A retail company is launching a new customer-facing application in a dedicated VPC in the … — AWS Certified Solutions Architect - Professional

A retail company is launching a new customer-facing application in a dedicated VPC in the $us-west-2$ Region. The application runs on Amazon EC2 instances distributed across three Availability Zones ( $us-west-2a$ , $us-west-2b$ , and $us-west-2c$ ) within private subnets. The instances require outbound internet connectivity to download real-time currency exchange rates and must also resolve internal domain names within a Route 53 Private Hosted Zone (PHZ) named $internal.retail.aws$ that is managed in a separate Shared Services AWS account. Which design configuration satisfies these requirements while minimizing latency, preventing a single point of failure for outbound traffic, and ensuring proper internal name resolution?

Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Configure the route table of each private subnet to route internet-bound traffic ( $0.0.0.0/0$ ) to the NAT Gateway in its corresponding Availability Zone. Associate the $internal.retail.aws$ Private Hosted Zone in the Shared Services account with the new application VPC.Answer
B
Deploy a single NAT Gateway in a public subnet in $us-west-2a$ . Configure the route tables of the private subnets in all three Availability Zones to route internet-bound traffic ( $0.0.0.0/0$ ) to this single NAT Gateway. Associate the $internal.retail.aws$ Private Hosted Zone in the Shared Services account with the new application VPC.
C
Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Configure the route table of each private subnet to route internet-bound traffic ( $0.0.0.0/0$ ) to the NAT Gateway in its corresponding Availability Zone. Rely on the VPC's default Route 53 Resolver to automatically resolve query requests for $internal.retail.aws$ without performing any cross-account association.
D
Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Attach an AWS Transit Gateway to the VPC, and configure the private subnets to route internet-bound traffic ( $0.0.0.0/0$ ) to the Transit Gateway. Associate the $internal.retail.aws$ Private Hosted Zone directly with the Transit Gateway to enable cross-VPC DNS resolution.

Answer

Deploy a NAT Gateway in a public subnet in each of the three Availability Zones, route each private subnet's internet-bound traffic to the NAT Gateway in its corresponding zone, and associate the Private Hosted Zone with the application VPC.

Deploying a NAT Gateway in each Availability Zone ensures that workloads in each zone have a local, redundant path to the internet. This design avoids cross-AZ data transfer charges for internet egress and ensures that an outage in one Availability Zone does not disrupt internet connectivity in the other zones. Additionally, associating the cross-account Private Hosted Zone with the application VPC allows the application's default Route 53 Resolver to resolve domains within the private hosted zone.

Step-by-Step Solution

Ensure NAT Gateway redundancy by deploying a NAT Gateway in a public subnet in each Availability Zone.

Workloads in each Availability Zone route outbound traffic locally, preventing a single point of failure and avoiding cross-AZ data transfer latency and costs.

Designing for high availability requires eliminating single points of failure at the Availability Zone level.

Associate the Route 53 Private Hosted Zone (PHZ) in the Shared Services account with the application VPC.

The VPC is authorized to query the private DNS records hosted in the Shared Services account.

Private Hosted Zones must be explicitly associated with a VPC to allow internal DNS resolution from within that VPC.

Key Concept

High-availability VPC egress design and cross-account Route 53 Private Hosted Zone association.

Estimated Time:1m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic