Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a secure hybrid and multi-account network topology. The architecture consists of 1010 spoke VPCs distributed across 22 AWS accounts in the `eu-west-1` Region, and a Shared Services VPC in a central account. Hybrid connectivity to the on-premises datacenter is established via AWS Direct Connect using an AWS Transit Gateway.

The configuration must satisfy the following requirements:
- All spoke VPCs must be able to communicate with the on-premises datacenter.
- Spoke VPCs must not be able to communicate with each other.
- All spoke VPCs must be able to resolve domain names in a Route 53 Private Hosted Zone (`aws.internal`) hosted in the Shared Services account.

Which of the following actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure two Transit Gateway route tables: associate the spoke VPC attachments with a route table that routes traffic only to the Direct Connect Gateway attachment, and associate the Direct Connect Gateway attachment with a route table that has propagations enabled for all spoke VPC attachments.Answer
  2. Authorize and associate the Route 53 Private Hosted Zone in the Shared Services account with each of the spoke VPCs in the consumer accounts.Answer
  3. C
    Attach all spoke VPCs directly to the Direct Connect Gateway and enable transitive routing to allow VPC-to-VPC communication while bypassing the Transit Gateway.
  4. D
    Share the Private Hosted Zone from the Shared Services account with the spoke accounts using AWS Resource Access Manager (RAM), and configure Route 53 Resolver rules to forward queries to the Shared Services VPC.

Answer

To meet the requirements, the Solutions Architect must configure two Transit Gateway route tables (one for spokes routing to the Direct Connect Gateway without propagation, and one for the Direct Connect Gateway propagating spoke routes) and authorize/associate the Route 53 Private Hosted Zone from the Shared Services account with each spoke VPC.
To restrict inter-spoke communication while allowing spoke-to-on-premises traffic, a hub-and-spoke routing isolation pattern is used with two Transit Gateway route tables. Spoke VPC attachments are associated with a route table that only has a route to the Direct Connect Gateway. The Direct Connect Gateway attachment is associated with a route table that propagates routes from the spoke VPCs, allowing return traffic. For DNS resolution, a Private Hosted Zone cannot be shared via AWS Resource Access Manager (RAM); instead, cross-account association authorization must be created, allowing each spoke VPC to be associated with the Private Hosted Zone directly.

Step-by-Step Solution

1
Create a Transit Gateway route table for spoke VPCs and associate the spoke attachments to it. Add a route pointing to the Direct Connect Gateway attachment to allow outbound traffic to on-premises. Do not enable propagation from spoke VPCs to this table to prevent inter-spoke routing.
Spokes can route traffic to on-premises but remain isolated from one another.
This establishes the outbound path of the hub-and-spoke isolation model.
2
Create a second Transit Gateway route table for the Direct Connect Gateway attachment, and enable route propagation for all spoke VPC attachments.
On-premises return traffic is successfully routed back to the appropriate spoke VPC.
This establishes the inbound path of the hub-and-spoke isolation model.
3
Authorize cross-account VPC association for the Route 53 Private Hosted Zone in the Shared Services account using the AWS CLI or SDK, and then associate the private hosted zone with each of the spoke VPCs in the consumer accounts.
All spoke VPCs can resolve DNS queries for the private hosted zone directly.
Private Hosted Zones do not support sharing via AWS RAM and require explicit cross-account VPC association.

Key Concept

Hub-and-spoke network routing isolation with AWS Transit Gateway and cross-account Route 53 Private Hosted Zone association.
Estimated Time:2m 0s
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic