Examkin

Question

Difficulty: HardEnhancing Reliability and Disaster Recovery

An enterprise operates a transaction processing application in us-east-1 within AWS Account A. The database tier uses a Multi-AZ Amazon Aurora PostgreSQL DB cluster, and the application tier runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The EC2 instances reside in private subnets and route outbound API validation traffic through a single NAT Gateway located in a single public subnet.

To enhance disaster recovery (DR) and reliability, the company plans to establish a warm standby DR environment in us-west-2 within AWS Account B. The target recovery time objective (RTO) is 10 minutes, and the recovery point objective (RPO) is 1 minute. The database tier will be replicated using Amazon Aurora Global Database. A Private Hosted Zone (PHZ) named corp.internal in Account A is used to map database connections to db.corp.internal.

Which TWO actions should the Solutions Architect take to configure the warm standby environment to meet these requirements?

  1. Authorize the association of the corp.internal Private Hosted Zone in Account A with the VPC in Account B using the Route 53 API or AWS CLI, and then associate the VPC in Account B with the Private Hosted Zone.Answer
  2. Deploy a NAT Gateway in each Availability Zone in the standby VPC in us-west-2, and configure the private subnet route tables to direct outbound traffic to the local NAT Gateway within the same Availability Zone.Answer
  3. C
    In Account B, create a duplicate Private Hosted Zone for corp.internal and use a Route 53 Resolver outbound endpoint to forward database queries to Account A's Route 53 Resolver inbound endpoint.
  4. D
    Deploy a single NAT Gateway in one Availability Zone in the us-west-2 VPC and configure all standby private subnets to route outbound traffic through it, relying on Route 53 health checks to route outbound traffic to Account A's NAT Gateway if the local NAT Gateway fails.
  5. E
    Configure a Route 53 active-passive failover routing policy using a standard HTTP health check pointing to the private IP address of the database writer endpoint to automate regional failover of the application tier during a primary database outage.

Answer

To configure the standby environment for disaster recovery and reliability, the Solutions Architect must authorize the cross-account Private Hosted Zone association from Account A to Account B's VPC, and deploy redundant NAT Gateways across all Availability Zones in the standby region.
Authorizing the cross-account Private Hosted Zone association from Account A to Account B's standby VPC ensures correct, low-latency private DNS resolution of db.corp.internal in the standby region. Deploying a NAT Gateway in each Availability Zone in the standby VPC eliminates single points of failure for outbound third-party API traffic, meeting reliability objectives.

Step-by-Step Solution

1
Configure cross-account DNS resolution for the database endpoint.
Authorized the association of the corp.internal Private Hosted Zone from Account A using the AWS CLI command 'aws route53 create-vpc-association-authorization', and then accepted it in Account B using 'aws route53 associate-vpc-with-hosted-zone'.
This allows EC2 instances in Account B's VPC to resolve db.corp.internal to the database endpoints without introducing complex routing endpoints or split-horizon DNS conflicts.
2
Ensure egress high availability in the standby region.
Deployed a NAT Gateway in each public subnet across multiple Availability Zones in us-west-2, and updated the private subnet route tables to direct 0.0.0.0/0 traffic to the NAT Gateway in the respective zone.
This eliminates the single point of failure for outbound traffic, which is critical for making API validation calls during failover scenarios.

Key Concept

Establishing cross-account DNS resolution and multi-Availability Zone NAT Gateway redundancy to build a highly reliable multi-region disaster recovery environment.
Rate this question

Topics

Enhancing Reliability and Disaster Recovery