A company has deployed its AWS environment in a single AWS Region. The environment consists of a few hundred application VPCs, a shared services VPC, and a VPN connection to the company’s on-premises environment. A network engineer needs to implement a transit gateway with the following requirements:
• Application VPCs must be isolated from each other.
• Bidirectional communication must be allowed between the application VPCs and the on-premises network.
• Bidirectional communication must be allowed between the application VPCs and the shared services VPC. The network engineer creates the transit gateway with options disabled for default route table association and default route table propagation. The network engineer also creates the VPN attachment for the on-premises network and creates the VPC attachments for the application VPCs and the shared services VPC. The network engineer must meet all the requirements for the transit gateway by designing a solution that needs the least number of transit gateway route tables. Which combination of actions should the network engineer perform to accomplish this goal? (Choose two.)
Select 2 answers.
Marked answer: E
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose CE1
best possible but E is still not correct, because In E, we propagate all application VPC attachments. will it not allow app VPC communication internally ?
1
C &E is correct!
2
Options B and E are correct Based on information here: https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html Example: Isolated VPCs or Isolated VPCs with shared services "Attachments associated with one isolated router can route packets to each other, but cannot route packets to or receive packets from the attachments for another isolated router" - it means that one route table for all attachments will allow communication between each other (which violates requirements) (Option B) In order to provide isolated application VPCs with Transit Gateway (Option E) In order to provide bidirectional communication between on-premises and shared-services VPC and bidirectional communication between application VPCs and the shared services VPC, option E is correct
