A global enterprise requires highly available hybrid connectivity between its on-premises data centers in New York and London to AWS VPCs in us-east-1 and eu-west-2. The solution must provide line-rate encryption and protect against a single AWS Direct Connect location failure. Which architecture meets these requirements with the LEAST operational overhead?

Answer options:

Provision one DX connection per region. Establish IPsec VPNs over the DX connections to Transit Gateways.

Provision two DX connections in each region at different DX locations. Enable MACsec on the connections. Use Direct Connect gateways associated with Transit Gateways in each region.

Provision two DX connections per region. Use AWS VPN CloudHub for encryption and routing between regions.

Provision one DX connection and one Site-to-Site VPN per region. Enable MACsec on the VPN.

How to approach this question

Identify the requirement for line-rate encryption (MACsec) and location resiliency (two DX locations).

Full Answer

B.Provision two DX connections in each region at different DX locations. Enable MACsec on the connections. Use Direct Connect gateways associated with Transit Gateways in each region.✓ Correct

Provision two Direct Connect connections in each region at different DX locations. Enable MACsec on the connections. Use Direct Connect gateways associated with Transit Gateways in each region.

MACsec (IEEE 802.1AE) provides hardware-based, line-rate encryption over Direct Connect. Using two connections at different locations ensures high availability.

Common mistakes

Selecting IPsec VPN over DX, which limits throughput.

All questions Question 02

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 6

75 questions · hints · full answers · grading

More questions from this exam

Q02An organization has 50 VPCs across two AWS Regions connected via Transit Gateways (TGW). The TGWs...Hard Q03A company uses AWS Organizations. The network team wants to share a central Transit Gateway (TGW)...Medium Q04An enterprise has on-premises data centers in the US and Europe. They want to use the AWS global ...Hard Q05A company requires that all API calls to Amazon S3 from their VPC must not traverse the public in...Medium Q06An enterprise uses AWS Organizations with all features enabled. The CISO mandates that no AWS acc...Hard

View all 75 questions →