Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A logistics company is designing a multi-account AWS environment in the `us-east-1` Region. The architecture consists of 1010 spoke VPCs for different business units, a central inspection VPC for outbound internet traffic, and a shared services VPC that hosts common tools and a Route 53 Private Hosted Zone (PHZ) named `logistics.local`.

The company's network requirements are:
1. All spoke VPCs must route outbound internet traffic through the central inspection VPC.
2. The egress architecture must be highly available and resilient to Availability Zone (AZ) failures.
3. Resources in all spoke VPCs must resolve DNS queries for `logistics.local`.
4. Operational complexity and cost must be minimized.

Which architecture meets these requirements?

  1. Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC, routing internet-bound traffic through them. Associate the `logistics.local` Private Hosted Zone with each of the spoke VPCs.Answer
  2. B
    Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy a single NAT Gateway in a single Availability Zone within the central inspection VPC to minimize cost, and route all egress traffic through it. Associate the `logistics.local` Private Hosted Zone with each of the spoke VPCs.
  3. C
    Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC. Enable DNS support on the Transit Gateway attachments, relying on them to automatically forward DNS queries for the `logistics.local` Private Hosted Zone without associating it with the spoke VPCs.
  4. D
    Establish a full mesh of VPC peering connections between all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC. Use a Direct Connect Gateway associated with all VPCs to route inter-VPC traffic and resolve private DNS queries.

Answer

Provision an AWS Transit Gateway to connect all spoke VPCs and the central inspection VPC. Deploy NAT Gateways in multiple Availability Zones within the central inspection VPC, routing internet-bound traffic through them. Associate the `logistics.local` Private Hosted Zone with each of the spoke VPCs.
The correct architecture uses AWS Transit Gateway to simplify routing by acting as a hub for spoke VPCs. Centralizing outbound traffic through NAT Gateways deployed across multiple Availability Zones in the central inspection VPC provides both highly available egress and resilience against AZ failures. Associating the Route 53 Private Hosted Zone with all spoke VPCs enables DNS resolution for the private domain directly and cost-effectively.

Step-by-Step Solution

1
Analyze the egress requirements and select a centralized VPC architecture with AWS Transit Gateway.
All spoke VPCs are connected to the central inspection VPC via Transit Gateway attachments.
Using Transit Gateway avoids the administrative complexity of maintaining a full mesh of VPC peering connections.
2
Design the high availability configuration for the NAT Gateways in the central inspection VPC.
NAT Gateways are deployed in multiple Availability Zones within the central inspection VPC.
Deploying NAT Gateways across multiple AZs ensures egress traffic remains operational if a single Availability Zone experiences an outage.
3
Establish private DNS resolution for the shared Private Hosted Zone.
The Route 53 Private Hosted Zone is associated with each of the spoke VPCs.
Associating the Private Hosted Zone directly with the spoke VPCs allows resource instances within them to resolve the domain names without incurring the costs or complexity of Route 53 Resolver endpoints.

Key Concept

Centralized egress and shared DNS resolution in a multi-account AWS environment using Transit Gateway and Private Hosted Zones.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic