Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A logistics company is designing a new cloud infrastructure on AWS across three VPCs: a Shared Services VPC (vpc-shared), a Production application VPC (vpc-prod), and a Development application VPC (vpc-dev). The company has an on-premises datacenter that must connect securely to these VPCs using an existing 10 Gbps AWS Direct Connect (DX) connection. Additionally, resources in the private subnets of vpc-prod and vpc-dev require outbound internet access to download software patches, but they must not be directly exposed to the internet. The design must minimize operational overhead, be resilient to Availability Zone (AZ) failures, and allow private DNS resolution for internal domain names across all environments, including the on-premises datacenter. Which TWO of the following networking configurations should the Solutions Architect implement to meet these requirements?

  1. Deploy a NAT Gateway in each utilized Availability Zone within the Shared Services VPC, and update the spoke VPC route tables to direct default traffic (0.0.0.0/0) to the Transit Gateway, which forwards it to the Shared Services VPC NAT Gateways.Answer
  2. Associate the Route 53 Private Hosted Zones with all three VPCs (vpc-shared, vpc-prod, and vpc-dev), and create Route 53 Resolver Inbound Endpoints in the Shared Services VPC to forward DNS requests originating from the on-premises datacenter.Answer
  3. C
    Deploy a single NAT Gateway in one Availability Zone of the Shared Services VPC to centralize and process all outbound traffic from both spoke VPCs to minimize running costs.
  4. D
    Configure the AWS Direct Connect Gateway to perform transitive routing between the spoke VPCs and the Shared Services VPC, bypassing the need for an AWS Transit Gateway.
  5. E
    Associate the Route 53 Private Hosted Zones exclusively with the Shared Services VPC, and rely on Transit Gateway attachment routing to resolve DNS queries originating from the development and production VPCs.

Answer

Deploy a NAT Gateway in each utilized Availability Zone within the Shared Services VPC, and update the spoke VPC route tables to direct default traffic to the Transit Gateway, which forwards it to the Shared Services VPC NAT Gateways. Additionally, associate the Route 53 Private Hosted Zones with all three VPCs (vpc-shared, vpc-prod, and vpc-dev), and create Route 53 Resolver Inbound Endpoints in the Shared Services VPC to forward DNS requests originating from the on-premises datacenter.
To achieve high availability and prevent single points of failure for outbound internet traffic, NAT Gateways must be deployed in each Availability Zone where resources reside. Centralizing egress through a Transit Gateway to these redundant NAT Gateways satisfies the security and HA requirements. For private DNS resolution, Route 53 Private Hosted Zones must be associated with every VPC requiring resolution, and Route 53 Resolver Inbound Endpoints are required to receive and resolve DNS queries coming from on-premises clients over the Direct Connect link.

Step-by-Step Solution

1
Address the high availability and resiliency requirements for egress internet traffic.
Deploy redundant NAT Gateways across multiple Availability Zones in the Shared Services VPC rather than a single NAT Gateway.
A single NAT Gateway represents a single point of failure in the event of an AZ outage.
2
Configure internal DNS resolution across the multi-account/multi-VPC architecture and on-premises.
Associate the Route 53 Private Hosted Zone (PHZ) with the Shared Services VPC, the Production VPC, and the Development VPC, and set up Route 53 Resolver Inbound Endpoints in the Shared Services VPC.
VPCs cannot resolve names in a PHZ unless the PHZ is explicitly associated with them. The Inbound Endpoints provide IP addresses in the VPC that on-premises DNS servers can target to resolve AWS-internal names.
3
Establish proper routing paths for hybrid connectivity.
Use Transit Gateway to manage routing between the spoke VPCs, Shared Services VPC, and the Direct Connect Gateway.
Direct Connect Gateway alone does not support transitive VPC-to-VPC or VPC-to-on-premises routing without a Transit Gateway.

Key Concept

Designing a resilient hybrid network architecture with centralized internet egress and cross-VPC/on-premises DNS resolution.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic