AWS Certified Solutions Architect – Associate (SAA-C03) — Question 681

A company has an AWS Direct Connect connection from its on-premises location to an AWS account. The AWS account has 30 different VPCs in the same AWS Region. The VPCs use private virtual interfaces (VIFs). Each VPC has a CIDR block that does not overlap with other networks under the company's control.

The company wants to centrally manage the networking architecture while still allowing each VPC to communicate with all other VPCs and on-premises networks.

Which solution will meet these requirements with the LEAST amount of operational overhead?

Answer options

• A. Create a transit gateway, and associate the Direct Connect connection with a new transit VIF. Turn on the transit gateway's route propagation feature.
• B. Create a Direct Connect gateway. Recreate the private VIFs to use the new gateway. Associate each VPC by creating new virtual private gateways.
• C. Create a transit VPConnect the Direct Connect connection to the transit VPCreate a peering connection between all other VPCs in the Region. Update the route tables.
• D. Create AWS Site-to-Site VPN connections from on premises to each VPC. Ensure that both VPN tunnels are UP for each connection. Turn on the route propagation feature.

Correct answer: A

Explanation

AWS Transit Gateway acts as a centralized regional router, easily facilitating any-to-any communication between multiple VPCs and on-premises networks with minimal administrative overhead. Using a transit VIF with AWS Direct Connect allows the on-premises environment to connect directly to the Transit Gateway, which then handles routing for all 30 VPCs. Other options like full-mesh VPC peering or individual Site-to-Site VPNs introduce significant management complexity, while a Direct Connect gateway with private VIFs does not natively support VPC-to-VPC routing.