An enterprise is designing a highly resilient and scalable hybrid network architecture to … — AWS Certified Solutions Architect - Professional

An enterprise is designing a highly resilient and scalable hybrid network architecture to connect its on-premises data centers in New York and London with AWS environments in the `us-east-1` and `eu-west-2` Regions. The design includes a central AWS Transit Gateway in `us-east-1` (`tgw-us-east-1`) and another in `eu-west-2` (`tgw-eu-west-2`) connected via a Transit Gateway peering attachment. A central Shared Services VPC is deployed in `us-east-1` and hosts Route 53 Private Hosted Zones (PHZs). Multiple spoke VPCs are deployed in both regions, each with private subnets distributed across $3$ Availability Zones. The on-premises locations are connected to a global Direct Connect Gateway (`dxgw-global`) via $10\text{ Gbps}$ AWS Direct Connect connections, and backup Site-to-Site VPN connections are established to each regional Transit Gateway. Spoke VPC workloads require low-latency, highly available outbound internet access, secure cross-premises DNS resolution, and resilient hybrid failover. Which two actions must the solutions architect take to satisfy these requirements? (Select two.)

A
In each spoke VPC, deploy a single NAT Gateway in a public subnet within one Availability Zone, and configure the default route ( $0.0.0.0/0$ ) in the route tables of all private subnets to point to this NAT Gateway to optimize idle hourly charges.
In each spoke VPC, deploy a NAT Gateway in a public subnet within each of the $3$ Availability Zones, and configure the default route ( $0.0.0.0/0$ ) in the route table of each private subnet to point to the NAT Gateway in its corresponding Availability Zone.Answer
Associate the Route 53 Private Hosted Zones in the Shared Services VPC with all spoke VPCs in both Regions. Configure Route 53 Resolver Inbound Endpoints in the Shared Services VPC to receive DNS queries from on-premises DNS servers, and Outbound Endpoints with forwarding rules to route queries for on-premises domains.Answer
D
Configure Route 53 Resolver conditional forwarding rules in each spoke VPC to forward DNS queries for the Private Hosted Zones to the Shared Services VPC's Route 53 Resolver Inbound Endpoint IP addresses, avoiding direct cross-account hosted zone associations.
E
Configure the global Direct Connect Gateway (`dxgw-global`) to act as the transit routing hub between `tgw-us-east-1` and `tgw-eu-west-2` by enabling transit routing on the gateway, thereby routing inter-VPC traffic across the Direct Connect backbone.

Answer

The correct architecture requires deploying a NAT Gateway in each of the three Availability Zones for each spoke VPC to ensure multi-AZ resilience and avoid cross-AZ charges, and associating the Route 53 Private Hosted Zones with all spoke VPCs in both regions while utilizing Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC for hybrid DNS resolution.

Deploying a local NAT Gateway in each of the three Availability Zones ensures high availability and eliminates cross-AZ charges. Associating the Route 53 Private Hosted Zones in the Shared Services VPC with all spoke VPCs across both regions enables local DNS resolution of private records, while Route 53 Resolver Inbound and Outbound Endpoints in the Shared Services VPC allow query routing between AWS and on-premises DNS servers.

Step-by-Step Solution

Evaluate NAT Gateway architecture for high availability and cost optimization.

Identify that deploying a single NAT Gateway across three Availability Zones introduces a single point of failure and incurs cross-AZ data transfer costs. A dedicated NAT Gateway per Availability Zone ensures zone isolation and eliminates cross-AZ charges for internet-bound traffic.

This guarantees that an AZ outage does not impact outbound connectivity for the entire VPC and minimizes data transfer charges.

Design the DNS resolution architecture for the Route 53 Private Hosted Zones and on-premises environments.

Determine that Private Hosted Zones (PHZs) must be explicitly associated with each VPC that needs to resolve them, even across accounts and regions. Set up Route 53 Resolver Inbound Endpoints to handle queries from on-premises to AWS, and Outbound Endpoints with forwarding rules to handle queries from AWS to on-premises.

This establishes a secure, standard pattern for hybrid bi-directional DNS resolution and ensures spoke VPCs can resolve the central PHZs directly.

Analyze transitive routing limitations of Direct Connect Gateway.

Confirm that Direct Connect Gateway cannot route traffic between attached Transit Gateways. Traffic between the regional Transit Gateways must go over the peered Transit Gateway connection rather than the Direct Connect backbone.

Understanding AWS transitive routing limits ensures the architecture relies on TGW peering for inter-region VPC communication.

Key Concept

High availability network design using regional multi-AZ NAT Gateways, cross-VPC Route 53 Private Hosted Zone associations, and hybrid bi-directional Route 53 Resolver Endpoints.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic