the data center and AWS be encrypted in transit at the full 10 Gbps line rate of the link. The business also requires a backup path that keeps critical systems reachable at reduced bandwidth if the Direct Connect location fails, and it wants that backup at the lowest cost.

Which two actions should the solutions architect take? Each correct answer presents part of the solution.

1. AOrder a 10 Gbps dedicated connection at a Direct Connect location that supports MACsec, associate a connectivity association key (CAK/CKN) with the connection, and enable MACsec on the customer router.MACsec provides IEEE 802.1AE layer 2 encryption between the customer router and the AWS device at line rate. It is available on supported dedicated connections.
2. BOrder a 10 Gbps hosted connection from an AWS Direct Connect Partner and enable MACsec on the hosted connection.MACsec is supported on dedicated connections, not on hosted connections, so this would not meet the encryption requirement.
3. CCreate an AWS Site-to-Site VPN connection over the internet attached to the same transit gateway, and let BGP prefer the Direct Connect path while it is available.A VPN attachment to the transit gateway is an inexpensive, encrypted backup path. The transit gateway prefers Direct Connect routes over VPN routes for the same prefix, so the VPN is used only when Direct Connect fails.
4. DRun a private IP Site-to-Site VPN over the transit virtual interface and send all production traffic through it to satisfy the encryption policy.Private IP VPN encrypts traffic over Direct Connect, but each tunnel is limited to about 1.25 Gbps (5 Gbps for a large bandwidth tunnel), so it cannot meet the 10 Gbps line-rate requirement without complex ECMP across several tunnels.
5. ECreate a second Direct Connect gateway and associate it with the transit gateway to provide a backup path.A second Direct Connect gateway is a logical construct that still depends on the same physical connection and location, so it does not protect against a location failure.