Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An e-commerce enterprise is deploying a new high-throughput platform in the eu-west-1 Region. The architecture consists of a processing VPC (vpc-processing) and a database VPC (vpc-storage). The application servers in vpc-processing run in private subnets across three Availability Zones (eu-west-1a, eu-west-1b, and eu-west-1c). These servers must make high-volume API calls to a third-party SaaS provider over the internet, and privately resolve and access a database in vpc-storage using the private domain name db.internal. The design must minimize data transfer costs, prevent cross-Availability Zone dependencies for outbound traffic, and ensure high availability. Which configuration steps should the solutions architect perform to meet these requirements? (Select TWO.)

  1. Deploy a NAT Gateway in the public subnet of each Availability Zone (eu-west-1a, eu-west-1b, and eu-west-1c) within vpc-processing, and configure the route tables of the private subnets in each zone to route outbound internet traffic (0.0.0.0/0) through the local NAT Gateway in that same zone.Answer
  2. Associate the Route 53 Private Hosted Zone for db.internal with both vpc-processing and vpc-storage to allow instances in both VPCs to resolve the private database domain name directly.Answer
  3. C
    Deploy a single NAT Gateway in the public subnet of eu-west-1a within vpc-processing to serve all outbound internet traffic from all three Availability Zones, reducing NAT Gateway hourly provisioned costs.
  4. D
    Configure an AWS Transit Gateway, attach both VPCs, and associate the db.internal Private Hosted Zone directly with the Transit Gateway to enable transitive DNS resolution across the attached networks.
  5. E
    Create the db.internal Private Hosted Zone in vpc-storage, and deploy Route 53 Resolver outbound endpoints in vpc-processing to forward DNS queries to the Route 53 Resolver inbound endpoints deployed in vpc-storage.

Answer

Deploy a NAT Gateway in the public subnet of each Availability Zone (eu-west-1a, eu-west-1b, and eu-west-1c) within vpc-processing, routing private subnet traffic to the local NAT Gateway in that same zone, and associate the Route 53 Private Hosted Zone for db.internal with both vpc-processing and vpc-storage.
The correct architecture achieves high availability and lowest cost by deploying a NAT Gateway in each of the three Availability Zones to prevent cross-AZ data transfer fees, and by associating the Route 53 Private Hosted Zone directly with both VPCs to allow simple, cost-effective internal resolution.

Step-by-Step Solution

1
Analyze outbound internet routing requirements for vpc-processing.
To avoid cross-Availability Zone data transfer charges and eliminate a single point of failure, a separate NAT Gateway must be provisioned in each Availability Zone. The route tables of the private subnets in each zone must route 0.0.0.0/0 traffic to the NAT Gateway in the corresponding zone.
This guarantees Availability Zone independence and minimizes cross-AZ data transfer fees.
2
Analyze private DNS resolution requirements for db.internal.
A Route 53 Private Hosted Zone (PHZ) should be created for db.internal. This PHZ must then be associated with both vpc-processing and vpc-storage VPCs.
VPC association allows local DNS resolution to function natively in both VPCs, avoiding the cost, management overhead, and latency of Route 53 Resolver endpoints.

Key Concept

Multi-Availability Zone NAT Gateway redundancy and Route 53 Private Hosted Zone multi-VPC association.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic