Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A media streaming company is launching a new video-processing platform in the us-west-2 region. The architecture consists of a Production VPC (vpc-prod-processing) and a Shared Services VPC (vpc-shared-services), both connected via an AWS Transit Gateway. The video-processing EC2 instances are distributed across two Availability Zones (us-west-2a and us-west-2b) in private subnets of vpc-prod-processing and must access the internet to download transcoding packages and license updates. The company wants to centralize all outbound internet traffic through vpc-shared-services to inspect traffic and minimize costs. Additionally, the EC2 instances in vpc-prod-processing need to resolve internal database endpoints registered in a Route 53 Private Hosted Zone (corp.internal) managed within vpc-shared-services. The solution must be highly resilient, preventing any single points of failure. Which two actions should the Solutions Architect take to satisfy these requirements? (Select TWO.)

  1. Deploy a NAT Gateway in a public subnet within both us-west-2a and us-west-2b in the Shared Services VPC, and route outbound traffic from the Transit Gateway subnet route tables to the NAT Gateway in the same Availability Zone.Answer
  2. Associate the Route 53 Private Hosted Zone corp.internal with both the Shared Services VPC and the Production VPC.Answer
  3. C
    Deploy a single NAT Gateway in a public subnet of the Shared Services VPC to centralize outbound traffic from both Availability Zones.
  4. D
    Rely on the Transit Gateway's default DNS propagation to automatically route DNS queries for corp.internal from the Production VPC to the Shared Services VPC without modifying private hosted zone associations.
  5. E
    Configure a Direct Connect Gateway attached directly to both VPCs to facilitate transitive routing of outbound internet traffic and DNS queries between the VPCs.

Answer

Deploy a NAT Gateway in each Availability Zone in the Shared Services VPC to prevent single points of failure, and associate the Route 53 Private Hosted Zone corp.internal with both the Shared Services VPC and the Production VPC to allow resolution of internal DNS names.
The correct solution involves deploying a NAT Gateway in each Availability Zone of the Shared Services VPC to ensure high availability and prevent single points of failure. Additionally, the Route 53 Private Hosted Zone corp.internal must be explicitly associated with the Production VPC to allow DNS queries originating from that VPC to resolve successfully.

Step-by-Step Solution

1
Ensure internet egress redundancy in the hub VPC.
Two NAT Gateways are deployed, one in each Availability Zone of the Shared Services VPC.
This guarantees that outbound connectivity is resilient against an Availability Zone outage.
2
Configure routing for centralized egress.
Outbound traffic from the Production VPC is directed to the Transit Gateway, which forwards it to the Shared Services VPC where route tables point to the local NAT Gateways.
This establishes a centralized egress path without creating a single point of failure.
3
Associate the Route 53 Private Hosted Zone with the consumer VPC.
The Private Hosted Zone corp.internal is associated with the Production VPC.
This allows resources in the Production VPC to query the Route 53 Resolver and successfully resolve endpoints in the Private Hosted Zone.

Key Concept

Centralized egress design requires multi-AZ NAT Gateways to avoid a single point of failure, and Route 53 Private Hosted Zones require explicit association with all VPCs that need to resolve their records.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic