AWS Certified Advanced Networking - Specialty

AWS Certified Advanced Networking - Specialty

Get started today

Ultimate access to all questions.


A rapidly growing company is experiencing throughput limitations on data transfers between its on-premises systems and Amazon EC2 instances in VPCs due to a single AWS Site-to-Site VPN connection between its on-premises data center firewall and an AWS Transit Gateway. A network engineer needs to design a highly available, secure solution that scales VPN throughput from on premises to VPC resources to accommodate the increasing traffic. Which solution meets these requirements?




Explanation:

To resolve the throttling issue and meet the requirements of high availability, security, and scalability, the best solution is to configure multiple dynamic BGP-based Site-to-Site VPN connections to the transit gateway and configure equal-cost multi-path routing (ECMP). This approach allows for the distribution of traffic across multiple VPN connections, thereby increasing the overall throughput. Dynamic BGP-based VPN connections automatically adjust to changes in network topology, ensuring high availability. ECMP ensures that traffic is evenly distributed across the available paths, optimizing the use of the VPN connections. This solution is both scalable and secure, as it leverages AWS's managed VPN and transit gateway services. Option A is the correct choice because it directly addresses the need for increased throughput, high availability, and scalability. Options B, C, and D do not fully meet the requirements as effectively as option A. Option B uses static routing, which lacks the flexibility of BGP. Option C suggests enabling acceleration, which does not inherently increase the number of available paths for traffic. Option D proposes a software appliance-based VPN connection, which may not offer the same level of scalability, security, and ease of management as AWS's managed VPN services.