Examkin

Question

Difficulty: EasyHybrid and Multi-Account Network Connectivity Design

A solutions architect is designing a hybrid network architecture where multiple spoke VPCs in a single AWS Region need to access the internet through a centralized egress VPC using AWS Transit Gateway. To ensure high availability and prevent a single point of failure for outbound traffic, how should the NAT Gateways be deployed in the egress VPC?

  1. Deploy one NAT Gateway in each Availability Zone of the egress VPC, and configure the egress VPC route tables to direct internet-bound traffic from each private subnet to the NAT Gateway in its respective Availability Zone.Answer
  2. B
    Deploy a single NAT Gateway in one public subnet of the egress VPC, and configure the Transit Gateway route tables to direct all spoke VPC internet-bound traffic to this NAT Gateway.
  3. C
    Connect the spoke VPCs to a Direct Connect Gateway directly and configure the Direct Connect Gateway to route all egress traffic back to the on-premises proxy servers.
  4. D
    Set up a Route 53 Private Hosted Zone in the egress VPC and associate it only with the egress VPC, expecting the spoke VPCs to resolve internet endpoints through Transit Gateway attachments.

Answer

Deploy one NAT Gateway in each Availability Zone of the egress VPC, and configure the egress VPC route tables to direct internet-bound traffic from each private subnet to the NAT Gateway in its respective Availability Zone.
The correct architecture requires deploying one NAT Gateway in each Availability Zone of the egress VPC. This alignment ensures that an outage in one Availability Zone does not impact outbound traffic from other zones, satisfying the high availability constraint.

Step-by-Step Solution

1
Analyze the egress routing requirement.
Egress traffic from spoke VPCs must go through a centralized egress VPC via AWS Transit Gateway.
Centralizing egress traffic simplifies security monitoring and minimizes public IP usage.
2
Design for high availability across Availability Zones.
Deploy at least two NAT Gateways, one in each Availability Zone (AZ) of the egress VPC.
A single NAT Gateway creates a single point of failure if its AZ goes down.
3
Configure internal VPC routing inside the egress VPC.
Ensure route tables in each private subnet point to the NAT Gateway within the same AZ.
This guarantees that traffic remains zoned and isolated, ensuring high availability and fault tolerance.

Key Concept

Multi-AZ NAT Gateway Redundancy in Centralized Egress Architectures
Estimated Time:1m 30s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic