Examkin

Question

Difficulty: EasyImplementing Auto Scaling and Fault Tolerance

An application runs on Amazon EC2 instances managed by an Auto Scaling group deployed across three Availability Zones (AZ−AAZ-A, AZ−BAZ-B, and AZ−CAZ-C). The EC2 instances are in private subnets and need to make outbound connections to the internet to fetch system updates. Which actions should a Solutions Architect take to design a network topology that provides high availability and fault tolerance for outbound internet traffic if any single Availability Zone experiences an outage? (Select TWO.)

  1. Deploy a NAT gateway in a public subnet within each of the three Availability Zones.Answer
  2. Configure the route table for the private subnets in each Availability Zone to route outbound internet traffic through the NAT gateway in the corresponding Availability Zone.Answer
  3. C
    Deploy a single NAT gateway in the public subnet of AZ−AAZ-A and configure the route tables for private subnets in AZ−BAZ-B and AZ−CAZ-C to route traffic through it.
  4. D
    Deploy a NAT gateway in a private subnet in each of the three Availability Zones to protect the gateway from direct public internet exposure.
  5. E
    Set the Auto Scaling group default cooldown period to 6060 seconds to accelerate the launching of new instances when outbound traffic fails.

Answer

Deploy a NAT gateway in a public subnet within each of the three Availability Zones, and configure the route table for the private subnets in each Availability Zone to route outbound internet traffic through the NAT gateway in the corresponding Availability Zone.
To achieve high availability and fault tolerance for outbound internet traffic in a multi-AZ VPC, a NAT Gateway must be deployed in a public subnet in each Availability Zone. The private subnets in each Availability Zone should then be configured to route their outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway in the same Availability Zone. This ensures that the failure of a single Availability Zone does not impact outbound traffic from the other healthy Availability Zones.

Step-by-Step Solution

1
Analyze the single point of failure in the network architecture.
Identified that routing traffic from multiple Availability Zones through a single NAT Gateway makes the entire outbound path dependent on the health of that gateway's Availability Zone.
AWS NAT Gateways operate within a single Availability Zone. If that zone fails, the gateway becomes unavailable, causing connectivity loss for all dependent subnets.
2
Design a highly available NAT Gateway topology.
Determine that deploying a NAT Gateway in a public subnet in each Availability Zone (AZ−AAZ-A, AZ−BAZ-B, and AZ−CAZ-C) is required for zone redundancy.
Zonal NAT Gateways ensure that if one Availability Zone goes down, the instances in the other zones can still access the internet through their local, functioning NAT Gateways.
3
Configure routing to support zonal isolation.
Point the route table of the private subnets in each Availability Zone to the NAT Gateway in the same zone.
This configuration avoids cross-zone dependencies and charges, ensuring that outbound traffic stays within the same zone until it leaves the VPC.

Key Concept

High Availability and Fault Tolerance with Zonal NAT Gateways
Estimated Time:1m 30s
Rate this question

Topics

Implementing Auto Scaling and Fault Tolerance