Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network connectivity and DNS resolution solution for its multi-account AWS environment. The environment consists of 12 spoke VPCs in the us-east-1 Region, each containing workloads that need to communicate with an on-premises datacenter.

The network design must meet the following requirements:
- The primary connection to the datacenter must use a 10 Gbps AWS Direct Connect connection.
- A backup connection must be established using an AWS Site-to-Site VPN over the internet.
- Failover from the Direct Connect connection to the VPN connection must happen automatically.
- On-premises servers must be able to resolve domain names for resources hosted in a Route 53 Private Hosted Zone (PHZ) associated with the AWS VPCs.
- Administrative overhead for routing and DNS configuration must be minimized.

Which of the following architectures meets these requirements?

  1. A
    Attach the spoke VPCs to an AWS Transit Gateway. Create a Direct Connect Gateway, and connect it to the datacenter using a Private Virtual Interface (Private VIF). Associate the Direct Connect Gateway with the Transit Gateway. Establish a Site-to-Site VPN connection and attach it to the Transit Gateway. Configure BGP routing to manage path preference. Create a Route 53 Resolver inbound endpoint in a shared services VPC, associate the PHZ with all spoke VPCs, and configure the on-premises DNS servers to forward queries to the inbound endpoint.
  2. B
    Attach the spoke VPCs to an AWS Transit Gateway. Create a Direct Connect Gateway, and connect it to the datacenter using a Transit Virtual Interface (Transit VIF). Associate the Direct Connect Gateway with the Transit Gateway. Establish a Site-to-Site VPN connection and attach it to the Transit Gateway. Configure BGP routing to manage path preference. Create a Route 53 Resolver inbound endpoint in a shared services VPC, associate the PHZ only with the shared services VPC, and configure the on-premises DNS servers to forward queries to the inbound endpoint.
  3. Attach the spoke VPCs to an AWS Transit Gateway. Create a Direct Connect Gateway, and connect it to the datacenter using a Transit Virtual Interface (Transit VIF). Associate the Direct Connect Gateway with the Transit Gateway. Establish a Site-to-Site VPN connection and attach it to the Transit Gateway. Configure Border Gateway Protocol (BGP) to advertise the VPC CIDRs and manage path preference. Create a Route 53 Resolver inbound endpoint in a shared services VPC, associate the PHZ with the shared services VPC and all spoke VPCs, and configure the on-premises DNS servers to forward queries to the inbound endpoint.Answer
  4. D
    Attach the spoke VPCs to an AWS Transit Gateway. Create a Direct Connect Gateway, and connect it to the datacenter using a Transit Virtual Interface (Transit VIF). Associate the Direct Connect Gateway with the Transit Gateway. Establish a Site-to-Site VPN connection and attach it to the Transit Gateway. Route all internet-bound traffic from the spoke VPCs through a single NAT Gateway located in a single Availability Zone in a shared services VPC to minimize costs. Create a Route 53 Resolver inbound endpoint in the shared services VPC, associate the PHZ with all VPCs, and configure the on-premises DNS servers to forward queries to the inbound endpoint.

Answer

Attach the spoke VPCs to an AWS Transit Gateway. Create a Direct Connect Gateway, and connect it to the datacenter using a Transit Virtual Interface (Transit VIF). Associate the Direct Connect Gateway with the Transit Gateway. Establish a Site-to-Site VPN connection and attach it to the Transit Gateway. Configure Border Gateway Protocol (BGP) to advertise the VPC CIDRs and manage path preference. Create a Route 53 Resolver inbound endpoint in a shared services VPC, associate the PHZ with the shared services VPC and all spoke VPCs, and configure the on-premises DNS servers to forward queries to the inbound endpoint.
The correct architecture uses AWS Transit Gateway to scale connectivity across 12 spoke VPCs, exceeding the 10 VPC limit of Direct Connect Gateway direct associations. It utilizes a Transit Virtual Interface (Transit VIF) which is required for connecting Direct Connect to a Transit Gateway via a Direct Connect Gateway. Dynamic BGP routing naturally supports failover between Direct Connect and Site-to-Site VPN. For DNS resolution, a centralized Route 53 Resolver inbound endpoint is established in a shared services VPC. The Private Hosted Zone (PHZ) is associated with both the shared services VPC (allowing the inbound endpoint to resolve it) and all spoke VPCs (allowing resources in those VPCs to resolve the private domains), minimizing DNS overhead.

Step-by-Step Solution

1
Deploy AWS Transit Gateway and attach the 12 spoke VPCs.
Provides a centralized hub-and-spoke transit network that allows communication between the VPCs and on-premises, minimizing administrative overhead.
AWS Transit Gateway simplifies multi-account networking and scales beyond the limit of 10 direct VPC associations allowed by a Direct Connect Gateway.
2
Establish hybrid connectivity using a Transit VIF with AWS Direct Connect and a Site-to-Site VPN.
Creates a high-speed primary network path via Direct Connect and an encrypted backup path via VPN, both terminating at the Transit Gateway.
Transit VIF is mandatory for connecting a Direct Connect Gateway to a Transit Gateway, while VPN provides cost-effective failover capacity.
3
Configure dynamic BGP routing on the Transit Gateway and on-premises router.
Automates failover by advertising the same prefixes over both paths, with the Direct Connect path preferred over the VPN path.
BGP dynamic routing ensures automatic path failover and routing symmetry between AWS and the on-premises datacenter.
4
Establish Route 53 Resolver inbound endpoints and associate the Private Hosted Zone (PHZ) with all VPCs.
Allows on-premises DNS servers to forward queries to the inbound endpoint IPs, while ensuring resources in all spoke VPCs can also resolve private domain names.
Route 53 Resolver inbound endpoints bridge on-premises and AWS DNS resolution, and the PHZ must be associated with any VPC requiring resolution of its domain names.

Key Concept

Hybrid and Multi-Account Network Connectivity Design

Alternative Method

Instead of using a Transit Gateway for VPN, you could establish a VPN connection directly to each VPC's Virtual Private Gateway (VGW), but this would significantly increase administrative overhead and scale poorly compared to a centralized Transit Gateway solution.
Estimated Time:3m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic