Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-account architecture on AWS in the ap-southeast-2 region. The design includes a shared services account managing a central VPC (vpc-shared-services) and two spoke VPCs in separate accounts: vpc-sales-prod and vpc-hr-prod. A Route 53 Private Hosted Zone (PHZ) named corp.aws is hosted in the shared services account. Workloads in the spoke VPCs require private DNS resolution for corp.aws and must be able to download software patches from the internet. The network design must be highly available, minimize single points of failure, and use AWS Transit Gateway (tgw-sydney) to interconnect the VPCs. Which combination of steps should a Solutions Architect take to meet these requirements? (Select TWO.)

  1. In the shared services AWS account, authorize the association of the Private Hosted Zone corp.aws with the spoke VPCs (vpc-sales-prod and vpc-hr-prod), and then accept the association from the sales and HR AWS accounts.Answer
  2. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-shared-services, and configure the route tables of the private subnets to route outbound traffic through the NAT Gateway in the same Availability Zone.Answer
  3. C
    Deploy a single NAT Gateway in one public subnet of vpc-shared-services to centralize internet egress and minimize operational cost, routing all traffic from all Availability Zones through it.
  4. D
    Configure a Direct Connect Gateway directly connected to the spoke VPCs (vpc-sales-prod and vpc-hr-prod) to enable transitive traffic routing between them.
  5. E
    Associate the Private Hosted Zone corp.aws with the spoke VPCs (vpc-sales-prod and vpc-hr-prod) directly from the Route 53 console in the sales and HR accounts, without performing any cross-account authorization steps.

Answer

To meet the requirements, the Solutions Architect must authorize and accept the cross-account association of the Private Hosted Zone corp.aws with the spoke VPCs, and deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-shared-services to ensure Availability Zone-level redundancy.
To meet the requirements, the Solutions Architect must authorize and accept the cross-account association of the Private Hosted Zone corp.aws with the spoke VPCs to allow private DNS resolution. Additionally, deploying a NAT Gateway in each Availability Zone of the shared services VPC ensures Availability Zone-level redundancy for outbound internet connectivity, eliminating any single points of failure.

Step-by-Step Solution

1
Authorize the association of the Private Hosted Zone corp.aws with the spoke VPCs in the shared services account, and accept the association from the spoke accounts.
The spoke VPCs vpc-sales-prod and vpc-hr-prod can privately resolve domain names within the corp.aws zone.
Cross-account association of Private Hosted Zones requires explicit authorization from the hosted zone owner before the VPC owner can associate it.
2
Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-shared-services.
Redundant internet egress paths are established.
Deploying NAT Gateways across multiple Availability Zones provides high availability and prevents a single AZ outage from interrupting egress traffic.
3
Configure the private subnets' route tables in vpc-shared-services to send internet-bound traffic (0.0.0.0/00.0.0.0/0) to the local NAT Gateway in the same Availability Zone.
AZ-independent egress routing.
This ensures that workloads routed through Transit Gateway to vpc-shared-services leverage the redundant NAT infrastructure properly.

Key Concept

Multi-account private DNS resolution and highly available centralized egress design using Transit Gateway.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic