MemberDecember 19, 2020 at 11:25 am
For the flowing question from practice exam, I did not think that the correct answer provided would allow for transitive communication between the VPCs, which appears to be a requirement from the question, “These applications must be able to connect to the on-premises data center as well to each other.” What am I missing or failing to interpret correctly? How does an AWS Site-To-Site VPN meet the transitive VPC requirements of the question? What does the complete solution look like?
EXAM QUESTION: A company has hundreds of applications deployed in three different Amazon VPCs. These applications must be able to connect to the on-premises data center as well to each other. The connection must have an AES256 encryption and be authenticated with SHA1 or SHA2 hashing functions. It should also use Diffie-Hellman (DH) groups for key exchange to support Perfect Forward Secrecy (PFS). The solution should automatically rotate the certificate for the AWS-side of the tunnel endpoint using a service-linked role.
What are the steps required in order to properly set up this network architecture?
<b style=”font-family: inherit; font-size: inherit;”>CORRECT ANSWER: Set up an AWS VPN connection.
MemberDecember 20, 2020 at 1:19 am
I think i understand now, but want to confirm. The solution would be a complete full mesh AWS site-to-site VPN, where each VPC would have connectivity to each other VPC and the on-prem data center. That would meet the requirements of the question, meeting the VPN options requirements and allowing the applications to connect to each other and the on-prem data center. Let me know if i am now on the right track.
AdministratorDecember 21, 2020 at 3:03 pm
Thank you for your insights.
Not necessarily a mesh. Although that is the old of doing it, you can instead use the AWS Transit Gateway to interconnect VPCs and on-premises network in a central hub. This is much simpler than setting up many complex peering networks.
Let me know if you need more clarifications.
Carlo @ Tutorials Dojo
Log in to reply.