A financial services firm is designing its AWS network architecture in the `us-east-1` Reg… — AWS Certified Solutions Architect - Professional

A financial services firm is designing its AWS network architecture in the `us-east-1` Region. The architecture consists of $20$ VPCs split equally between production and development accounts. The firm has an existing $1\text{ Gbps}$ AWS Direct Connect connection with a Private Virtual Interface (VIF) terminated at a Direct Connect Gateway (DXGW). All $20$ VPCs are currently associated with the DXGW via Virtual Private Gateways (VGWs) to access the on-premises network.

The firm has the following new requirements:
- All production VPCs must be able to communicate with each other, and all development VPCs must be able to communicate with each other. Production and development VPC traffic must remain isolated.
- All VPCs must resolve domain names hosted in a single Route 53 Private Hosted Zone (PHZ) managed in a centralized shared services account.
- Administrative overhead must be minimized.

Which network design solution meets these requirements?

A
Deploy an AWS Transit Gateway. Create a Transit VIF on the Direct Connect connection, associate the Direct Connect Gateway with the Transit Gateway, and attach all $20$ VPCs to the Transit Gateway. Configure two separate Transit Gateway route tables to isolate production and development traffic. Rely on the Transit Gateway attachments to automatically forward DNS queries for the Route 53 Private Hosted Zone from all VPCs without manual VPC association.
B
Keep the existing Virtual Private Gateway associations with the Direct Connect Gateway. Enable transitive VPC-to-VPC routing on the Direct Connect Gateway to allow production-to-production and development-to-development communication. Authorize and associate the Route 53 Private Hosted Zone with each of the $20$ VPCs.
Deploy an AWS Transit Gateway. Create a Transit VIF on the Direct Connect connection, associate the Direct Connect Gateway with the Transit Gateway, and attach all $20$ VPCs to the Transit Gateway. Configure two separate Transit Gateway route tables to isolate production and development traffic. Authorize and associate the Route 53 Private Hosted Zone in the shared services account with each of the $20$ VPCs.Answer
D
Establish a full mesh of VPC peering connections among the $10$ production VPCs and another full mesh among the $10$ development VPCs. Keep the existing Direct Connect Gateway associations for hybrid connectivity. Associate the Route 53 Private Hosted Zone with only the shared services VPC, and route all DNS queries through a single NAT Gateway deployed in that shared services VPC.

Answer

Deploy AWS Transit Gateway, connect the VPCs using separate route tables for production and development to ensure isolation, associate the Direct Connect Gateway with the Transit Gateway using a Transit VIF, and associate the Route 53 Private Hosted Zone with all VPCs.

The correct option correctly uses AWS Transit Gateway to handle routing between the

20

VPCs. By deploying two Transit Gateway route tables, the architecture achieves complete isolation between the production and development networks while allowing all VPCs to access the on-premises data center. Additionally, it properly addresses DNS requirements by explicitly associating the Route 53 Private Hosted Zone with all

20

VPCs across the accounts.

Step-by-Step Solution

Consolidate multi-VPC routing by deploying AWS Transit Gateway.

Simplifies connection management from

20

individual Direct Connect VGW associations to a single hub structure.

Direct Connect Gateway does not allow transitive routing between VPCs, so a Transit Gateway is required to facilitate inter-VPC communication.

Set up Transit Gateway route tables for production and development attachments.

Traffic from production VPCs can route to other production VPCs but is blocked from reaching development VPCs, and vice versa.

Multiple route tables allow network isolation without configuring complex security groups or firewalls for each VPC link.

Establish hybrid connectivity using a Transit Virtual Interface (VIF).

Connects the on-premises network to the Transit Gateway via the Direct Connect Gateway.

A Transit VIF is mandatory for attaching a Direct Connect Gateway to an AWS Transit Gateway.

Associate the centralized Route 53 Private Hosted Zone with all

20

spoke VPCs.

All production and development VPCs can resolve domains hosted in the centralized PHZ.

Route 53 PHZs require explicit association with target VPCs to answer queries originating from those VPCs, regardless of Transit Gateway connectivity.

Key Concept

AWS Transit Gateway routing isolation combined with cross-account Route 53 Private Hosted Zone association.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic