Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A company is designing a new multi-AZ workload in the us-east-1 Region. The architecture consists of application servers deployed in private subnets across two Availability Zones (us-east-1a and us-east-1b) within a single VPC (vpc-app). These servers must securely initiate outbound connections to the internet to download software updates. The design must ensure that the workload remains resilient to Availability Zone outages and that an issue in one Availability Zone does not disrupt outbound connectivity for servers in the other zone. Which of the following networking designs should a solutions architect recommend to meet these requirements?

  1. Deploy one NAT Gateway in a public subnet in us-east-1a and another NAT Gateway in a public subnet in us-east-1b. Configure the route table for the private subnet in us-east-1a to route outbound traffic through the NAT Gateway in us-east-1a, and configure the route table for the private subnet in us-east-1b to route outbound traffic through the NAT Gateway in us-east-1b.Answer
  2. B
    Deploy a single NAT Gateway in a public subnet in us-east-1a. Configure the route tables of the private subnets in both us-east-1a and us-east-1b to point their default route (0.0.0.0/0) to this single NAT Gateway.
  3. C
    Deploy an AWS Transit Gateway and attach it to the subnets in vpc-app. Create a Direct Connect Gateway associated with the Transit Gateway, and configure a default route (0.0.0.0/0) in the Transit Gateway route table pointing directly to the Direct Connect Gateway to route outbound traffic.
  4. D
    Create a Route 53 Private Hosted Zone (PHZ) for external package repositories, associate it with vpc-app, and configure Route 53 Resolver outbound endpoints to route all outbound internet-bound application traffic directly to public IP addresses.

Answer

Deploy one NAT Gateway in a public subnet in each Availability Zone and configure the route tables of the private subnets to route outbound traffic through their respective local NAT Gateway.
Deploying one NAT Gateway in each Availability Zone and configuring local subnet routing ensures that outbound internet connectivity is fully resilient to Availability Zone outages, preventing any single point of failure.

Step-by-Step Solution

1
Analyze the high availability requirement for outbound traffic across Availability Zones.
Determine that outbound traffic must be insulated from single Availability Zone failures.
The scenario requires that an issue in one Availability Zone does not disrupt outbound connectivity for servers in the other zone.
2
Evaluate NAT Gateway deployment topologies for zone-level redundancy.
Identify that deploying a NAT Gateway in each Availability Zone prevents cross-AZ single points of failure.
Pointing private subnet route tables to a local NAT Gateway in the same zone limits the impact of an outage to that zone.
3
Validate alternative routing and resolution options against data plane egress capabilities.
Reject Direct Connect Gateway and Route 53 configurations as invalid solutions for internet egress.
Direct Connect Gateway does not support transitive 0.0.0.0/0 routing, and Route 53 Private Hosted Zones only handle DNS queries rather than data packets.

Key Concept

Deploying redundant NAT Gateways per Availability Zone to prevent cross-AZ single points of failure for internet egress.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic