Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a hybrid network to connect its on-premises environment with 20 spoke VPCs in a multi-account AWS environment. The design must use an AWS Transit Gateway for centralized routing. The network architecture requires a primary 10 Gbps10\text{ Gbps} AWS Direct Connect connection and a backup AWS Site-to-Site VPN connection, with automatic failover and failback. Additionally, on-premises servers must resolve domain names for resources inside an AWS Route 53 Private Hosted Zone (PHZ) that is managed in a shared services VPC.

Which two configurations should a solutions architect implement to meet these requirements? (Select TWO.)

  1. Associate the AWS Direct Connect gateway with the Transit Gateway using a Transit Virtual Interface (Transit VIF), and attach the Site-to-Site VPN to the Transit Gateway, configuring BGP routing on both paths.Answer
  2. Create Route 53 Resolver inbound endpoints in the shared services VPC, associate the Route 53 PHZ with all 20 spoke VPCs and the shared services VPC, and configure on-premises DNS forwarders to target the inbound endpoint IP addresses.Answer
  3. C
    Associate the Route 53 PHZ only with the shared services VPC, and rely on Transit Gateway route propagation to automatically route DNS queries from the other 20 spoke VPCs to the Route 53 Resolver in the shared services VPC.
  4. D
    Associate the Direct Connect Gateway directly with all 20 spoke VPCs using Private Virtual Interfaces (Private VIFs) to establish direct transitive routing, bypassing the Transit Gateway to optimize latency.
  5. E
    Deploy a single NAT Gateway in the shared services VPC and route all egress traffic from the 20 spoke VPCs through this gateway to provide a single public egress point for on-premises DNS forwarding.

Answer

To meet the requirements, the solutions architect must associate the AWS Direct Connect gateway with the Transit Gateway using a Transit VIF and configure BGP routing on both paths, while also creating Route 53 Resolver inbound endpoints in the shared services VPC and associating the Route 53 PHZ with all 20 spoke VPCs and the shared services VPC.
To establish a highly available, scalable hybrid network, AWS Transit Gateway acts as the central hub. Associating the Direct Connect gateway via a Transit VIF and establishing a BGP-configured VPN attachment allows for automatic failover and failback, as AWS naturally prioritizes Direct Connect over VPN when identical routes are advertised. For on-premises servers to resolve names in the Private Hosted Zone, Route 53 Resolver inbound endpoints must be created in the shared services VPC. Furthermore, because DNS queries targeting the VPC-local resolver IP (169.254.169.253) cannot cross Transit Gateway attachments, the Private Hosted Zone must be associated with the shared services VPC and all 20 spoke VPCs.

Step-by-Step Solution

1
Configure hybrid routing using AWS Transit Gateway.
Connect the AWS Direct Connect Gateway using a Transit VIF to the Transit Gateway, and establish a backup Site-to-Site VPN attachment to the same Transit Gateway.
This centralizes transit network management for all 20 spoke VPCs and avoids the scale limitations of Direct Connect Gateway associations.
2
Configure BGP routing on both the Direct Connect and VPN paths.
Dynamic routes are advertised via BGP. By default, AWS route preference prioritizes the Direct Connect path over the VPN path when identical prefixes are advertised.
This configuration enables automatic failover to the VPN connection and automatic failback to the Direct Connect connection when it recovers.
3
Implement the hybrid DNS architecture.
Deploy Route 53 Resolver inbound endpoints in the shared services VPC. Configure the on-premises DNS server to forward queries for the internal domain to these inbound endpoint IPs. Associate the Private Hosted Zone with all 20 spoke VPCs and the shared services VPC.
On-premises servers need the inbound endpoints to query AWS DNS. The PHZ must be associated with every VPC from which queries are initiated (including the inbound endpoint's VPC) because DNS query traffic to the Route 53 Resolver IP cannot cross Transit Gateway attachments.

Key Concept

Centralized hybrid network routing using AWS Transit Gateway combined with BGP routing, and private DNS query resolution across hybrid environments using Route 53 Resolver inbound endpoints and explicit Private Hosted Zone associations.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic