A multinational financial services enterprise is designing a secure, multi-region AWS netw… — AWS Certified Solutions Architect - Professional

A multinational financial services enterprise is designing a secure, multi-region AWS network architecture using AWS Organizations. The design must connect workloads in two regions: $us-east-1$ (acting as the primary region) and $us-west-2$ (acting as the disaster recovery region).

The architecture includes:
- In $us-east-1$ : A Shared Services account containing a Route 53 Private Hosted Zone (PHZ) named $corp.internal$ , a centralized egress VPC ( $vpc-egress-east$ ) containing stateful security appliances and NAT Gateways, and two spoke VPCs ( $vpc-payment-prod$ and $vpc-ledger-prod$ ) in separate business unit accounts.
- In $us-west-2$ : A disaster recovery spoke VPC ( $vpc-payment-dr$ ) in a business unit account.
- Two peered Transit Gateways: $tgw-useast1$ in $us-east-1$ and $tgw-uswest2$ in $us-west-2$ .

The networking requirements are:
1. Spoke VPCs in both regions must route all outbound internet traffic ( $0.0.0.0/0$ ) through the stateful security appliances.
2. Outbound traffic must be highly available and resilient to single Availability Zone outages.
3. Spoke VPCs must be able to privately resolve DNS queries for $corp.internal$ .
4. The design must minimize administrative overhead while adhering to AWS routing limitations.

Which of the following designs meets these requirements?

Deploy a local egress VPC ( $vpc-egress-west$ ) in $us-west-2$ containing NAT Gateways and security appliances in multiple Availability Zones. Route outbound traffic from $vpc-payment-dr$ via $tgw-uswest2$ to $vpc-egress-west$ . In $us-east-1$ , configure $tgw-useast1$ to route outbound traffic to $vpc-egress-east$ across multiple Availability Zones with Transit Gateway appliance mode enabled. Authorize and associate the $corp.internal$ Private Hosted Zone with the spoke VPCs in both regions using cross-account VPC associations.Answer
B
Route all outbound traffic from $vpc-payment-dr$ through the peered Transit Gateways to the central $vpc-egress-east$ VPC in $us-east-1$ to consolidate security inspection. In $vpc-egress-east$ , route traffic to a single NAT Gateway located in the $us-east-1a$ subnet to minimize NAT gateway costs. Associate the $corp.internal$ Private Hosted Zone with all spoke VPCs using a single centralized Route 53 Resolver inbound endpoint.
C
Deploy local egress VPCs with a single NAT Gateway in each region to minimize costs. Associate the $corp.internal$ Private Hosted Zone with $vpc-egress-east$ and configure the spoke VPCs to route DNS queries over the Transit Gateway peering attachment without setting up Route 53 Resolver endpoints or cross-account PHZ associations.
D
Route all outbound traffic from $vpc-payment-dr$ to $tgw-uswest2$ , then over the peering connection to $tgw-useast1$ , and out through $vpc-egress-east$ using its multi-AZ NAT Gateways. To resolve DNS, copy the zone file of $corp.internal$ to a new public Route 53 hosted zone in the disaster recovery account, and configure all VPCs to resolve queries against the public zone.

Answer

Deploy a local egress VPC in the disaster recovery region to handle local internet traffic, configure Transit Gateway appliance mode in the primary region's egress VPC, and perform cross-account Private Hosted Zone associations for private DNS resolution.

The correct design correctly implements local egress in the disaster recovery region because AWS Transit Gateway peering does not support transitive routing to NAT Gateways or firewalls in a peered region. It also achieves high availability and symmetric routing by configuring multi-AZ NAT Gateways and enabling Appliance Mode on the transit gateway attachment for the egress VPC. Furthermore, it securely resolves private DNS by utilizing Route 53 cross-account and cross-region Private Hosted Zone associations.

Step-by-Step Solution

Address the cross-region transit routing limitation for internet egress by planning local egress infrastructure in the disaster recovery region.

A local egress VPC (

vpc-egress-west

) is designed in

us-west-2

with its own multi-AZ NAT Gateways and security appliances, avoiding the invalid path over Transit Gateway peering.

AWS Transit Gateway peering does not support transitive routing to NAT Gateways or Internet Gateways in a peered region.

Ensure symmetric routing and high availability for security appliances in the primary region's egress VPC.

Transit Gateway appliance mode is enabled on the attachment for

vpc-egress-east

, and NAT Gateways are deployed in multiple Availability Zones.

Appliance mode ensures that stateful firewall inspection traffic returns to the same firewall instance, preventing routing asymmetry, while multi-AZ NAT Gateways prevent single points of failure.

Configure private DNS resolution across regions and accounts for the

corp.internal

zone.

The Shared Services account authorizes associations with the spoke VPCs in both regions, and the respective spoke accounts accept the associations.

Route 53 Private Hosted Zones can resolve DNS queries across accounts and regions only when authorized and associated using the cross-account association process.

Key Concept

AWS Transit Gateway transitive routing limitations, multi-AZ NAT Gateway resilience, stateful appliance routing with Transit Gateway appliance mode, and cross-account Private Hosted Zone association.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic