A company is designing a new environment on AWS with a single VPC named `Production-VPC` (… — AWS Certified Solutions Architect - Professional

A company is designing a new environment on AWS with a single VPC named `Production-VPC` (CIDR: $10.0.0.0/16$ ) to host a web application. The architecture is deployed across two Availability Zones, `us-west-2a` and `us-west-2b`. The public subnets `Public-Subnet-A` ( $10.0.1.0/24$ ) and `Public-Subnet-B` ( $10.0.2.0/24$ ) host Application Load Balancers. The application instances are running in the private subnets `Private-Subnet-A` ( $10.0.10.0/24$ ) and `Private-Subnet-B` ( $10.0.20.0/24$ ). The instances in the private subnets must be able to securely download software patches from the internet. The design must ensure that an outage of a single Availability Zone does not disrupt outbound internet connectivity for the resources in the remaining active Availability Zone. Which configuration should the solutions architect implement to meet these requirements?

A
Deploy a single NAT Gateway in `Public-Subnet-A`. Configure a single shared route table associated with both `Private-Subnet-A` and `Private-Subnet-B` to route outbound traffic ( $0.0.0.0/0$ ) to this single NAT Gateway.
B
Deploy an AWS Transit Gateway named `Production-TGW`. Configure the route tables of `Private-Subnet-A` and `Private-Subnet-B` to route all outbound traffic ( $0.0.0.0/0$ ) directly to `Production-TGW` without deploying any NAT Gateways or Internet Gateways in the VPC.
Deploy one NAT Gateway in `Public-Subnet-A` and another NAT Gateway in `Public-Subnet-B`. Configure the route table for `Private-Subnet-A` to route outbound traffic ( $0.0.0.0/0$ ) to the NAT Gateway in `Public-Subnet-A`, and configure the route table for `Private-Subnet-B` to route outbound traffic to the NAT Gateway in `Public-Subnet-B`.Answer
D
Deploy a Route 53 Private Hosted Zone named `egress.internal` and associate it with `Production-VPC`. Configure the route tables of both private subnets to route outbound traffic ( $0.0.0.0/0$ ) to the Route 53 Resolver outbound endpoint.

Answer

Deploy one NAT Gateway in each public subnet, and configure the route tables of the corresponding private subnets to route outbound internet traffic to the local NAT Gateway in the same Availability Zone.

The correct configuration is to deploy a dedicated NAT Gateway in the public subnet of each Availability Zone and route outbound traffic from each private subnet to the NAT Gateway in its respective zone. This design ensures that if one Availability Zone experiences an outage, the NAT Gateway in the other zone remains functional, preventing a complete loss of egress connectivity for the remaining healthy zone.

Step-by-Step Solution

Identify the high availability and fault-domain isolation requirement for outbound internet access.

Realize that outbound traffic from private subnets requires NAT Gateways, and relying on a single NAT Gateway introduces an Availability Zone dependency.

Each Availability Zone should operate independently to ensure that a failure in one zone does not affect resources in the other.

Select a design that places a NAT Gateway in each Availability Zone's public subnet.

A NAT Gateway is deployed in `Public-Subnet-A` and another in `Public-Subnet-B`.

This establishes redundant egress paths that are physically located in separate physical infrastructure zones.

Configure the VPC route tables to align with local Availability Zone routing.

The route table for `Private-Subnet-A` points to the NAT Gateway in `Public-Subnet-A`, and the route table for `Private-Subnet-B` points to the NAT Gateway in `Public-Subnet-B`.

This ensures that traffic does not cross Availability Zones for internet egress under normal operating conditions, isolating the failure domain.

Key Concept

NAT Gateway redundancy across multiple Availability Zones to ensure highly available internet egress.

Estimated Time:1m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic