Question 480
During an AWS global infrastructure design review, the decisive constraint is: A security team needs to isolate internet egress for different migrated divisions. What is the most appropriate design under these constraints?
Explanation
Correct Answer
Segment VPC and Transit Gateway route tables and apply centrally inspected egress. Segmented routing limits shared east-west access among migration tenants.
Incorrect Answers
Connect networks through approved Direct Connect or Site-to-Site VPN with correct routes would address a different requirement: An application moved to private AWS subnets must retain a secure private path to its on-premises database during transition. Hybrid transport and routing are needed while database calls remain on-premises.
This alternative, Redesign IP allocation or introduce scoped translation/proxy connectivity, is appropriate when A migrated service's VPC overlaps an acquired subsidiary's on-premises address space. Direct routed VPC connectivity cannot transparently handle overlapping CIDR blocks.
For the separate situation A new public ALB must call migrated app tasks hosted only in private subnets, Configure proper ALB target groups, VPC routes and security-group references could be useful. The ALB accepts public ingress while its registered targets remain privately addressed.