Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-VPC environment in the `us-west-2` region. The design includes a central egress VPC (`vpc-egress`) and two spoke VPCs (`vpc-workload-a` and `vpc-workload-b`). The workloads must route all internet-bound traffic through the central egress VPC. The architecture must be highly available across two Availability Zones (`us-west-2a` and `us-west-2b`) without any single points of failure. Additionally, the workloads in the spoke VPCs must resolve private DNS names hosted in a Route 53 Private Hosted Zone (PHZ) `corp.internal` that is managed in a separate shared services AWS account.

Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

  1. Deploy a NAT Gateway in the public subnet of each Availability Zone in the egress VPC. Configure the private subnet route tables to direct outbound traffic to the NAT Gateway in the corresponding Availability Zone.Answer
  2. Create VPC association authorizations for the spoke VPCs from the shared services AWS account where the private hosted zone is hosted, and associate the private hosted zone with the spoke VPCs using the AWS CLI or SDK.Answer
  3. C
    Deploy a single NAT Gateway in one Availability Zone within the egress VPC, and configure the route tables of all other subnets in the egress VPC to route internet-bound traffic through this NAT Gateway to minimize costs.
  4. D
    Associate the private hosted zone with the shared services VPC and rely on Transit Gateway route propagation to transitively resolve private DNS records from the spoke VPCs.
  5. E
    Use an AWS Direct Connect Gateway associated with all three VPCs to enable transitive VPC-to-VPC routing for outbound internet-bound traffic.

Answer

Deploy a NAT Gateway in each Availability Zone in the egress VPC, and create VPC association authorizations in the shared services account to associate the Private Hosted Zone with the spoke VPCs.
The correct configurations deploy a NAT Gateway in the public subnet of each Availability Zone in the egress VPC, and route private subnet traffic to the local NAT Gateway. This ensures high availability and avoids cross-AZ traffic charges. Additionally, cross-account association of the Route 53 Private Hosted Zone must be authorized by the shared services account and associated with each spoke VPC so they can resolve the `corp.internal` domains.

Step-by-Step Solution

1
Ensure NAT gateway redundancy in the egress VPC by deploying a NAT Gateway in the public subnet of each Availability Zone.
Egress traffic remains resilient to Availability Zone outages, preventing a single point of failure.
Routing traffic across Availability Zones to a single NAT Gateway violates the high availability requirement.
2
Configure the spoke VPCs to route internet-bound traffic via Transit Gateway to the egress VPC, and map subnets in the egress VPC to route traffic to their respective local NAT Gateways.
Spoke VPC outbound traffic is successfully routed to the internet with AZ-level isolation.
This establishes the path for egress traffic through the central egress VPC.
3
Create VPC association authorizations for the spoke VPCs in the shared services account, and complete the associations in the workload accounts.
The spoke VPCs are associated with the PHZ and can resolve DNS queries for `corp.internal`.
Route 53 Private Hosted Zones do not support transitive DNS resolution over Transit Gateway, so they must be explicitly associated with each VPC.

Key Concept

High availability configuration of NAT Gateways for centralized egress and cross-account Route 53 Private Hosted Zone association.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic