Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a new multi-region, multi-account AWS environment with the following VPCs:
- In us-east-1: VPC-Retail-Prod and VPC-Retail-Dev (owned by Account A)
- In eu-west-1: VPC-Wholesale-Prod and VPC-Wholesale-Dev (owned by Account B)
- In us-east-1: VPC-Core-Ops (owned by Account C), which hosts a Route 53 Private Hosted Zone (PHZ) named corp.internal

The architectural requirements are:
1. VPC-Retail-Prod and VPC-Wholesale-Prod must have private, bi-directional, lowest-latency, and most cost-effective network connectivity.
2. The development VPCs (VPC-Retail-Dev and VPC-Wholesale-Dev) must remain completely isolated from the production VPCs and from each other.
3. Resources in all four application VPCs must resolve DNS queries for the corp.internal domain.
4. Resources in the private subnets of VPC-Retail-Prod and VPC-Wholesale-Prod must have highly available, redundant outbound IPv4 internet access.

Which solution should a solutions architect recommend to meet these requirements?

  1. A
    Establish an inter-region VPC peering connection between VPC-Retail-Prod and VPC-Wholesale-Prod. In Account C, create VPC association authorizations for corp.internal to authorize associations with the four application VPCs, then accept the associations in Accounts A and B. In each production VPC, deploy a single NAT Gateway in one public subnet, and configure the private subnet route tables in all Availability Zones to route outbound traffic through this single NAT Gateway.
  2. B
    Deploy AWS Transit Gateways in us-east-1 and eu-west-1 and peer them. Attach VPC-Retail-Prod, VPC-Retail-Dev, VPC-Wholesale-Prod, and VPC-Wholesale-Dev to their respective regional Transit Gateways. Use Transit Gateway route tables to allow production-to-production routing and isolate development traffic. Associate the PHZ corp.internal with the Transit Gateways to enable DNS resolution across all VPCs. In each production VPC, deploy NAT Gateways in each public subnet across multiple Availability Zones for internet access.
  3. Establish an inter-region VPC peering connection between VPC-Retail-Prod and VPC-Wholesale-Prod. In Account C, create VPC association authorizations for corp.internal to authorize associations with the four application VPCs, then accept the associations in Accounts A and B. In each production VPC, deploy a NAT Gateway in each public subnet across multiple Availability Zones, and update the private subnet route tables to direct outbound traffic to the NAT Gateway in their respective Availability Zone.Answer
  4. D
    Establish an inter-region VPC peering connection between VPC-Retail-Prod and VPC-Wholesale-Prod, and establish VPC peering from VPC-Core-Ops to all four application VPCs. Deploy Route 53 Resolver inbound endpoints in VPC-Core-Ops and outbound endpoints in each application VPC to forward DNS queries for corp.internal over the peering connections. In each production VPC, deploy a NAT Gateway in each public subnet across multiple Availability Zones.

Answer

The correct solution is to establish an inter-region VPC peering connection between the two production VPCs, perform direct cross-account Private Hosted Zone associations for DNS resolution, and deploy multi-AZ NAT Gateways in the production VPCs for redundant egress.
Establishing an inter-region VPC peering connection provides direct, low-latency communication with no data processing fees, making it the most cost-effective design for this specific topology. Performing direct cross-account Private Hosted Zone association resolves DNS names natively without requiring expensive Route 53 Resolver endpoints. Finally, deploying a NAT Gateway in each public subnet across multiple Availability Zones prevents a single Availability Zone outage from disrupting outbound internet traffic for the entire VPC.

Step-by-Step Solution

1
Determine the optimal cross-region network connectivity for the production VPCs.
VPC Peering is selected over Transit Gateway because it provides direct, lowest-latency routing and avoids Transit Gateway's hourly attachment and data processing charges.
Since only two production VPCs need to communicate, a complex hub-and-spoke model is unnecessary and less cost-effective.
2
Design the DNS resolution architecture for the centralized Private Hosted Zone.
Use Route 53 VPC association authorizations in Account C to authorize cross-account associations, and associate the PHZ directly with all four application VPCs.
Direct association allows VPCs to resolve the PHZ without the cost, complexity, and latency of deploying Route 53 Resolver endpoints.
3
Configure egress routing to support high availability and redundancy.
Deploy a NAT Gateway in each Availability Zone containing active private resources in the production VPCs.
Using a single NAT Gateway creates a single point of failure, violating the redundancy requirement during a zone outage.

Key Concept

Designing cost-effective, high-performance, and resilient multi-region networking by choosing VPC Peering for simple peering topologies, leveraging cross-account Route 53 Private Hosted Zone associations, and deploying redundant multi-AZ NAT Gateways for egress.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic