Examkin

Question

Difficulty: Very hardOptimizing Network Performance and Latency

An international energy conglomerate operates a real-time smart grid telemetry platform. The core processing systems run on Amazon EC2 instances in a VPC in the us-west-2 (Oregon) Region. Real-time data is sent from a centralized control center in Oslo, Norway, which is connected to AWS via a 10 Gbps AWS Direct Connect connection terminating at an AWS Direct Connect partner location in Europe. Currently, the Oslo control center accesses a staging VPC in the eu-west-1 (Ireland) Region via a Private Virtual Interface (VIF) connected to a Virtual Private Gateway (VGW). To transmit telemetry data to us-west-2, the traffic is routed from Oslo to the staging VPC in eu-west-1 over the Direct Connect link, and then forwarded to us-west-2 using an inter-region VPC Peering connection. Latency spikes and significant throughput degradation are causing telemetry data packet drops. Furthermore, on-premises systems in Oslo cannot resolve the private DNS names of the us-west-2 compute nodes, which are defined in a Route 53 Private Hosted Zone (PHZ) associated with the us-west-2 VPC. Which combination of actions should a solutions architect implement to minimize replication latency, maximize throughput, and resolve on-premises DNS queries for the private hosted zone?

  1. Provision a Transit Virtual Interface (VIF) on the Direct Connect connection and connect it to a Direct Connect Gateway. Associate the Direct Connect Gateway with an AWS Transit Gateway in us-west-2, and attach the us-west-2 VPC to the Transit Gateway. Create Route 53 Resolver Inbound Endpoints in the us-west-2 VPC, and configure the on-premises DNS servers to conditionally forward queries for the internal domain to the Inbound Endpoint IP addresses.Answer
  2. B
    Establish a Direct Connect Gateway and associate it directly with the Virtual Private Gateways (VGWs) in both eu-west-1 and us-west-2. Configure the on-premises router to route traffic destined for us-west-2 by forwarding it to the eu-west-1 VPC via the Direct Connect Gateway, allowing the Direct Connect Gateway to route the transit traffic to us-west-2. Configure Route 53 Resolver Inbound Endpoints in eu-west-1 to handle the on-premises DNS queries.
  3. C
    Provision a Transit Virtual Interface (VIF) on the Direct Connect connection and connect it to a Direct Connect Gateway. Associate the Direct Connect Gateway with an AWS Transit Gateway in us-west-2, and attach the us-west-2 VPC to the Transit Gateway. Create Route 53 Resolver Inbound Endpoints in the eu-west-1 VPC, and configure the on-premises DNS servers to conditionally forward queries for the internal domain to the eu-west-1 Inbound Endpoint IP addresses.
  4. D
    Deploy a single NAT Gateway in a single Availability Zone within the eu-west-1 VPC. Set up an AWS Site-to-Site VPN from the Oslo control center over the public internet terminating on the NAT Gateway, routing all us-west-2 traffic through it. Associate the Route 53 Private Hosted Zone in us-west-2 with the eu-west-1 VPC, and deploy Route 53 Resolver Inbound Endpoints in the eu-west-1 VPC.

Answer

Establish a direct path to the us-west-2 Region by provisioning a Transit Virtual Interface (VIF) on the Direct Connect connection, connecting it to a Direct Connect Gateway, and associating it with an AWS Transit Gateway in us-west-2. Then, create Route 53 Resolver Inbound Endpoints in the us-west-2 VPC and configure the on-premises DNS servers to forward domain queries to those endpoints.
The correct option establishes a direct, non-transitive route to the us-west-2 Region using a Transit Virtual Interface (VIF) connected to a Direct Connect Gateway, which is associated with an AWS Transit Gateway in us-west-2. This bypasses the eu-west-1 hop and avoids the transitive routing limitations of VPC Peering. Creating Route 53 Resolver Inbound Endpoints in the us-west-2 VPC (where the Private Hosted Zone is associated) and forwarding on-premises DNS queries to these endpoints allows successful DNS resolution of private records from Oslo.

Step-by-Step Solution

1
Analyze the existing network topology and identify the cause of latency and replication failure.
The current path attempts to route traffic from the Oslo control center to eu-west-1 via a Direct Connect Private VIF, and then to us-west-2 using an inter-region VPC Peering connection. Because AWS VPC Peering does not support transitive routing (traffic entering a VPC from a VPN or Direct Connect cannot be routed across a VPC peering connection to another VPC), this traffic path fails, resulting in packet drops and fallback to high-latency public routes.
Understanding the transit limitations of VPC Peering is essential to design an optimized, direct routing path.
2
Select the optimal connectivity model to establish a direct, high-throughput, low-latency path to us-west-2.
Create a Transit VIF on the Direct Connect connection, connect it to a Direct Connect Gateway (DXGW), and associate the DXGW with an AWS Transit Gateway in the us-west-2 Region. Attach the us-west-2 VPC to this Transit Gateway.
This allows Oslo to bypass the staging VPC in eu-west-1 and directly access us-west-2 resources over the AWS global network backbone, maximizing throughput and reducing latency.
3
Design the hybrid DNS resolution architecture to allow on-premises systems to resolve private hosted zone domain names.
Deploy Route 53 Resolver Inbound Endpoints in the us-west-2 VPC. Since the Route 53 Private Hosted Zone (PHZ) is associated with the us-west-2 VPC, any queries arriving at these endpoints will be resolved against the PHZ.
Route 53 PHZs cannot be queried directly from on-premises over a hybrid connection without using Route 53 Resolver Inbound Endpoints.
4
Configure on-premises DNS forwarding.
Configure the on-premises DNS servers in Oslo to conditionally forward DNS queries for the internal domain name space to the IP addresses of the Route 53 Resolver Inbound Endpoints in us-west-2.
This ensures that internal name resolution queries are routed over the Direct Connect link to AWS, resolving successfully.

Key Concept

Transitive routing limitations of AWS VPC Peering/Direct Connect Gateway and hybrid DNS resolution using Route 53 Resolver Inbound Endpoints.
Estimated Time:3m 0s
Rate this question

Topics

Optimizing Network Performance and Latency