Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

An enterprise is deploying a new high-throughput, latency-sensitive application across two AWS Regions: us-east-1 (primary) and us-west-2 (secondary). The architecture consists of the following components:

* Two application VPCs: App-VPC-US1 in us-east-1 and App-VPC-US2 in us-west-2, each deployed across three Availability Zones.
* A central shared services VPC: Shared-VPC-US1 in us-east-1 containing a Route 53 Private Hosted Zone (PHZ) named app.corp.internal and Route 53 Resolver Outbound Endpoints to resolve on-premises DNS queries.
* Hybrid connectivity via AWS Direct Connect (DX) with a Direct Connect Gateway (DXGW) connected to an on-premises data center, and a backup Site-to-Site VPN.

The solution must satisfy the following constraints:
1. Cross-region network traffic between App-VPC-US1 and App-VPC-US2 must achieve the lowest latency and highest throughput possible, bypassing intermediate hubs.
2. Private instances in all three VPCs must be able to resolve records in app.corp.internal and route queries for corp.internal to on-premises DNS servers.
3. Outbound internet egress for private subnets in all VPCs must remain resilient to single Availability Zone failures within their respective regions.
4. Cross-region hybrid connectivity failover must be dynamic and automated.

Which network architecture design fully satisfies these requirements with the lowest latency and lowest administrative overhead?

  1. A
    Deploy a Transit Gateway in each region (TGW-US1 and TGW-US2). Associate the local VPCs to their respective Transit Gateways. Peer the two Transit Gateways to route both cross-region application traffic and hybrid backup traffic. In each VPC, deploy a single NAT Gateway in the first Availability Zone's public subnet and configure a route pointing 0.0.0.0/0 in all private subnets to this NAT Gateway to minimize running costs. Associate the app.corp.internal Private Hosted Zone with all three VPCs. Set up Route 53 Resolver Outbound Endpoints in Shared-VPC-US1 and associate forwarding rules with all VPCs to resolve corp.internal via the hybrid connection.
  2. B
    Deploy a Transit Gateway in each region (TGW-US1 and TGW-US2). Connect the local VPCs to their respective Transit Gateways. Connect the Transit Gateways to the Direct Connect Gateway for hybrid routing. Associate the app.corp.internal Private Hosted Zone only with Shared-VPC-US1. Deploy Route 53 Resolver Inbound Endpoints in Shared-VPC-US1 and Outbound Endpoints in all VPCs. Configure forwarding rules in App-VPC-US1 and App-VPC-US2 to forward queries for app.corp.internal to the Inbound Endpoints in Shared-VPC-US1 to allow cross-VPC DNS resolution. In each VPC, deploy a NAT Gateway in every Availability Zone.
  3. Deploy a Transit Gateway in each region (TGW-US1 and TGW-US2). Associate the local VPCs to their respective Transit Gateways. Connect the Transit Gateways to the Direct Connect Gateway using Transit Virtual Interfaces (Transit VIFs) for primary hybrid connectivity, and establish a Site-to-Site VPN connection to each Transit Gateway as a backup. Create a direct VPC Peering connection between App-VPC-US1 and App-VPC-US2 for low-latency cross-region application traffic. In each VPC, deploy a NAT Gateway in every Availability Zone (three per VPC) to handle outbound internet egress. Associate the app.corp.internal Private Hosted Zone with App-VPC-US1, App-VPC-US2, and Shared-VPC-US1. Configure Route 53 Resolver Outbound Endpoints in Shared-VPC-US1 and associate the forwarding rules for corp.internal with all VPCs.Answer
  4. D
    Deploy a Direct Connect Gateway (DXGW) and associate it directly with the Virtual Private Gateways (VGWs) of App-VPC-US1, App-VPC-US2, and Shared-VPC-US1 to handle both hybrid connectivity and cross-VPC routing. Establish a direct VPC Peering connection between App-VPC-US1 and App-VPC-US2 for low-latency application traffic. In each VPC, deploy a NAT Gateway in every Availability Zone. Associate the app.corp.internal Private Hosted Zone with all three VPCs, and deploy Route 53 Resolver Outbound Endpoints in each region to forward queries to on-premises DNS servers.

Answer

The correct architecture uses a Transit Gateway in each region connected to a Direct Connect Gateway using Transit VIFs and Site-to-Site VPNs for resilient hybrid routing, establishes a direct VPC Peering connection between App-VPC-US1 and App-VPC-US2 for the lowest latency application path, deploys a NAT Gateway per Availability Zone within each VPC for egress redundancy, and associates the Private Hosted Zone directly with all three VPCs to enable native resolution.
The correct solution correctly separates high-performance local application routing from hybrid gateway failover. Direct VPC Peering ensures application traffic bypasses Transit Gateways, meeting the latency constraint. Redundant NAT Gateways per AZ preserve egress availability. Associating the Private Hosted Zone with all target VPCs achieves optimal private name resolution natively. Using regional Transit Gateways connected via Transit VIFs to a Direct Connect Gateway satisfies dynamic failover and backup constraints.

Step-by-Step Solution

1
Evaluate the cross-region application routing path for latency constraints.
Identify that VPC Peering provides direct, point-to-point cross-region routing without a transit hop, bypassing Transit Gateway peering to deliver the lowest latency and highest throughput.
Transit Gateway peering adds processing hops and data processing fees, whereas VPC Peering routes directly over the AWS backbone.
2
Design high availability for outbound internet egress.
Determine that a NAT Gateway must be deployed in each Availability Zone where private subnets are present (three NAT Gateways per VPC).
Configuring route tables to share a single NAT Gateway across multiple Availability Zones introduces a single point of failure in case of an AZ outage.
3
Address private hosted zone DNS resolution constraints.
Associate the Route 53 Private Hosted Zone (app.corp.internal) directly with App-VPC-US1, App-VPC-US2, and Shared-VPC-US1.
Route 53 Resolver Inbound Endpoints are not required and add latency. Direct association with VPCs is the native and recommended method to resolve a PHZ across multiple VPCs.
4
Design dynamic hybrid failover with backup paths.
Connect regional Transit Gateways (TGWs) to the Direct Connect Gateway (DXGW) using Transit VIFs, and run backup Site-to-Site VPN connections to the TGWs.
Direct Connect Gateway alone associated with VGWs does not support transitive routing or VPN backup failover patterns for multiple spoke VPCs.

Key Concept

Multi-region hybrid networking design balancing lowest latency (VPC Peering) with high availability (multi-AZ NAT Gateways, Transit Gateway for hybrid failover) and native DNS resolution (PHZ multi-VPC association).
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic