An enterprise is designing a highly resilient network architecture in the eu-central-1 Reg… — AWS Certified Solutions Architect - Professional

An enterprise is designing a highly resilient network architecture in the eu-central-1 Region for a credit-scoring platform. The design includes two spoke VPCs, vpc-scoring-prod and vpc-analytics-prod, each containing workloads distributed across Availability Zones eu-central-1a and eu-central-1b. Additionally, a centralized egress VPC, vpc-egress-central, is deployed in the same region to inspect and NAT all outbound internet traffic. The platform has the following constraints: 1. All outbound internet traffic from the spoke VPCs must flow through the central egress VPC. 2. Outbound connectivity must be resilient to the outage of a single Availability Zone. 3. Workloads in both spoke VPCs must resolve internal DNS queries for scoring.internal, a Route 53 Private Hosted Zone (PHZ) hosted in a separate Shared Services AWS account. 4. The solution must minimize cost and operational complexity. Which of the following architectures satisfies these requirements?

A
Establish VPC Peering connections between the spoke VPCs and the central egress VPC. Deploy a NAT Gateway in both Availability Zones eu-central-1a and eu-central-1b within vpc-egress-central. Configure the route tables of the spoke VPCs to point $0.0.0.0/0$ to the VPC Peering connection. In the Shared Services account, submit a Route 53 VPC association authorization for the spoke VPCs, and complete the association from the spoke accounts.
B
Interconnect the spoke VPCs and the central egress VPC using an AWS Transit Gateway. Deploy a single NAT Gateway in Availability Zone eu-central-1a within vpc-egress-central. Configure the spoke VPC route tables to route $0.0.0.0/0$ traffic to the Transit Gateway, and configure the Transit Gateway route table to route $0.0.0.0/0$ to the central egress VPC. In the Shared Services account, submit a Route 53 VPC association authorization for the spoke VPCs, and complete the association from the spoke accounts.
Interconnect the spoke VPCs and the central egress VPC using an AWS Transit Gateway. Deploy a NAT Gateway in both Availability Zones eu-central-1a and eu-central-1b within vpc-egress-central. Configure the spoke VPC route tables to route $0.0.0.0/0$ traffic to the Transit Gateway, and configure the Transit Gateway route table to route $0.0.0.0/0$ to the central egress VPC. In the Shared Services account, submit a Route 53 VPC association authorization for the spoke VPCs, and complete the association from the spoke accounts.Answer
D
Interconnect the spoke VPCs and the central egress VPC using an AWS Transit Gateway. Deploy a NAT Gateway in both Availability Zones eu-central-1a and eu-central-1b within vpc-egress-central. Configure the spoke VPC route tables to route $0.0.0.0/0$ traffic to the Transit Gateway, and configure the Transit Gateway route table to route $0.0.0.0/0$ to the central egress VPC. In the Shared Services account, deploy Route 53 Resolver inbound endpoints. In the spoke VPC accounts, deploy Route 53 Resolver outbound endpoints and configure forwarding rules for scoring.internal targeting the inbound endpoints.

Answer

Interconnect the spoke VPCs and the central egress VPC using an AWS Transit Gateway. Deploy a NAT Gateway in both Availability Zones eu-central-1a and eu-central-1b within vpc-egress-central. Configure the spoke VPC route tables to route

0.0.0.0/0

traffic to the Transit Gateway, and configure the Transit Gateway route table to route

0.0.0.0/0

to the central egress VPC. In the Shared Services account, submit a Route 53 VPC association authorization for the spoke VPCs, and complete the association from the spoke accounts.

The correct architecture uses AWS Transit Gateway to enable transitive routing from the spoke VPCs through the central egress VPC, meeting the routing requirement. It deploys a NAT Gateway in both Availability Zones to ensure high availability and prevent single-AZ failures from causing outages. Finally, it uses Route 53 VPC association authorization to share the private hosted zone across accounts, which introduces zero additional cost and maintains the lowest operational complexity.

Step-by-Step Solution

Use AWS Transit Gateway to interconnect the spoke VPCs and the central egress VPC.

Establishes a hub-and-spoke network topology that supports transitive routing for outbound internet traffic.

VPC Peering does not support transitive routing, so a transit hub like Transit Gateway is required to forward traffic from spoke VPCs to a central egress VPC.

Deploy a NAT Gateway in both Availability Zones eu-central-1a and eu-central-1b inside the egress VPC.

Provides high availability and redundancy for outbound internet traffic.

If an entire Availability Zone experiences an outage, workloads in the remaining zone can still access the internet through the local NAT Gateway in that zone.

Perform a cross-account Route 53 Private Hosted Zone association between the Shared Services account and the spoke VPCs.

Enables resolution of the scoring.internal domain in the spoke VPCs without adding resolver endpoints.

Using cross-account association is the native and cost-free method to share a PHZ between VPCs in different accounts, minimizing both cost and operational overhead.

Key Concept

Centralized egress routing using AWS Transit Gateway combined with cross-account Route 53 Private Hosted Zone association.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic