Examkin

Question

Difficulty: EasyHybrid and Multi-Account Network Connectivity Design

A company is designing a hybrid network architecture to connect its on-premises data center with multiple spoke VPCs across different AWS accounts in the same Region. They plan to use AWS Direct Connect as the primary connection and require transitive routing between all spoke VPCs and the on-premises network. Additionally, the company has created a Route 53 Private Hosted Zone (PHZ) in a central shared services account and wants to ensure that all spoke VPCs can resolve the internal domain names hosted in this PHZ. Which TWO actions must a solutions architect perform to meet these requirements? (Select TWO.)

  1. Create an AWS Transit Gateway, attach all spoke VPCs to the Transit Gateway, and connect the Transit Gateway to the on-premises data center via an AWS Direct Connect gateway using a Transit Virtual Interface (Transit VIF).Answer
  2. Authorize and associate the central Route 53 Private Hosted Zone with the spoke VPCs in the other AWS accounts by using the AWS CLI or SDK to perform cross-account hosted zone associations.Answer
  3. C
    Connect all spoke VPCs directly to an AWS Direct Connect gateway using a Private Virtual Interface (Private VIF) to enable spoke-to-spoke transitive routing over the Direct Connect connection.
  4. D
    Share the central Route 53 Private Hosted Zone with the other AWS accounts using AWS Resource Access Manager (RAM) to automatically enable DNS resolution in all spoke VPCs.
  5. E
    Deploy a single NAT Gateway in one Availability Zone of a centralized egress VPC and route all outbound internet traffic from all spoke VPCs through this gateway to reduce costs.

Answer

The correct actions are to create an AWS Transit Gateway attached to all spoke VPCs and connect it to the on-premises environment using an AWS Direct Connect gateway with a Transit Virtual Interface (Transit VIF), and to authorize and associate the central Route 53 Private Hosted Zone with the spoke VPCs in the other AWS accounts using Route 53 cross-account associations.
Establishing hybrid connectivity with transitive routing requires AWS Transit Gateway connected to a Direct Connect gateway using a Transit VIF. For cross-account DNS resolution, the central Private Hosted Zone must be authorized and associated with each spoke VPC in other accounts using the Route 53 CLI or API.

Step-by-Step Solution

1
Identify the proper AWS service for hybrid transitive routing.
Determine that AWS Transit Gateway is required to act as the hub for VPC-to-VPC and VPC-to-on-premises connectivity over Direct Connect, which must use a Transit Virtual Interface (Transit VIF).
AWS Direct Connect Gateway does not support transitive VPC-to-VPC routing directly without a transit hub.
2
Determine the proper method for cross-account private DNS resolution.
Determine that cross-account VPC association with the central Route 53 Private Hosted Zone must be authorized and associated.
Route 53 Private Hosted Zones cannot be shared via AWS Resource Access Manager (RAM), requiring programmatic cross-account VPC associations instead.

Key Concept

AWS Transit Gateway for hybrid hub-and-spoke routing, combined with cross-account Route 53 Private Hosted Zone associations.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic