Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

An enterprise is designing a high-availability, multi-account network architecture in the us-east-1 Region. The architecture consists of three VPCs:

1. vpc-app-prod (Application Account): Distributed across Availability Zones us-east-1a and us-east-1b, containing private subnets hosting critical workloads.
2. vpc-shared-services (Shared Services Account): Hosts internal shared services and a Route 53 Private Hosted Zone (PHZ) named services.corp.internal.
3. vpc-net-egress (Network Account): A centralized VPC designed to handle all outbound internet traffic.

An AWS Transit Gateway (tgw-central) in the Network Account interconnects all three VPCs. The architecture must satisfy the following constraints:
- Workloads in vpc-app-prod must resolve hostnames under the services.corp.internal domain.
- All outbound internet traffic from vpc-app-prod must route through vpc-net-egress for centralized network address translation (NAT).
- The network design must be resilient to a single Availability Zone outage. A failure in us-east-1a must not interrupt internet access or DNS resolution for workloads running in us-east-1b.

Which design configuration meets these requirements while ensuring maximum resiliency?

  1. Deploy a NAT Gateway in a public subnet in us-east-1a and another NAT Gateway in a public subnet in us-east-1b within vpc-net-egress. In vpc-net-egress, configure the route tables associated with the Transit Gateway attachment subnets to direct traffic destined for 0.0.0.0/0 to the local NAT Gateway in the same Availability Zone. Authorize the association of vpc-app-prod with the services.corp.internal Private Hosted Zone from the Shared Services Account, then associate the VPC from the Application Account. Configure the private subnet route tables in vpc-app-prod to route 0.0.0.0/0 to tgw-central, and configure the Transit Gateway route table associated with vpc-app-prod to route 0.0.0.0/0 to the vpc-net-egress attachment.Answer
  2. B
    Deploy a single NAT Gateway in the us-east-1a public subnet of vpc-net-egress to minimize ongoing Gateway charges. In vpc-net-egress, configure the route tables of all Transit Gateway attachment subnets to route 0.0.0.0/0 to this single NAT Gateway. Authorize the association of vpc-app-prod with the services.corp.internal Private Hosted Zone from the Shared Services Account, then associate the VPC from the Application Account. Configure the private subnet route tables in vpc-app-prod to route 0.0.0.0/0 to tgw-central, and configure the Transit Gateway route table associated with vpc-app-prod to route 0.0.0.0/0 to the vpc-net-egress attachment.
  3. C
    Deploy a NAT Gateway in a public subnet in both us-east-1a and us-east-1b within vpc-net-egress. Configure tgw-central with a single route table where route propagation is enabled for all VPC attachments. Configure a static route in tgw-central for 0.0.0.0/0 pointing directly to the Internet Gateway of vpc-net-egress. Configure the Route 53 Resolver in the Application Account to use an outbound resolver endpoint in vpc-app-prod that forwards DNS queries for services.corp.internal to the inbound resolver endpoint in vpc-shared-services.
  4. D
    Deploy a NAT Gateway in a public subnet in both us-east-1a and us-east-1b within vpc-net-egress. In vpc-net-egress, configure the route tables associated with the Transit Gateway attachment subnets to direct traffic destined for 0.0.0.0/0 to the local NAT Gateway in the same Availability Zone. Configure the private subnet route tables in vpc-app-prod to route 0.0.0.0/0 to tgw-central. Rely on the active Transit Gateway attachments to automatically forward DNS queries for services.corp.internal from vpc-app-prod to the DNS servers in vpc-shared-services without explicit cross-account VPC association.

Answer

Deploy redundant NAT Gateways across Availability Zones in the egress VPC, perform cross-account Private Hosted Zone association using hosted zone association authorization, and route outbound traffic from the application VPC through the Transit Gateway to the egress VPC.
The correct configuration establishes high availability by deploying a NAT Gateway in both Availability Zones in the egress VPC. It also correctly addresses DNS resolution requirements by authorizing and performing a cross-account association of the Private Hosted Zone with the application VPC. Outbound routing is properly set up by pointing the application VPC's default route to the Transit Gateway, routing to the egress VPC attachment, and mapping the attachment subnet route tables to the respective NAT Gateways in each Availability Zone.

Step-by-Step Solution

1
Ensure Multi-AZ NAT Gateway redundancy.
Two NAT Gateways are deployed in vpc-net-egress, one in us-east-1a and one in us-east-1b.
This guarantees that an outage in one Availability Zone does not disrupt internet connectivity for workloads in the other Availability Zone.
2
Establish cross-account DNS resolution.
The Shared Services Account authorizes the association of vpc-app-prod with services.corp.internal, and the Application Account accepts the association.
Route 53 Private Hosted Zones require explicit VPC association to allow resolution within consumer VPCs. Simple IP connectivity over Transit Gateway does not automatically enable PHZ DNS resolution.
3
Configure egress routing through Transit Gateway.
Route tables in vpc-app-prod point 0.0.0.0/0 to tgw-central, the Transit Gateway route table routes 0.0.0.0/0 to the vpc-net-egress attachment, and the TGW attachment subnets in vpc-net-egress route to their local NAT Gateways.
This forces all outbound traffic from the application subnets through the centralized egress VPC where traffic is processed by the NAT Gateways.

Key Concept

Centralized egress and cross-account DNS design using AWS Transit Gateway and Route 53 Private Hosted Zones.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic