Exam AWS Certified Solutions Architect - Associate SAA-C02 topic 1 question 233 discussion

B, C, and D enable resources sharing between VPCs, therefore none of them can be the correct answer. The elimination, A is the answer. Also VPN on top of DX to provide encryption.

Ans : A sure Check link https://docs.aws.amazon.com/whitepapers/latest/aws-vpc-connectivity-options/aws-direct-connect-vpn.html

Option D: Create a new VPC called Network. Within the Network VPC, create an AWS Transit Gateway with an AWS Direct Connect connection back to the data center. Attach all the other VPCs to the Network VPC.

Option D is the recommended solution. The solution architect should create a new VPC called Network and create an AWS Transit Gateway within the Network VPC. An AWS Direct Connect connection should be established from the AWS Transit Gateway back to the data center. The other three VPCs should be attached to the Network VPC, and the traffic can be routed through the AWS Transit Gateway to the data center. This solution is scalable, secure, and maintains the separation between the VPCs. By using a single AWS Transit Gateway, the solution reduces complexity and simplifies the management of the network architecture. Additionally, this solution provides better control and monitoring capabilities, enabling the organization to maintain high levels of security and compliance.

Answer A, all others sharing connections

Answer is A

Answer is A

"ensure security and avoid resource sharing". all 3 VPC require own VPN.

D is better https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-network-security-for-vpc-to-vpc-and-on-premises-to-vpc-traffic.html

D is right no need to 4 direct connect connection to each VPC plus VPN, one Network VPC can handle.

Transit Gateway is a Regional resource and can connect thousands of VPCs within the same AWS Region. You can create multiple Transit Gateway instances per Region, and you can connect to a maximum of three Transit Gateway instances over a single Direct Connect connection for hybrid connectivity. Typically, you can use just one Transit Gateway instance connecting all your VPC instances in a given Region, and use Transit Gateway routing tables to isolate them wherever needed. There is a valid case for creating multiple Transit Gateway instances to limit misconfiguration blast radius, segregate control plane operations and administrative ease-of-use https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/building-scalable-secure-multi-vpc-network-infrastructure.pdf

Answer should be A

A as you do not need to create a new VPC network for using transit gateway. It is not like NAT gateway which needs to be in public subnet within VPC.

We have to use Transit Gateway for scalability. https://aws.amazon.com/premiumsupport/knowledge-center/transit-gateway-connect-vpcs-from-vpn/

I will go with D. For scalability , Transit GW is way better and flexible for routing.

lets end the war : https://aws.amazon.com/premiumsupport/knowledge-center/transit-gateway-connect-vpcs-from-vpn/ A is not scalable. you create DX and VPN on each VPC ? that alot effort

A seems correct