What is the MOST cost-effective solution that meets these requirements?

By:
In: SAP-C01
Tagged:
With: 2 Comments
A company has introduced a new policy that allows employees to work remotely from their homes if they connect by using a VPN.The company is hosting internal applications with VPCs in multiple AWS accounts.Currently, the applications are accessible from the company’s on-premises office network through an AWS Site- to-Site VPN connection.The VPC in the company’s main AWS account has peering connections established with VPCs in other AWS accounts.A solutions architect must design a scalable AWS Client VPN solution for employees to use while they work from home.

What is the MOST cost-effective solution that meets these requirements?

Create a Client VPN endpoint in each AWS account. Configure required routing that allows access to internal applications.

Create a Client VPN endpoint in the main AWS account. Configure required routing that allows access to internal applications.

Create a Client VPN endpoint in the main AWS account. Provision a transit gateway that is connected to each AWS account. Configure required routing that allows access to internal applications.

Create a Client VPN endpoint in the main AWS account. Establish connectivity between the Client VPN endpoint and the AWS Site-to-Site VPN.

Explanations:

Creating a Client VPN endpoint in each AWS account would increase costs significantly due to multiple endpoints, making it less cost-effective. It also adds complexity to the routing configuration across accounts.

Creating a single Client VPN endpoint in the main AWS account is the most cost-effective solution. It allows for centralized management of connections and simplifies routing, while providing access to all internal applications through peering connections.

Adding a transit gateway increases costs as it introduces additional charges for the transit gateway service. While it may provide scalability, it is not the most cost-effective solution for the requirements.

While establishing connectivity between the Client VPN endpoint and the AWS Site-to-Site VPN may allow for access to on-premises resources, it does not directly address the scalability and internal application access requirements, and it could involve additional setup complexity and costs.

2026-03-21

2 Comments

  1. Michael
    Author

    I sort that the answer is:
    Create a Client VPN endpoint in the main AWS account. Configure required routing that allows access to internal applications.

  2. Sandra
    Author

    My best guess is:
    Create a Client VPN endpoint in the main AWS account. Configure required routing that allows access to internal applications.

Leave a Reply

Your email address will not be published. Required fields are marked *

fifteen − five =