Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

A financial services firm operates a multi-account AWS environment with 4040 spoke VPCs distributed across 22 AWS accounts in the `us-east-1` and `us-west-2` Regions. The firm connects its on-premises data center to AWS using an AWS Direct Connect (DX) gateway associated with an AWS Transit Gateway (TGW) in each Region via transit virtual interfaces (VIFs) over redundant 10 Gbps10\text{ Gbps} connections. As a backup, a Site-to-Site VPN connection is established from on-premises to each TGW. The firm requires:

1. Symmetrical routing over the DX connections under normal operations, with automatic failover to the VPN connections if the DX connections fail.
2. Outbound internet traffic from all spoke VPCs must be routed through a centralized egress VPC in each Region while ensuring high availability.
3. Services in all VPCs must resolve DNS queries for a private hosted zone (PHZ) hosted in `us-east-1` under one of the AWS accounts.

Which configuration should the Solutions Architect implement to meet these requirements?

  1. Configure the on-premises router to advertise the on-premises prefixes with AS-path prepending over the VPN connections, and set a higher BGP local preference on-premises for routes received via DX. Deploy NAT Gateways in multiple Availability Zones in the egress VPC of each Region, configuring separate subnet route tables to route egress traffic. Authorize and associate the Route 53 PHZ with all spoke VPCs across both accounts.Answer
  2. B
    Associate the Direct Connect gateway directly with the Virtual Private Gateways of all 4040 spoke VPCs to bypass Transit Gateway processing fees. Establish VPC peering connections between all spoke VPCs for inter-VPC traffic. Deploy a single NAT Gateway in the egress VPC of each Region, and associate the Route 53 PHZ with the central egress VPC.
  3. C
    Configure BGP routing with AS-path prepending on the VPN and higher local preference on-premises for DX. Deploy NAT Gateways in multiple Availability Zones in the egress VPC of each Region. Share the Route 53 PHZ with the secondary account using AWS Resource Access Manager (RAM) to automatically enable DNS resolution in all spoke VPCs.
  4. D
    Configure BGP routing with AS-path prepending on the VPN and higher local preference on-premises for DX. Deploy a single NAT Gateway in a single public subnet in the egress VPC of each Region to route all outbound internet traffic from the spoke VPCs. Authorize and associate the Route 53 PHZ with all spoke VPCs across both accounts.

Answer

Configure the on-premises router to advertise the on-premises prefixes with AS-path prepending over the VPN connections, and set a higher BGP local preference on-premises for routes received via DX. Deploy NAT Gateways in multiple Availability Zones in the egress VPC of each Region, configuring separate subnet route tables to route egress traffic. Authorize and associate the Route 53 PHZ with all spoke VPCs across both accounts.
The correct configuration implements BGP routing policies to ensure symmetric routing, where Direct Connect is the preferred primary path and VPN is the backup. By prepending AS-paths on the VPN, AWS Transit Gateway chooses the shorter path (Direct Connect) for inbound traffic to on-premises. Setting a higher Local Preference on the on-premises router ensures outbound traffic to AWS uses the Direct Connect path. Deploying NAT Gateways across multiple Availability Zones in the egress VPC prevents single points of failure. Authorizing and associating the Route 53 Private Hosted Zone across accounts using Route 53 APIs allows services in all VPCs to resolve internal DNS names properly.

Step-by-Step Solution

1
Configure BGP attributes on the on-premises router and AWS Transit Gateway to ensure symmetric routing.
Traffic from AWS to on-premises prefers the Direct Connect path because the backup VPN advertises paths with AS-path prepending. Traffic from on-premises to AWS prefers Direct Connect because of a higher BGP Local Preference configuration.
Prevents asymmetric routing, which can cause stateful firewalls on-premises to drop return packets and lead to unpredictable performance.
2
Deploy NAT Gateways in each Availability Zone (AZ) in the egress VPCs.
The spoke VPCs forward outbound traffic to the local TGW, which routes the traffic to the NAT Gateway in the corresponding Availability Zone of the egress VPC.
Eliminates cross-AZ data transfer charges and ensures high availability, guaranteeing that an outage in one AZ does not affect internet egress for the remaining AZs.
3
Set up cross-account Route 53 Private Hosted Zone (PHZ) associations using the AWS CLI or Route 53 API.
Spoke VPCs in both AWS accounts can privately resolve domain names hosted in the primary account's PHZ.
Allows secure private DNS resolution across accounts. Since AWS Resource Access Manager (RAM) does not support Route 53 PHZs, the cross-account association workflow must be executed.

Key Concept

Symmetric hybrid routing, high availability egress design, and cross-account Route 53 Private Hosted Zone association.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic