Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

For the separate situation An existing VPC peering relationship connects two VPCs, and a third VPC needs to reach the peer through one of them, Add a direct peering link or use a Transit Gateway rather than relying on the intermediate peer could be useful. VPC peering does not support transitive routing through a peer VPC.

Peer the regional Transit Gateways and configure the peering routes solves the related scenario An organization needs inter-Region routing between centrally connected VPC groups; transit Gateway inter-Region peering links regional transit domains without a full mesh.

Although Use dedicated spoke and shared-services Transit Gateway route-table associations and propagations can be valid when A shared-services VPC must be reached from every spoke but spokes must not reach each other, it targets a different technical condition. Segmented transit route tables allow hub-service reachability without spoke-to-spoke routing.

For the separate situation An existing VPC peering relationship connects two VPCs, and a third VPC needs to reach the peer through one of them, Add a direct peering link or use a Transit Gateway rather than relying on the intermediate peer could be useful. VPC peering does not support transitive routing through a peer VPC.

Although Peer the regional Transit Gateways and configure the peering routes can be valid when An organization needs inter-Region routing between centrally connected VPC groups, it targets a different technical condition. Transit Gateway inter-Region peering links regional transit domains without a full mesh.

Attach the VPCs to an AWS Transit Gateway with explicit route tables would address a different requirement: A corporation must route traffic among 80 VPCs without managing thousands of bilateral peering links. Transit Gateway provides a transitive hub and reduces the VPC peering mesh.

Use dedicated spoke and shared-services Transit Gateway route-table associations and propagations solves the related scenario A shared-services VPC must be reached from every spoke but spokes must not reach each other; segmented transit route tables allow hub-service reachability without spoke-to-spoke routing.

Although Attach the VPCs to an AWS Transit Gateway with explicit route tables can be valid when A corporation must route traffic among 80 VPCs without managing thousands of bilateral peering links, it targets a different technical condition. Transit Gateway provides a transitive hub and reduces the VPC peering mesh.

Separate their attachments into segment-specific Transit Gateway route tables would address a different requirement: Two isolated business-unit VPC groups attach to one Transit Gateway but must never route between each other. Attachment association and propagation boundaries prevent unintended east-west reachability.

Although Attach the VPCs to an AWS Transit Gateway with explicit route tables can be valid when A corporation must route traffic among 80 VPCs without managing thousands of bilateral peering links, it targets a different technical condition. Transit Gateway provides a transitive hub and reduces the VPC peering mesh.

Add a direct peering link or use a Transit Gateway rather than relying on the intermediate peer would address a different requirement: An existing VPC peering relationship connects two VPCs, and a third VPC needs to reach the peer through one of them. VPC peering does not support transitive routing through a peer VPC.

This alternative, Use dedicated spoke and shared-services Transit Gateway route-table associations and propagations, is appropriate when A shared-services VPC must be reached from every spoke but spokes must not reach each other. Segmented transit route tables allow hub-service reachability without spoke-to-spoke routing.

This alternative, Add a direct peering link or use a Transit Gateway rather than relying on the intermediate peer, is appropriate when An existing VPC peering relationship connects two VPCs, and a third VPC needs to reach the peer through one of them. VPC peering does not support transitive routing through a peer VPC.

For the separate situation An organization needs inter-Region routing between centrally connected VPC groups, Peer the regional Transit Gateways and configure the peering routes could be useful. Transit Gateway inter-Region peering links regional transit domains without a full mesh.

Separate their attachments into segment-specific Transit Gateway route tables solves the related scenario Two isolated business-unit VPC groups attach to one Transit Gateway but must never route between each other; attachment association and propagation boundaries prevent unintended east-west reachability.

For the separate situation A central network team needs to connect many VPCs over a common Direct Connect deployment, Use a Direct Connect gateway with an appropriate Transit Gateway association could be useful. A Direct Connect gateway supports scalable private connectivity to multiple AWS VPC networks.

Evaluate Direct Connect MACsec on supported dedicated ports and locations solves the related scenario The company requires encrypted traffic over a dedicated Direct Connect circuit without an additional application tunnel; mACsec encrypts layer-2 frames on supported dedicated Direct Connect connections.

Deploy separate Direct Connect connections at independent locations where feasible would address a different requirement: An existing Direct Connect path must remain available after a single physical connection failure. Physically diverse connections avoid a single circuit or colocation failure domain.

Although Evaluate Direct Connect MACsec on supported dedicated ports and locations can be valid when The company requires encrypted traffic over a dedicated Direct Connect circuit without an additional application tunnel, it targets a different technical condition. MACsec encrypts layer-2 frames on supported dedicated Direct Connect connections.

Configure an AWS Site-to-Site VPN as a secondary hybrid path with BGP route preference would address a different requirement: The dedicated hybrid connection is healthy but a regional routing disruption requires automatic backup. The VPN offers an alternate encrypted path if the preferred Direct Connect route is unavailable.

This alternative, Use a Direct Connect gateway with an appropriate Transit Gateway association, is appropriate when A central network team needs to connect many VPCs over a common Direct Connect deployment. A Direct Connect gateway supports scalable private connectivity to multiple AWS VPC networks.

Although Provision an AWS Direct Connect connection and private virtual interface to the VPC transit design can be valid when A data center needs consistent private connectivity to AWS that bypasses the public internet, it targets a different technical condition. Direct Connect provides a dedicated network path rather than an internet-based encrypted tunnel.

Deploy separate Direct Connect connections at independent locations where feasible would address a different requirement: An existing Direct Connect path must remain available after a single physical connection failure. Physically diverse connections avoid a single circuit or colocation failure domain.

This alternative, Use a Direct Connect gateway with an appropriate Transit Gateway association, is appropriate when A central network team needs to connect many VPCs over a common Direct Connect deployment. A Direct Connect gateway supports scalable private connectivity to multiple AWS VPC networks.

Deploy separate Direct Connect connections at independent locations where feasible would address a different requirement: An existing Direct Connect path must remain available after a single physical connection failure. Physically diverse connections avoid a single circuit or colocation failure domain.

For the separate situation The company requires encrypted traffic over a dedicated Direct Connect circuit without an additional application tunnel, Evaluate Direct Connect MACsec on supported dedicated ports and locations could be useful. MACsec encrypts layer-2 frames on supported dedicated Direct Connect connections.

Provision an AWS Direct Connect connection and private virtual interface to the VPC transit design solves the related scenario A data center needs consistent private connectivity to AWS that bypasses the public internet; direct Connect provides a dedicated network path rather than an internet-based encrypted tunnel.

This alternative, Use a Direct Connect gateway with an appropriate Transit Gateway association, is appropriate when A central network team needs to connect many VPCs over a common Direct Connect deployment. A Direct Connect gateway supports scalable private connectivity to multiple AWS VPC networks.

Provision an AWS Direct Connect connection and private virtual interface to the VPC transit design solves the related scenario A data center needs consistent private connectivity to AWS that bypasses the public internet; direct Connect provides a dedicated network path rather than an internet-based encrypted tunnel.

Although Configure an AWS Site-to-Site VPN as a secondary hybrid path with BGP route preference can be valid when The dedicated hybrid connection is healthy but a regional routing disruption requires automatic backup, it targets a different technical condition. The VPN offers an alternate encrypted path if the preferred Direct Connect route is unavailable.