ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Professional All Questions

View all questions & answers for the AWS Certified Solutions Architect - Professional exam
Go to Exam

Exam AWS Certified Solutions Architect - Professional topic 1 question 548 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional
Question #: 548
Topic #: 1
[All AWS Certified Solutions Architect - Professional Questions]

A company is designing a new highly available web application on AWS. The application requires consistent and reliable connectivity from the application servers in AWS to a backend REST API hosted in the company's on-premises environment. The backend connection between AWS and on-premises will be routed over an AWS Direct Connect connection through a private virtual interface. Amazon Route 53 will be used to manage private DNS records for the application to resolve the IP address on the backend REST API.
Which design would provide a reliable connection to the backend API?

  • A. Implement at least two backend endpoints for the backend REST API, and use Route 53 health checks to monitor the availability of each backend endpoint and perform DNS-level failover.
  • B. Install a second Direct Connect connection from a different network carrier and attach it to the same virtual private gateway as the first Direct Connect connection.
  • C. Install a second cross connect for the same Direct Connect connection from the same network carrier, and join both connections to the same link aggregation group (LAG) on the same private virtual interface.
  • D. Create an IPSec VPN connection routed over the public internet from the on-premises data center to AWS and attach it to the same virtual private gateway as the Direct Connect connection.
Show Suggested Answer Hide Answer
Suggested Answer: B 🗳️
by jay1ram2 at March 17, 2020, 9:45 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
01037
Highly Voted 3 years, 7 months ago
D. Why almost everyone chose B. B is clearly wrong. Check below. "You cannot associate a virtual private gateway with more than one Direct Connect gateway" in https://docs.aws.amazon.com/directconnect/latest/UserGuide/virtualgateways.html
upvoted 24 times
GeniusMikeLiu
3 years, 4 months ago
It should be D, question is care about secure, VPN with IP Sec is secure, and Direct Connect is Private not secure.
upvoted 4 times
Byrney
2 years, 6 months ago
"The application requires consistent and reliable connectivity" not secure.
upvoted 2 times
...
desertlotus1211
2 years, 5 months ago
Tell me what makes a 'Direct' connection unsecure? A direct connection is private dark fiber...
upvoted 1 times
...
...
LCC92
3 years, 6 months ago
"You cannot associate a virtual private gateway with more than one Direct Connect gateway" Direct Connect Gateway is a different entity, we dont use it in this question.
upvoted 10 times
...
LCC92
3 years, 6 months ago
we can associate a VPG with multiple DX. https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect.html "Figure 6 - Redundant AWS Direct Connect" The correct answer is B.
upvoted 17 times
heany
2 years, 7 months ago
correct. Direct connect gateway is not required here. two Direct connects can be connected to VIFs of VPG
upvoted 2 times
...
...
Jesuisleon
1 year, 11 months ago
Direct Connect and Direct conenct gateway are different things. In B, we reuse the already existing Direct connect gateway and set up a second direct connection. So B is right
upvoted 1 times
...
...
jay1ram2
Highly Voted 3 years, 8 months ago
My answer is B - 2 DX connection to on-prem provides more reliable connectivity between AWS and data center https://aws.amazon.com/answers/networking/aws-multiple-data-center-ha-network-connectivity/ A - The ask is, Which design would provide a "reliable connection" to the backend API? not to re-design the backend implementation for High Availability. C - 2 DX connections from the same provider create a single point of failure D - VPN over the public internet is generally less reliable than a dedicated DX connection.
upvoted 22 times
...
MikelH93
Most Recent 1 year, 12 months ago
Selected Answer: B
pls they said "reliable connection" so it's B not D
upvoted 1 times
...
mrgreatness
2 years, 6 months ago
Im going B as there is no mention of secure
upvoted 2 times
...
joanneli77
2 years, 7 months ago
A VPN+DX is common because it is cheap, but it is not as reliable as two DX (add CGW hardware and different routing paths and it's messy). Two DX can be connected to one VGW.
upvoted 1 times
...
kadev
2 years, 9 months ago
Maybe the Question is not exactly. "a secure connection " => D maybe almost matching. But why we need VPN over internet while we have Direct Connect lol
upvoted 1 times
...
Harithareddynn
2 years, 9 months ago
Selected Answer: D
The question is about security, hence VPN connection is needed and it is D
upvoted 1 times
epomatti
2 years, 8 months ago
No, it says "reliable", not secure. Not the same thing.
upvoted 1 times
...
3a632a3
1 year, 4 months ago
The premise of the argument is incorrect as the question already states that they are using 1 DX connection. Adding a VPN as a backup doesn't make the DX connection anymore secure.
upvoted 1 times
...
...
hilft
2 years, 9 months ago
It's D.
upvoted 1 times
...
KiraguJohn
2 years, 10 months ago
Which architecture would be most likely to establish a secure connection to the backend API? - Did i miss anything here? i thought the question is about security
upvoted 1 times
nexus2020
2 years, 9 months ago
Not sure what you are trying to say here. Direct Connect is private, and it is secure as no one else can see what going on there. VPN is secure, based on it is encrypted, but VPN is used on public network due to the nature that the public network is public, not secure. VPN is not more secure than Direct Connect. so IMO, DirectConnect is fine.
upvoted 1 times
...
...
Student1950
2 years, 10 months ago
here is the correct link https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html
upvoted 2 times
...
Student1950
2 years, 10 months ago
I believe Answer should be D but its not worded correctly. Basically we can enable IPSec VPN on existing DX connection using Public VIF of DX to establish secure communication between AWS and On-Prem as the link below https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-aws-transit-gateway-vpn.html
upvoted 1 times
...
JonnyB1001
2 years, 10 months ago
Not A: thats HA. Not B: You cannot associate a virtual private gateway with more than one Direct Connect gateway and you cannot attach a private virtual interface to more than one Direct Connect gateway. C: same-same, so not dependable. D: provides secure and diverse route. So D is the answer
upvoted 1 times
...
hilft
2 years, 10 months ago
I would go for D
upvoted 1 times
...
KiraguJohn
2 years, 10 months ago
D: For a secure connection B: For a redundancy
upvoted 1 times
...
bobsmith2000
2 years, 12 months ago
Selected Answer: B
"content and dependable" connection. It's definitively B. For encryption in transit via Direct Connect in case of REST the one could use HTTPS
upvoted 2 times
...
Alvindo
3 years ago
Answer is D B is for redundancy question asked SECURE, which a VPN offers since it encrypts the networl
upvoted 1 times
...
Netaji
3 years, 1 month ago
Selected Answer: B
when its DX, it's secure by default because it's not internet comparatively - question also says as first condition " The application needs constant and dependable communication between its AWS application servers and a backend REST API housed on-premises." so its B people are saying Direct connect gateway I agree not mentioned answer so no question and normal DX will connect 2 connection on VPG as below https://aws.amazon.com/directconnect/resiliency-recommendation/?nc=sn&loc=4&dn=2 if anyone want to see a direct connect gateway, please see below URL https://www.stax.io/changelog/2020-10-06-new-direct-connect-functionality-for-stax-networks/
upvoted 2 times
...
Load full discussion...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago