AWS Certified Solutions Architect – Associate (SAA-C03) — Question 861

A company is migrating five on-premises applications to VPCs in the AWS Cloud. Each application is currently deployed in isolated virtual networks on premises and should be deployed similarly in the AWS Cloud. The applications need to reach a shared services VPC. All the applications must be able to communicate with each other.

If the migration is successful, the company will repeat the migration process for more than 100 applications.

Which solution will meet these requirements with the LEAST administrative overhead?

Answer options

• A. Deploy software VPN tunnels between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC.
• B. Deploy VPC peering connections between the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets to the shared services VPC through the peering connection.
• C. Deploy an AWS Direct Connect connection between the application VPCs and the shared services VPAdd routes from the application VPCs in their subnets to the shared services VPC and the applications VPCs. Add routes from the shared services VPC subnets to the applications VPCs.
• D. Deploy a transit gateway with associations between the transit gateway and the application VPCs and the shared services VPC. Add routes between the application VPCs in their subnets and the application VPCs to the shared services VPC through the transit gateway.

Correct answer: D

Explanation

AWS Transit Gateway acts as a highly scalable, centralized cloud router that simplifies network topology, making it the ideal solution for connecting more than 100 VPCs with minimal administrative effort. In contrast, using VPC peering or software VPNs to connect over 100 VPCs would require creating and managing a complex, hard-to-maintain mesh of individual point-to-point connections. AWS Direct Connect is designed for connecting on-premises data centers to AWS rather than facilitating routing between a large number of cloud-native VPCs.