Examkin

Question

Difficulty: HardNetworking and Connectivity Design

A logistics enterprise is establishing a new platform across multiple AWS accounts in the eu-central-1 Region. The architecture requires three production spoke VPCs (vpc-delivery-prod, vpc-warehouse-prod, and vpc-tracking-prod) to communicate with one another for real-time inventory updates. Additionally, these spoke VPCs must connect to the corporate on-premises network via a 10 Gbps AWS Direct Connect connection. The enterprise also requires secure, highly available outbound internet access for all spokes to download software patches, and name resolution for a private DNS zone (corp.internal) hosted in a central shared services account. Which architecture should a solutions architect recommend to satisfy these requirements while preventing single points of failure and minimizing administrative overhead?

  1. Deploy an AWS Transit Gateway and attach the three spoke VPCs, the shared services VPC, and a dedicated egress VPC to it. Associate the Direct Connect Gateway with the Transit Gateway to enable hybrid connectivity. In the egress VPC, deploy NAT Gateways across multiple Availability Zones, and configure the Transit Gateway route tables to route all outbound internet traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone corp.internal with all spoke VPCs, the shared services VPC, and the egress VPC.Answer
  2. B
    Deploy a Direct Connect Gateway and associate the three spoke VPCs and the shared services VPC directly with the Direct Connect Gateway to enable spoke-to-spoke communication and hybrid connectivity. In a dedicated egress VPC, deploy a single NAT Gateway in a single Availability Zone, and configure VPC peering connections from each spoke VPC to the egress VPC for outbound internet access. Associate the private hosted zone corp.internal only with the shared services VPC.
  3. C
    Deploy an AWS Transit Gateway and attach the three spoke VPCs, the shared services VPC, and a dedicated egress VPC to it. Associate the Direct Connect Gateway with the Transit Gateway. In the egress VPC, deploy a single NAT Gateway in one Availability Zone to centralize and simplify outbound traffic paths, and configure the Transit Gateway route tables to route all outbound internet traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone corp.internal with all spoke VPCs, the shared services VPC, and the egress VPC.
  4. D
    Deploy an AWS Transit Gateway and attach the three spoke VPCs, the shared services VPC, and a dedicated egress VPC to it. Associate the Direct Connect Gateway with the Transit Gateway. In the egress VPC, deploy NAT Gateways across multiple Availability Zones, and configure the Transit Gateway route tables to route all outbound internet traffic from the spoke VPCs to the egress VPC. Associate the private hosted zone corp.internal only with the shared services VPC, relying on Transit Gateway routing to forward DNS queries from the spoke VPCs to the shared services DNS endpoints.

Answer

The correct architecture uses AWS Transit Gateway to connect the spoke VPCs, shared services, and egress VPCs, while routing outbound internet traffic to highly available NAT Gateways in the egress VPC and associating the Route 53 Private Hosted Zone with all VPCs in the environment.
The correct architecture leverages AWS Transit Gateway to handle routing between spoke VPCs and the Direct Connect Gateway, as Direct Connect Gateway does not support transitive VPC-to-VPC routing. By routing all 0.0.0.0/0 traffic from the spokes to a centralized egress VPC with NAT Gateways distributed across multiple Availability Zones, the design remains highly available. Finally, associating the Route 53 Private Hosted Zone with all the VPCs ensures that resource DNS queries can be resolved locally within each VPC, as DNS resolution is not transitive over Transit Gateway.

Step-by-Step Solution

1
Evaluate the spoke-to-spoke and hybrid connectivity requirements.
Identify that AWS Transit Gateway is required to support transitive routing between VPCs and to connect to the on-premises network via a Direct Connect Gateway.
Direct Connect Gateway alone does not support transitive VPC-to-VPC routing. A Transit Gateway is necessary to act as a central cloud router.
2
Address the outbound internet access and high availability requirements.
Create a centralized egress VPC containing NAT Gateways deployed across multiple Availability Zones, routing all outbound internet traffic from the spokes through the Transit Gateway.
Centralizing egress traffic simplifies security governance, and deploying NAT Gateways across multiple Availability Zones eliminates any single point of failure for outbound internet connectivity.
3
Address the private DNS resolution requirements.
Associate the Route 53 Private Hosted Zone corp.internal with all the spoke VPCs, the shared services VPC, and the egress VPC.
Route 53 Private Hosted Zone resolution is VPC-local. Because DNS queries do not transit across Transit Gateway attachments, the hosted zone must be explicitly associated with each VPC in the architecture.

Key Concept

Multi-VPC routing transitively via AWS Transit Gateway, high availability NAT Gateway architecture, and Route 53 Private Hosted Zone multi-VPC cross-account associations.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic