Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An organization is establishing a new payment and inventory processing system in the `us-west-2` Region. The architecture contains a payment VPC (`vpc-payments-prd`) and an inventory VPC (`vpc-inventory-prd`). Hybrid connectivity to the on-premises database servers is established using an AWS Direct Connect connection. To support local service discovery, the organization hosts a Route 53 Private Hosted Zone (PHZ) named `service.internal` inside a central shared-services AWS account. Workloads in both VPCs must be able to communicate with each other, connect to the on-premises database, and resolve DNS queries for `service.internal`. Which networking design meets these requirements while ensuring high availability and minimal routing complexity?

  1. Attach both `vpc-payments-prd` and `vpc-inventory-prd`, along with the AWS Direct Connect Gateway, to an AWS Transit Gateway. Configure Transit Gateway route tables to allow VPC-to-VPC and VPC-to-on-premises traffic. Perform cross-account authorization and associate the Route 53 Private Hosted Zone `service.internal` directly with both `vpc-payments-prd` and `vpc-inventory-prd`.Answer
  2. B
    Attach both `vpc-payments-prd` and `vpc-inventory-prd` directly to the AWS Direct Connect Gateway. Use the Direct Connect Gateway's built-in routing to forward traffic between the VPCs and the on-premises network. Associate the Route 53 Private Hosted Zone `service.internal` directly with the Direct Connect Gateway.
  3. C
    Attach both `vpc-payments-prd` and `vpc-inventory-prd`, along with the AWS Direct Connect Gateway, to an AWS Transit Gateway. Configure Transit Gateway routing for network connectivity. Associate the Route 53 Private Hosted Zone `service.internal` with the AWS Transit Gateway to enable DNS resolution across all attached VPCs.
  4. D
    Attach both `vpc-payments-prd` and `vpc-inventory-prd`, along with the AWS Direct Connect Gateway, to an AWS Transit Gateway. Deploy a single NAT Gateway in `vpc-payments-prd` to route all outbound hybrid and cross-VPC traffic. Associate the Route 53 Private Hosted Zone `service.internal` directly with both VPCs.

Answer

Attach both VPCs and the Direct Connect Gateway to an AWS Transit Gateway to enable routing, and perform cross-account authorization and association of the Route 53 Private Hosted Zone with both VPCs.
The correct architecture uses AWS Transit Gateway to act as a cloud router, enabling communication between the two VPCs and the on-premises data center via the Direct Connect Gateway. Additionally, Route 53 Private Hosted Zones must be associated with each VPC that needs to resolve the namespace. Since the hosted zone is in a centralized shared services account, cross-account association authorizations must be created to associate the zone with the payment and inventory VPCs.

Step-by-Step Solution

1
Deploy an AWS Transit Gateway and attach both VPCs and the AWS Direct Connect Gateway to it.
Enables transitive routing between the two spoke VPCs and the on-premises network.
Direct Connect Gateway does not support transitive routing, meaning spoke VPCs cannot communicate with each other through it. An AWS Transit Gateway is required to facilitate VPC-to-VPC and hybrid traffic.
2
Configure the Transit Gateway route tables to propagate routes from the VPCs and the Direct Connect Gateway.
Establishes network-level connectivity between all resources.
Proper route table configuration ensures that traffic is correctly routed between the on-premises CIDR ranges and the spoke VPC CIDRs.
3
Authorize and associate the Route 53 Private Hosted Zone with both VPCs from the central account.
Enables DNS resolution for the `service.internal` namespace in both VPCs.
Private Hosted Zones must be associated with each VPC individually. Because the zone resides in a different AWS account, a cross-account authorization must be created first before the association can be established.

Key Concept

AWS Transit Gateway for hybrid transitive routing and cross-account Route 53 Private Hosted Zone associations.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic