Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A retail company is designing a hybrid network to connect its on-premises corporate offices to a multi-account environment on AWS in the us-west-2 Region. The AWS environment contains a central network services account, a Production account, and a Development account. The Production and Development accounts each contain one spoke VPC.

The company has deployed an AWS Transit Gateway (TGW) in the central network services account and attached the spoke VPCs. To establish connectivity to the corporate offices, the company provisions a 1 Gbps AWS Direct Connect (DX) connection with a transit virtual interface (VIF) attached to a Direct Connect Gateway (DXGW), which is associated with the TGW. For high availability, they also configure a backup IPsec Site-to-Site VPN over the internet to the same TGW.

The company has the following requirements:
- The DX connection must serve as the primary path, and the Site-to-Site VPN must serve as a standby path that only handles traffic if the DX connection is down.
- Workloads in the spoke VPCs must be able to resolve DNS names of on-premises resources.
- All outbound internet traffic from the spoke VPCs must route through a centralized egress VPC in the network services account in a highly available manner.

Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. On the customer gateway device, set a higher BGP Local Preference for routes received from AWS via the Direct Connect Transit VIF compared to the Site-to-Site VPN, and advertise the identical corporate network CIDR block over both paths.Answer
  2. In the central network services account, create a Route 53 Resolver outbound endpoint, define a Resolver rule for the on-premises domain pointing to corporate DNS servers, and associate the rule with the Production and Development spoke VPCs.Answer
  3. C
    Associate the Direct Connect Gateway directly with the spoke VPCs using private virtual interfaces (VIFs), and use the Transit Gateway exclusively to manage the Site-to-Site VPN routing domain for backup traffic.
  4. D
    Configure a Route 53 Private Hosted Zone (PHZ) for the corporate domain in the central network services account, and enable DNS support on the Transit Gateway to automatically propagate resolution to all attached spoke VPCs.
  5. E
    Deploy a single NAT Gateway in the public subnet of the central egress VPC, and configure the route tables of the Production and Development VPCs to route outbound internet traffic through this NAT Gateway via Transit Gateway.

Answer

The correct actions are to configure a higher BGP Local Preference on the customer gateway for routes received via the Direct Connect Transit VIF than the Site-to-Site VPN (advertising identical CIDRs over both), and to create a Route 53 Resolver outbound endpoint in the central network services account, defining a Resolver rule for the on-premises domain, and associating this rule with the Production and Development spoke VPCs.
The correct options are to configure a higher BGP Local Preference on the customer gateway for routes received via the Direct Connect Transit VIF compared to the Site-to-Site VPN while advertising identical CIDRs over both, and to create a Route 53 Resolver outbound endpoint in the central account with Resolver rules associated with both spoke VPCs. The identical prefix advertisement ensures Transit Gateway (which automatically prefers DXGW over VPN for identical prefixes) routes traffic via Direct Connect for the AWS-to-on-premises direction. Setting local preference on the customer gateway ensures the on-premises router prefers the Direct Connect link for the on-premises-to-AWS direction. Creating a central Route 53 Resolver outbound endpoint and sharing/associating the forwarding rule allows spoke VPCs to resolve on-premises hostnames without needing duplicate endpoints.

Step-by-Step Solution

1
Establish routing priority for primary/backup.
On the on-premises customer gateway, set local preference to prefer routes learned via the DX Transit VIF, and advertise identical CIDR blocks over both DX and VPN.
Ensures symmetric routing where DX is preferred for both ingress and egress, as TGW naturally prefers DX over VPN for identical prefixes. This prevents asymmetric routing and provides automatic failover.
2
Establish hybrid DNS resolution.
Set up Route 53 Resolver outbound endpoints in the hub VPC and define forwarding rules for the corporate domain. Associate these rules with the Production and Development spoke VPCs.
Queries from spoke VPCs for the corporate domain are forwarded to the on-premises DNS servers. Enables private name resolution of on-premises resources across the multi-account network.

Key Concept

Configuring high availability routing over AWS Transit Gateway using Direct Connect (Transit VIF) and VPN failover, combined with cross-account DNS resolution using Route 53 Resolver rules.
Estimated Time:2m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic