Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a new multi-VPC environment in the `us-east-1` Region. The architecture includes three spoke VPCs (`vpc-app`, `vpc-db`, and `vpc-web`) connected via an AWS Transit Gateway (`tgw-core`). All spoke VPCs require outbound internet access to download software updates and must resolve domain names hosted in a private hosted zone (PHZ) named `corp.internal` created in a shared services VPC (`vpc-shared`). The design must satisfy the following constraints:

1. Outbound internet traffic must be inspected centrally using AWS Network Firewall before exiting via NAT Gateways.
2. The architecture must remain resilient to a single Availability Zone (AZ) failure without dropping traffic in other AZs.
3. Network latency and data transfer costs for accessing Amazon S3 from `vpc-db` must be minimized.
4. Spoke VPCs must resolve DNS queries for `corp.internal` efficiently.

Which of the following actions should the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Deploy a centralized egress VPC containing AWS Network Firewall endpoints and NAT Gateways across two Availability Zones, and enable Transit Gateway appliance mode on the egress VPC attachment.Answer
  2. Create an Amazon S3 Gateway VPC endpoint in the private subnets of the database VPC, and associate the private hosted zone with the application, database, and web VPCs.Answer
  3. C
    Deploy a single, centralized NAT Gateway in one Availability Zone of the egress VPC to optimize NAT Gateway idle costs for all spoke VPCs.
  4. D
    Configure a Route 53 Resolver outbound endpoint in the shared services VPC to forward all resolution queries for the private hosted zone from the spoke VPCs.
  5. E
    Configure a Direct Connect Gateway with a Transit VIF to establish transitive routing between the spoke VPCs and the egress VPC, bypassing the Transit Gateway.

Answer

The correct options are deploying a centralized egress VPC containing AWS Network Firewall endpoints and NAT Gateways across two Availability Zones with Transit Gateway appliance mode enabled, and creating an Amazon S3 Gateway VPC endpoint in the database VPC while associating the private hosted zone with the spoke VPCs.
To design a resilient egress infrastructure with centralized inspection, firewall endpoints and NAT Gateways must be placed in multiple Availability Zones. Enabling Transit Gateway appliance mode is essential because Transit Gateway normally routes traffic using hash algorithms that can lead to asymmetric pathing, which breaks stateful firewalls. For optimizing cost and latency to S3, a Gateway VPC endpoint is ideal because it does not carry the hourly or data processing fees associated with interface endpoints or Transit Gateway data paths. Lastly, associating the Private Hosted Zone with all spoke VPCs enables native, secure, and low-latency DNS resolution within those environments.

Step-by-Step Solution

1
Ensure high availability for egress traffic
NAT Gateways and Network Firewall endpoints are deployed across multiple Availability Zones in the egress VPC.
This guarantees that an outage in one Availability Zone does not impact egress operations in other zones.
2
Maintain stateful traffic symmetry through Network Firewall
Transit Gateway appliance mode is enabled on the egress VPC attachment.
Appliance mode ensures that both the request and response network flows for a given session pass through the same network interface in the egress VPC, preventing stateful firewalls from dropping the traffic.
3
Optimize S3 connectivity costs and latency
Create a Gateway VPC endpoint for Amazon S3 in the database VPC.
Gateway VPC endpoints redirect S3-destined traffic directly over the AWS network, bypassing Transit Gateway and NAT Gateway data processing charges.
4
Enable cross-account and cross-VPC private DNS resolution
Associate the Route 53 Private Hosted Zone with the application, database, and web VPCs.
Private Hosted Zones must be associated with VPCs to allow Route 53 to resolve queries for the defined domain within those VPCs.

Key Concept

Multi-VPC hybrid routing design using Transit Gateway appliance mode for centralized firewalls, combined with cost-optimized VPC endpoints and cross-VPC private DNS resolution.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic