Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

An enterprise is designing a highly resilient multi-Region AWS network architecture for a new financial application. The workload is deployed in the us−east−1us-east-1 and us−west−2us-west-2 Regions across multiple spoke VPCs, including vpc-us-east-prod-1, vpc-us-east-prod-2, and vpc-us-west-prod-1. The architecture must satisfy the following requirements:
- Establish dedicated, high-speed private connections to an on-premises data center with automatic failover.
- Provide highly available outbound internet access for all application instances in the private subnets, resilient to Availability Zone (AZ) failures.
- Resolve hostnames in a Route 53 Private Hosted Zone (PHZ) named corp.internal (hosted in a central shared services account) across all spoke VPCs in both Regions.
- Enable secure inter-Region VPC communication.

Which of the following designs meets these requirements while minimizing single points of failure and adhering to AWS networking best practices?

  1. A
    Deploy tgw-us-east-1 and tgw-us-west-2, peer them, and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. In each spoke VPC, deploy a NAT Gateway in every Availability Zone. In the central shared services account, create a Route 53 inbound Resolver endpoint. In all spoke VPCs, configure Route 53 Resolver forwarding rules for corp.internal pointing to this inbound resolver endpoint, without associating the private hosted zone with the spoke VPCs.
  2. B
    Deploy tgw-us-east-1 and tgw-us-west-2, peer them, and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. To optimize costs while maintaining egress, deploy a single NAT Gateway in vpc-us-east-prod-1 and configure the Transit Gateway route tables to route all outbound internet traffic from vpc-us-east-prod-2 and vpc-us-west-prod-1 to this central NAT Gateway. Associate the Private Hosted Zone corp.internal with all spoke VPCs.
  3. Deploy tgw-us-east-1 and tgw-us-west-2, peer them, and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. In each spoke VPC, deploy a NAT Gateway in every Availability Zone, routing outbound internet traffic to the local NAT Gateway. Submit a cross-account authorization to associate the Private Hosted Zone corp.internal from the shared services account directly with each spoke VPC. In the Transit Gateway route tables, configure local routing preferences to ensure primary traffic to on-premises uses the local Direct Connect connection, failing over to the peered Transit Gateway connection if needed.Answer
  4. D
    Deploy tgw-us-east-1 and tgw-us-west-2 and attach the local spoke VPCs. Associate dxgw-global-prod with both Transit Gateways. Rely on the Direct Connect Gateway to route inter-Region traffic between the spoke VPCs in us-east-1 and us-west-2. In each spoke VPC, deploy a NAT Gateway in every Availability Zone for internet egress. Authorize and associate the Private Hosted Zone corp.internal with all spoke VPCs.

Answer

The correct design utilizes peered Transit Gateways in both Regions to facilitate secure inter-Region VPC communication. It attaches a single global Direct Connect Gateway to both Transit Gateways to provide private connectivity to the on-premises data center. For high availability of outbound internet access, NAT Gateways must be deployed in every Availability Zone of each spoke VPC, ensuring AZ failure doesn't disrupt egress traffic. For DNS resolution, a cross-account authorization and subsequent association of the Private Hosted Zone with the spoke VPCs is the native and correct way to resolve the private zone across multiple VPCs without introducing routing loops.
The correct option provides a highly available egress design by placing NAT Gateways in every Availability Zone of each spoke VPC. It properly routes inter-Region VPC traffic through peered Transit Gateways rather than assuming Direct Connect Gateway is transitive. Additionally, it natively and securely associates the Route 53 Private Hosted Zone across accounts/Regions using cross-account authorization instead of creating DNS forwarding loops.

Step-by-Step Solution

1
Analyze inter-Region VPC-to-VPC communication requirements.
Peering tgw-us-east-1 and tgw-us-west-2 is required because Direct Connect Gateways do not support transitive routing between attached Transit Gateways.
Ensure that communication between Regions does not rely on unsupported paths.
2
Evaluate high availability for outbound internet egress.
Each spoke VPC must have a NAT Gateway deployed in every Availability Zone where workloads reside, and route tables must map local private subnets to their respective local NAT Gateway.
Avoid single points of failure (SPOF) associated with deploying a single NAT Gateway in a single AZ.
3
Address multi-account Private Hosted Zone (PHZ) DNS resolution.
Submit a Route 53 Private Hosted Zone association authorization from the shared services account to the spoke accounts, and then associate the PHZ corp.internal with the spoke VPCs.
Avoid using Resolver endpoints for forwarding rules of the same zone back to another VPC, which can create loop issues and is an architectural anti-pattern.

Key Concept

Hybrid and multi-Region AWS network architecture design integrating Transit Gateway peering, Direct Connect Gateway limitations, NAT Gateway high availability, and cross-account Route 53 Private Hosted Zone associations.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic