A company has 225 mobile and desktop devices and 300 partner VPNs that need access to an AWS VPC. VPN users should not be able to reach one another. Which approach will meet the technical and security requirements while minimizing costs?
A.
Use the AWS IPsec VPN for the mobile, desktop, and partner VPN connections. Use network access control lists (Network ACLs) and security groups to maintain routing separation.
B.
Use the AWS IPsec VPN for the partner VPN connections. Use an Amazon EC2 instance VPN for the mobile and desktop devices. Use Network ACLs and security groups to maintain routing separation.
C.
Create an AWS Direct Connect connection between on-premises and AWS Use a public virtual interface to connect to the AWS IPsec VPN for the mobile, desktop, and partner VPN connections.
D.
Use an Amazon EC2 instance VPN for the desktop, mobile, and partner VPN connections. Use features of the VPN instance to limit routing and connectivity.
D option is incomplete. which must be = Use an Amazon EC2 instance VPN for the desktop, mobile, and partner VPN connections. Use features of the VPN instance to limit routing and connectivity. and my opinion of correct answer is D
By elimination method: A: can't be correct since mobile/desktops can't use AWS VPN, B: Can't be correct, since NACLs will not control traffic between edges (CGW bound nets), C: we don't need Directconnect in this case. D: seems correct to me.
No distinction made between site-to-site versus client-vpn solutions. That implies it's all site-to-site. Question is outdated and should include distinction.
B is Correct, partners imply on-prem facility..it says they need access to your VPC, much the same as your own on-prem, you create a VPN onto your VPC. Mobile devices are small and EC2 can handle the load, it's a clean routing solution.
I go with B.
According to https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-limits.html
Site-to-Site VPN resources
Customer gateways per Region: 50
Virtual private gateways per Region: 5
You can attach only one virtual private gateway to a VPC at a time...
Site-to-Site VPN connections per Region: 50
Site-to-Site VPN connections per virtual private gateway: 10
This is about one VPC. You can only attach one VGW to it. The VGW can only have 10 VPNs. The limit is 10 not 50 in my opinion. But anyway, this makes B incorrect.
However, with option B, having 300 VPNs with non-overlapping blocks is difficult. This is create CloudHub VPN; I am not sure how NACL/SG restrictions will be applied to avoid cross-communication.
You can have up to fifty (50) Site-to-Site VPN connections per virtual gateway.
One VPC can have only one VGW attached, so each VPC can have up to 50 AWS VPN connections
And that simply eliminates A&B
Answer is D
Guys this is the complete question with complete answers and the correct answer as per the book is B
Book: AWS Certified Advanced Networking – Specialty By Saransh Paliwal
A company has 225 mobile and desktop devices and 300 partner VPNs that need access to an AWS VPC. VPN users should not be able to reach one another. Which approach will meet the technical and security requirements while minimizing costs?
A. Use the AWS IPsec VPN for the mobile, desktop, and partner VPN connections. Use network access control lists (Network ACLs) and security groups to maintain routing separation.
B. Use the AWS IPsec VPN for the partner VPN connections. Use an Amazon EC2 instance VPN for the mobile and desktop devices. Use Network ACLs and security groups to maintain routing separation.
C. Create an AWS Direct Connect connection between on-premises and AWS Use a public virtual interface to connect to the AWS IPsec VPN for the mobile, desktop, and partner VPN connections.
D. Use an Amazon EC2 instance VPN for the desktop, mobile, and partner VPN connections. Use features of the VPN instance to limit routing and connectivity.
Correct Answer: B
Looks like this book has most of the questions and answers in a complete sense. But the answers may or may not be right. At least we can use it to complete any questions or answers that maybe missing so we can better answer the questions as a group.
it is not an official book. the answers of these questions have the same source throughout all the web pages in the internet. examtopics or other websites get the answers from a 3rd party and they are usually wrong for AWS exams. so do not trust the answers. focus on the discussions part
B seems to make some sense but there are two issues: 1) "Use Network ACLs and security groups to maintain routing separation" does not apply to the edges; 2) VPN connections per VPC = 50. Therefore, we are left with D.
More digging on the subject indicates that client VPN offers granular control — It enables you to implement custom security controls by defining network-based access rules. These rules can be configured at the granularity of Active Directory groups. You can also implement access control using security groups.
B, or D am not sure.
B, a market place instance like openvpn for client to site vpn and VGW with IPsec for site-to-site vpn. downside is the 1.25gb/s limit on the vgw(technical bottle neck for 300 partners with ipsec encryp/decryp.
D: market place appliance on an instance will scale to 2.5g and you can scale up too by adding more. But D doesn't have IPsec.
This section is not available anymore. Please use the main Exam Page.ANS-C00 Exam Questions
Log in to ExamTopics
Sign in:
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
samiraninside
Highly Voted 3 years, 8 months agosimpler
Highly Voted 3 years, 8 months agoPavanKushwah123
Most Recent 2 years, 5 months agojoanneli77
2 years, 7 months agoAzureDP900
3 years, 4 months agoFarrowsBight
3 years, 5 months agoceros399
3 years, 6 months agoCyril_the_Squirl
3 years, 7 months agoVlan
3 years, 7 months agoHuntkey
3 years, 7 months agosapien45
3 years, 2 months agoHuntkey
3 years, 7 months agoSmart
3 years, 7 months agoSmart
3 years, 7 months agoPeppaPig
3 years, 7 months agoMalicaide
3 years, 7 months agoMalicaide
3 years, 7 months agocertificatores
3 years, 7 months agoJohnny_Green
3 years, 7 months agoJohnny_Green
3 years, 7 months agobackfringe
3 years, 8 months agoOrel
3 years, 8 months agoAjani
3 years, 8 months ago