Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

A financial services enterprise is modernizing a legacy monolithic transaction routing application currently running on-premises on VMware virtual machines. The target architecture must be highly available across three Availability Zones, achieve a Recovery Time Objective (RTO) of less than 15 minutes, and minimize operational overhead. The modernized application will run as containers on AWS Fargate. The containerized workloads must reside in private subnets without direct internet access and securely connect to an Amazon Aurora PostgreSQL database in a shared services VPC. The private endpoint of the database is registered in an Amazon Route 53 Private Hosted Zone (PHZ) in the shared services AWS account. All container registries must be accessed privately. Which combination of network topology and task configuration meets these modernization requirements with the least operational overhead?

  1. Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Configure ECS interface VPC endpoints in the workload VPC. Establish a Transit Gateway attachment to route traffic to the shared services VPC. Create a Route 53 Private Hosted Zone association authorization from the shared services account to the workload VPC, and associate the private hosted zone with the workload VPC.Answer
  2. B
    Deploy Amazon ECS tasks using the AWS Fargate launch type with the bridge network mode. Configure ECS interface VPC endpoints in the workload VPC. Establish a Transit Gateway attachment to route traffic to the shared services VPC. Create a Route 53 Private Hosted Zone association authorization from the shared services account to the workload VPC, and associate the private hosted zone with the workload VPC.
  3. C
    Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Configure ECS interface VPC endpoints in the workload VPC. Establish a VPC Peering connection to route traffic to the shared services VPC. Rely on the default Route 53 Resolver to automatically resolve the shared services database endpoint across the peered VPCs without explicitly authorizing or associating the Private Hosted Zone with the workload VPC.
  4. D
    Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Provision a single NAT Gateway in a single public subnet of the workload VPC to route task pulling requests to Amazon ECR. Establish a Transit Gateway attachment to route traffic to the shared services VPC. Create a Route 53 Private Hosted Zone association authorization from the shared services account to the workload VPC, and associate the private hosted zone with the workload VPC.

Answer

Deploy Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode, configure ECS interface VPC endpoints, use a Transit Gateway attachment for routing to the shared services VPC, and associate the shared services Route 53 Private Hosted Zone with the workload VPC.
The correct option outlines a fully private, highly available, and operationally lightweight architecture. AWS Fargate tasks must use the awsvpc network mode. By deploying interface VPC endpoints (PrivateLink) for ECS and ECR, container images can be securely pulled without public internet paths. Cross-VPC routing to the Aurora PostgreSQL database is handled through AWS Transit Gateway. To ensure the workload VPC can resolve the database DNS name registered in the shared services account, the Route 53 Private Hosted Zone must be associated with the workload VPC. This requires a cross-account association authorization.

Step-by-Step Solution

1
Select container platform and networking mode.
Amazon ECS with AWS Fargate launch type configured with the awsvpc network mode, which is the only supported networking mode on Fargate.
AWS Fargate manages the underlying host instances, which requires task-level elastic network interfaces (ENIs) provided by awsvpc mode.
2
Configure private access to AWS container registries and control plane services.
Interface VPC endpoints (AWS PrivateLink) created for Amazon ECS, Amazon ECR, and Amazon S3 (gateway endpoint) in the workload VPC.
Ensures tasks can register with the ECS cluster and pull container images privately without requiring public IP routing or NAT Gateways.
3
Set up private routing and cross-VPC DNS resolution for the database connection.
Establish a Transit Gateway attachment between the workload VPC and the shared services VPC, authorize the Private Hosted Zone association from the shared services account, and associate the PHZ with the workload VPC.
Enables IP-level routing for database traffic via Transit Gateway and allows resources in the workload VPC to resolve the database private domain name using Route 53 Resolver.

Key Concept

AWS Fargate network modes, VPC Endpoint configuration, and cross-account Route 53 Private Hosted Zone association
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic