Examkin

Question

Difficulty: HardOptimizing Network Performance and Latency

A logistics enterprise runs a real-time fleet tracking and route optimization application. The core system operates in the us-west-2 Region. The architecture consists of a shared services VPC hosting a latency-critical Kafka ingestion cluster, and ten regional ingestion VPCs in the same region. The regional VPCs receive continuous GPS telemetry from millions of IoT gateway devices over the internet, preprocess the messages on EC2 fleets, and forward them to the Kafka cluster.

Currently, all inter-VPC traffic is routed through a central AWS Transit Gateway. The telemetry preprocessing nodes experience frequent packet drops and microsecond latency spikes during peak hours, violating the strict sub-10ms data ingestion SLA. Additionally, the telemetry nodes fail to resolve the private DNS names of the Kafka brokers, which are defined in a Route 53 Private Hosted Zone (PHZ) in the shared services VPC. Outbound traffic to the on-premises database for metadata enrichment is routed via a single NAT Gateway in the shared services VPC.

The enterprise requires a solution that minimizes inter-VPC latency, ensures maximum throughput, maintains high availability for database enrichment routing, and resolves the DNS resolution failures.

Which of the following actions should the Solutions Architect recommend?

  1. A
    Peer the regional ingestion VPCs directly with the shared services VPC to bypass the Transit Gateway. Rely on a Route 53 Resolver inbound endpoint in the shared services VPC to handle DNS resolution from the regional VPCs without associating the Private Hosted Zone with them. Deploy a NAT Gateway in each Availability Zone of the shared services VPC.
  2. B
    Peer the regional ingestion VPCs directly with the shared services VPC to bypass the Transit Gateway, enabling Jumbo Frames (9001-byte MTU) for the data ingestion traffic. Associate the Kafka Private Hosted Zone with all regional VPCs. Keep the single NAT Gateway in the shared services VPC but configure routing tables in all Availability Zones to point to it.
  3. Peer the regional ingestion VPCs directly with the shared services VPC to bypass the Transit Gateway, enabling Jumbo Frames (9001-byte MTU) for the data ingestion traffic. Associate the Kafka Private Hosted Zone with all regional VPCs. Deploy a NAT Gateway in each Availability Zone of the shared services VPC to provide highly available outbound routes.Answer
  4. D
    Establish a centralized AWS Direct Connect Gateway and configure it to route transitive traffic directly between the regional VPCs and the shared services VPC, bypassing both Transit Gateway and VPC Peering. Associate the Kafka Private Hosted Zone with the Direct Connect Gateway. Deploy a NAT Gateway in each Availability Zone of the shared services VPC.

Answer

Peer the regional ingestion VPCs directly with the shared services VPC to bypass the Transit Gateway, enabling Jumbo Frames (9001-byte MTU) for the data ingestion traffic. Associate the Kafka Private Hosted Zone with all regional VPCs. Deploy a NAT Gateway in each Availability Zone of the shared services VPC to provide highly available outbound routes.
The correct answer optimizes latency and throughput by establishing direct VPC Peering connections, which bypasses the Transit Gateway hop and enables Jumbo Frames (9001-byte MTU) for same-region traffic. It also correctly resolves DNS by associating the Route 53 Private Hosted Zone with all regional VPCs and ensures high availability for outbound traffic by deploying a NAT Gateway in each Availability Zone of the shared services VPC.

Step-by-Step Solution

1
Replace the Transit Gateway path for inter-VPC ingestion traffic with direct VPC Peering connections between the regional VPCs and the shared services VPC.
Bypasses the Transit Gateway processing overhead (reducing latency by 1-2 ms) and enables Jumbo Frames (9001-byte MTU) to maximize throughput and prevent packet fragmentation.
Intra-region VPC Peering supports up to 9001-byte MTU, whereas Transit Gateway supports up to 8500-byte MTU and introduces processing latency.
2
Associate the Route 53 Private Hosted Zone (PHZ) created in the shared services VPC with each of the ten regional ingestion VPCs.
Enables resources within the regional VPCs to successfully resolve the private DNS names of the Kafka brokers.
Route 53 Private Hosted Zones are isolated by default and must be explicitly associated with any VPC that requires name resolution for the zone.
3
Deploy a NAT Gateway in each Availability Zone of the shared services VPC and configure the private subnet route tables to direct outbound 0.0.0.0/0 traffic to the local NAT Gateway in the same zone.
Ensures that outbound traffic to the on-premises database for metadata enrichment is highly available and resilient to Availability Zone failures.
A single NAT Gateway presents a single point of failure for multi-AZ architectures. Redundant NAT Gateways ensure high availability.

Key Concept

Optimizing multi-VPC latency and throughput involves using direct VPC Peering to leverage Jumbo Frames (9001-byte MTU) and bypass Transit Gateway hops, coupled with proper Private Hosted Zone association for DNS resolution and redundant NAT Gateways for outbound path resilience.
Estimated Time:3m 0s
Rate this question

Topics

Optimizing Network Performance and Latency