An enterprise has a multi-account AWS architecture. The core application backends are depl… — AWS Certified Solutions Architect - Professional

An enterprise has a multi-account AWS architecture. The core application backends are deployed across multiple private subnets in a Spoke VPC in the $us-west-2$ region. A Shared Services VPC in the $us-east-1$ region hosts a centralized internal API behind an Application Load Balancer (ALB) and holds a Route 53 Private Hosted Zone (PHZ) named `api.internal.enterprise.com`.

The Spoke VPC is connected to the Shared Services VPC via AWS Transit Gateway (TGW) peering. The enterprise also replicates high-throughput database transactions from its on-premises data center to the Spoke VPC in $us-west-2$ over a $10\text{ Gbps}$ AWS Direct Connect connection. The connection uses a Transit Virtual Interface (Transit VIF) terminated on a Direct Connect Gateway (DXGW) that is attached to the Spoke VPC's TGW.

The network architecture is currently experiencing the following performance and operational issues:
1. Database replication throughput is capped, and packet drops occur during peak sync periods. On-premises routers are configured with an MTU of $9000$ .
2. Instances in the $us-west-2$ Spoke VPC fail to resolve the hostname `api.internal.enterprise.com`.
3. Outbound internet traffic from all Availability Zones in the Spoke VPC is routed through a single NAT Gateway in one Availability Zone, which occasionally experiences localized failures, dropping all outbound connections.
4. The internal ALB in the Shared Services VPC drops connections during sudden daily flash traffic spikes.

Which combination of actions should a Solutions Architect recommend to optimize network performance, minimize latency, and resolve these issues?

Enable jumbo frames with an MTU of $8500$ on the Direct Connect Transit VIF, the Transit Gateway, and the on-premises routers. Associate the Route 53 Private Hosted Zone `api.internal.enterprise.com` with the Spoke VPC in $us-west-2$ using the Route 53 API for cross-account association. Deploy a NAT Gateway in each Availability Zone of the Spoke VPC, and configure the private route tables to direct outbound traffic to their respective local NAT Gateway. Request AWS Support to pre-warm the internal ALB in the Shared Services VPC before the daily flash traffic spikes.Answer
B
Configure the Direct Connect Gateway (DXGW) to bypass the Transit Gateway and establish transitive routing directly between the Spoke VPC and the Shared Services VPC. Maintain the on-premises MTU at $9000$ and the Transit VIF MTU at $1500$ , relying on Path MTU Discovery (PMTUD) to negotiate packet sizes. Associate the Route 53 PHZ with the Spoke VPC. Deploy a NAT Gateway in each Availability Zone of the Spoke VPC. Rely on the Application Load Balancer's automatic scaling policies to scale out resources dynamically during daily flash traffic spikes.
C
Enable jumbo frames with an MTU of $8500$ on the Direct Connect Transit VIF, the Transit Gateway, and the on-premises routers. Configure a Route 53 Resolver outbound endpoint in the Spoke VPC to forward queries for `api.internal.enterprise.com` to the default VPC resolver IP address $169.254.169.253$ in the Shared Services VPC without associating the PHZ. Deploy a NAT Gateway in each Availability Zone of the Spoke VPC. Request AWS Support to pre-warm the internal ALB in the Shared Services VPC.
D
Enable jumbo frames with an MTU of $8500$ on the Direct Connect Transit VIF, the Transit Gateway, and the on-premises routers. Associate the Route 53 Private Hosted Zone `api.internal.enterprise.com` with the Spoke VPC in $us-west-2$ using the Route 53 API. Deploy a single NAT Gateway in a single Availability Zone of the Spoke VPC, and route outbound traffic from all private subnets to this NAT Gateway to centralize outbound traffic management. Request AWS Support to pre-warm the internal ALB in the Shared Services VPC.

Answer

Enable jumbo frames with an MTU of

8500

on the Direct Connect Transit VIF, the Transit Gateway, and the on-premises routers; associate the Route 53 Private Hosted Zone with the Spoke VPC; deploy redundant NAT Gateways in each Availability Zone of the Spoke VPC; and pre-warm the Application Load Balancer.

The correct solution addresses all aspects of the latency and performance issues: (1) configuring the MTU to

8500

bytes across the entire replication path (matching the maximum supported by Transit Gateway and Direct Connect Transit VIF) avoids fragmentation and optimizes database throughput; (2) associating the Route 53 PHZ with the Spoke VPC using the Route 53 API enables native, low-latency cross-account DNS resolution; (3) deploying NAT Gateways in each Availability Zone removes the single point of failure and avoids inter-AZ transit latency; and (4) pre-warming the ALB ensures that the load balancer has enough capacity to handle sudden daily spikes in flash traffic without dropping packets.

Step-by-Step Solution

Configure MTU sizes across the hybrid path.

Jumbo frames are set to

8500

bytes on the on-premises routers, Direct Connect Transit VIF, and AWS Transit Gateway.

AWS Transit Gateway and Direct Connect Transit VIF support a maximum MTU of

8500

bytes. Aligning the MTU sizes prevents packet fragmentation and drops, thereby optimizing replication throughput and reducing CPU overhead on network interfaces.

Establish cross-account Route 53 Private Hosted Zone (PHZ) association.

The Route 53 PHZ `api.internal.enterprise.com` in the Shared Services VPC account is associated with the Spoke VPC in

us-west-2

Route 53 PHZs are only resolvable within VPCs that are explicitly associated with them. Associating the PHZ with the Spoke VPC allows Route 53 Resolver to resolve the internal domain locally, reducing latency and avoiding DNS resolution failures.

Design redundant NAT Gateways across Availability Zones.

A NAT Gateway is deployed in each Availability Zone, and route tables for the private subnets are updated to point to the local NAT Gateway.

A single NAT Gateway creates a single point of failure. Deploying a NAT Gateway per AZ ensures high availability and eliminates inter-AZ network latency and data transfer charges for outbound internet traffic.

Ensure the Application Load Balancer can handle rapid traffic spikes.

AWS Support pre-warms the ALB to support the anticipated spike in throughput.

Application Load Balancers scale dynamically but cannot handle sudden, massive flash traffic spikes instantly. Pre-warming scales the load balancer's capacity ahead of the spike to prevent dropped TCP connections.

Key Concept

Optimizing Network Performance and Latency in Hybrid and Multi-Account Architectures

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics