Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A software-as-a-service (SaaS) provider is establishing a new application environment in the eu-central-1 Region. The architecture features 33 spoke VPCs (vpc-tenant-a, vpc-tenant-b, and vpc-services) and a central egress VPC (vpc-egress). The instances in the tenant VPCs require access to APIs in the services VPC, must resolve internal domain names managed in a Route 53 Private Hosted Zone (PHZ) created in the services VPC, and need outbound internet access for patching. Which TWO network architecture configurations should the solutions architect implement to satisfy these connectivity and DNS requirements while ensuring high availability and resilience?

  1. Interconnect all tenant and services VPCs using an AWS Transit Gateway, and authorize and associate the services Private Hosted Zone with each of the tenant VPCs.Answer
  2. Deploy NAT Gateways in multiple Availability Zones in the central egress VPC, and configure the spoke VPC route tables to route outbound internet traffic to the AWS Transit Gateway.Answer
  3. C
    Deploy a single NAT Gateway in a single Availability Zone within the central egress VPC to centralize and route all outbound internet traffic from the spokes.
  4. D
    Associate the services Private Hosted Zone directly with the AWS Transit Gateway to automatically inherit DNS resolution across all attached spokes.
  5. E
    Establish a Direct Connect Gateway and attach it to all VPCs to handle transitive routing and DNS propagation between the spokes.

Answer

Interconnect all tenant and services VPCs using an AWS Transit Gateway, authorize and associate the services Private Hosted Zone with each of the tenant VPCs, deploy NAT Gateways in multiple Availability Zones in the central egress VPC, and configure the spoke VPC route tables to route outbound internet traffic to the AWS Transit Gateway.
The correct solution involves interconnecting all VPCs through an AWS Transit Gateway to establish the networking fabric. To enable internal name resolution, the Private Hosted Zone in the services VPC must be associated with each of the tenant VPCs. To ensure high availability for outbound egress, NAT Gateways must be deployed in multiple Availability Zones in the egress VPC, and the spoke VPC route tables must point to the Transit Gateway for default routing.

Step-by-Step Solution

1
Configure the core network interconnectivity using AWS Transit Gateway.
All spoke VPCs (vpc-tenant-a, vpc-tenant-b, and vpc-services) and the central egress VPC (vpc-egress) are attached to the Transit Gateway, enabling VPC-to-VPC IP routing.
This establishes the necessary network path for VPCs to communicate with the services VPC and the egress VPC.
2
Set up private DNS resolution across all VPCs.
The Route 53 Private Hosted Zone created in the services VPC is associated with both tenant VPCs.
Route 53 Private Hosted Zones must be explicitly associated with each VPC requiring DNS resolution. Because these are in a multi-VPC architecture, cross-account or cross-VPC association authorizations must be completed so that queries from tenant VPCs can resolve DNS names in the services VPC.
3
Deploy high-availability NAT Gateways and configure egress routing.
NAT Gateways are placed in multiple Availability Zones in vpc-egress. Spoke VPC route tables route default traffic (0.0.0.0/00.0.0.0/0) to the Transit Gateway, which routes it to vpc-egress, and then through the NAT Gateways to the internet.
Deploying NAT Gateways in multiple Availability Zones removes the single point of failure, satisfying the resilience and high availability requirement.

Key Concept

Designing highly resilient, multi-VPC architectures using Transit Gateway for routing, multi-AZ NAT Gateways for egress, and cross-VPC Route 53 Private Hosted Zone associations for internal name resolution.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic