Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

An enterprise is designing a multi-account AWS environment in the `us-east-1` Region. The architecture requires connecting a production workload VPC (`vpc-secure-compute`) in Account 1 with a shared services VPC (`vpc-shared-services`) in Account 2, and a centralized egress security VPC (`vpc-egress-security`) in Account 3.

The networking requirements are as follows:
- Workloads in `vpc-secure-compute` are deployed across two Availability Zones (`us-east-1a` and `us-east-1b`).
- Workloads in `vpc-secure-compute` must access a Private Hosted Zone (PHZ) named `internal.services` hosted in Account 2.
- All outbound internet traffic from `vpc-secure-compute` must be routed through `vpc-egress-security`, where it is inspected by stateful virtual firewall appliances behind an AWS Gateway Load Balancer (GWLB).
- Traffic from `vpc-secure-compute` to `vpc-shared-services` must bypass the firewall appliances and route directly.
- The network must be highly available and resilient to Availability Zone failures, with no risk of asymmetric routing or single points of failure.
- A Transit Gateway (`tgw-central`) in Account 4 is shared with all accounts.

Which TWO actions should the solutions architect perform to meet these requirements?

  1. In Account 2, submit an association authorization for the `internal.services` private hosted zone to `vpc-secure-compute` using the AWS CLI or SDK. In Account 1, associate `vpc-secure-compute` with the private hosted zone.Answer
  2. Enable Appliance Mode on the Transit Gateway VPC attachment for `vpc-egress-security` using the AWS CLI or Console to ensure that bidirectional stateful traffic is consistently routed through the same Availability Zone.Answer
  3. C
    In the route tables of `vpc-secure-compute`, direct all outbound internet traffic (0.0.0.0/00.0.0.0/0) to a single NAT Gateway deployed in the `us-east-1a` subnet of `vpc-egress-security` to minimize data processing costs.
  4. D
    Associate all VPC attachments with a single default Transit Gateway route table, and add static routes directing 0.0.0.0/00.0.0.0/0 to the `vpc-egress-security` attachment and `vpc-shared-services` CIDR to the `vpc-shared-services` attachment.
  5. E
    In Account 2, create a Route 53 Resolver outbound endpoint in `vpc-shared-services`. In Account 1, create an inbound endpoint in `vpc-secure-compute`. Create a resolver rule in Account 1 to forward queries for `internal.services` to the inbound endpoint.

Answer

The correct actions are to authorize and associate the Route 53 Private Hosted Zone across accounts (Account 2 to Account 1) and to enable Transit Gateway Appliance Mode on the egress/security VPC attachment.
To resolve DNS queries for `internal.services` in `vpc-secure-compute` (Account 1) using the PHZ in Account 2, the Solutions Architect must perform a cross-account PHZ association. This is done by authorizing the association in Account 2 and completing the association in Account 1. To inspect outbound internet traffic using stateful virtual firewalls in a central security VPC, Transit Gateway Appliance Mode must be enabled on the TGW VPC attachment for the security VPC. This ensures that the Transit Gateway sends both source-to-destination and return traffic of a flow to the same Network Interface (ENI) in the same Availability Zone, preventing stateful firewalls from dropping asymmetric traffic.

Step-by-Step Solution

1
Establish cross-account private DNS resolution by authorizing the private hosted zone association.
The private hosted zone `internal.services` in Account 2 is authorized to associate with `vpc-secure-compute` in Account 1.
AWS Route 53 requires explicit cross-account authorization before a Private Hosted Zone can be associated with a VPC in a different AWS account.
2
Associate the authorized VPC with the private hosted zone from the VPC owner's account.
`vpc-secure-compute` is associated with `internal.services`, allowing DNS queries to resolve natively.
Once authorized, the VPC owner must accept/complete the association so that local Route 53 Resolver can resolve names in the hosted zone.
3
Configure Transit Gateway Appliance Mode on the `vpc-egress-security` attachment.
Transit Gateway routes bidirectional flows through the same Availability Zone in the security VPC.
Stateful firewalls behind a Gateway Load Balancer require symmetric flow routing. Enabling Appliance Mode prevents asymmetric routing where ingress and egress traffic traverse different firewalls.

Key Concept

Design of highly available and secure hybrid multi-account routing and DNS architectures using Transit Gateway Appliance Mode and cross-account Route 53 Private Hosted Zone associations.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic