Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A company is designing a new application environment on AWS. The application consists of workloads running in private subnets across two Availability Zones (us-east-1a and us-east-1b) in VPC-A. The workloads in VPC-A must access external updates from the internet securely and also resolve private domain names hosted in a Route 53 Private Hosted Zone in VPC-B. VPC-A and VPC-B are connected using an AWS Transit Gateway. Which two configuration steps should the solutions architect perform to establish secure, redundant internet egress and private DNS resolution? (Select TWO.)

  1. Deploy a NAT Gateway in a public subnet in us-east-1a and a second NAT Gateway in a public subnet in us-east-1b. Configure the route table of each private subnet to direct outbound 0.0.0.0/0 traffic to the NAT Gateway in its respective Availability Zone.Answer
  2. Associate the Route 53 Private Hosted Zone in VPC-B with VPC-A, and verify that DNS resolution and DNS hostnames are enabled for VPC-A.Answer
  3. C
    Deploy a single NAT Gateway in a public subnet in us-east-1a. Configure a single route table shared across both private subnets in us-east-1a and us-east-1b to route outbound 0.0.0.0/0 traffic to this NAT Gateway.
  4. D
    Configure Transit Gateway route tables to route all outbound internet traffic from VPC-A through a Direct Connect Gateway associated with VPC-B.
  5. E
    Set up a Route 53 Resolver outbound endpoint in VPC-B and a Route 53 Resolver inbound endpoint in VPC-A to forward and resolve private DNS queries between the VPCs.

Answer

Deploy a NAT Gateway in each Availability Zone and associate VPC-A's private route tables to their local NAT Gateway, then associate the Route 53 Private Hosted Zone in VPC-B directly with VPC-A.
Deploying a NAT Gateway in each Availability Zone avoids cross-AZ dependencies and ensures egress redundancy. For private DNS resolution within AWS, associating the Route 53 Private Hosted Zone from VPC-B with VPC-A directly resolves queries across the VPC boundaries without extra infrastructure.

Step-by-Step Solution

1
Address high availability requirements for outbound internet traffic.
Deploy one NAT Gateway per Availability Zone (us-east-1a and us-east-1b) in public subnets, and configure separate private route tables mapping 0.0.0.0/0 to the local zone's NAT Gateway.
Ensures that Availability Zone failures do not cause a complete loss of internet egress for workloads in the surviving zone.
2
Address cross-VPC private DNS resolution requirements.
Associate the Route 53 Private Hosted Zone belonging to VPC-B with VPC-A.
Allows instances in VPC-A to resolve private domain names defined in VPC-B directly, without needing to route queries through costly and complex resolver endpoints.

Key Concept

High availability network egress design using multi-AZ NAT Gateways combined with cross-VPC Route 53 Private Hosted Zone association.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic