Exam AWS Certified Solutions Architect - Professional All Questions

View all questions & answers for the AWS Certified Solutions Architect - Professional exam

Exam AWS Certified Solutions Architect - Professional topic 1 question 867 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 867
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A software company is using three AWS accounts for each of its 10 development teams. The company has developed an AWS CloudFormation standard VPC template that includes three NAT gateways. The template is added to each account for each team. The company is concerned that network costs will increase each time a new development team is added. A solutions architect must maintain the reliability of the company's solutions and minimize operational complexity.
What should the solutions architect do to reduce the network costs while meeting these requirements?

A. Create a single VPC with three NAT gateways in a shared services account. Configure each account VPC with a default route through a transit gateway to the NAT gateway in the shared services account VPC. Remove all NAT gateways from the standard VPC template.
B. Create a single VPC with three NAT gateways in a shared services account. Configure each account VPC with a default route through a VPC peering connection to the NAT gateway in the shared services account VPC. Remove all NAT gateways from the standard VPC template.
C. Remove two NAT gateways from the standard VPC template. Rely on the NAT gateway SLA to cover reliability for the remaining NAT gateway.
D. Create a single VPC with three NAT gateways in a shared services account. Configure a Site-to-Site VPN connection from each account to the shared services account. Remove all NAT gateways from the standard VPC template.

Show Suggested Answer

Suggested Answer: A 🗳️

by Bigbearcn at April 23, 2022, 5:13 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Bigbearcn

Highly Voted 3 years, 2 months ago

Selected Answer: A

It's A. https://aws.amazon.com/cn/blogs/networking-and-content-delivery/creating-a-single-internet-exit-point-from-multiple-vpcs-using-aws-transit-gateway/

upvoted 12 times

snakecharmer2

3 years, 1 month ago

correct A, and also vpc peering is not Transitive, cant be used for egress using NAT. so B is wrong

upvoted 3 times

user0001

3 years, 1 month ago

if you read B , it say each VPC peered with the shared VPC which will work in this case

upvoted 1 times

Byrney

2 years, 7 months ago

B won't work: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html "If VPC A has an NAT device that provides internet access to subnets in VPC A, resources in VPC B can't use the NAT device in VPC A to access the internet."

upvoted 2 times

...

Byrney

Most Recent 2 years, 7 months ago

Selected Answer: A

Byrney 0 minutes ago Awaiting moderator approval B won't work: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html "If VPC A has an NAT device that provides internet access to subnets in VPC A, resources in VPC B can't use the NAT device in VPC A to access the internet."

upvoted 1 times

...

AwsBRFan

2 years, 8 months ago

Selected Answer: A

"minimize operational complexity." so peering is not the best choice,

upvoted 1 times

...

skywalker

2 years, 8 months ago

Selected Answer: B

B Between A nd B, i go for B as there are only 3 accounts/vpc to be peer. No need to have Transit Gateway which added additional cost.

upvoted 1 times

Pigi_102

2 years, 7 months ago

3 account for each of 10 development teams. This count at least 30 account/vpc.

upvoted 1 times

...

gnic

2 years, 10 months ago

Selected Answer: A

Why guys you are pointing accent on costs? The question ask for reliability and operational complexity. Should be A in this case.

upvoted 1 times

gnic

2 years, 10 months ago

Also the NAT Gateway are in the shared services account, it should save costs.

upvoted 1 times

...

CloudHandsOn

2 years, 11 months ago

B. This is my final answer

upvoted 1 times

...

Enigmaaaaaa

2 years, 11 months ago

Selected Answer: A

A will reduce operational complexity for sure. B is incorrect - you have limitation of peering connection of 125 MAX also you cant route traffic to NAT using peering https://docs.aws.amazon.com/vpc/latest/peering/invalid-peering-configurations.html#edge-to-edge-vgw "If either VPC in a peering relationship has one of the following connections, you cannot extend the peering relationship to that connection: An internet connection through an internet gateway An internet connection in a private subnet through a NAT device "

upvoted 3 times

...