Examkin

Question

Difficulty: HardNetworking and Connectivity Design

A global financial technology company is setting up a new multi-account AWS environment in the eu-west-1 Region. The architecture contains:
- vpc-payment-prod and vpc-analytics-prod in separate AWS accounts hosting production workloads across two Availability Zones (AZ-A and AZ-B).
- vpc-shared-core in a shared services AWS account, which contains a Route 53 Private Hosted Zone (PHZ) named core.internal containing service endpoints.
- vpc-security-egress in a network security account, hosting a cluster of transit inspection firewalls and outbound gateways.

An AWS Transit Gateway named tgw-transit-hub is deployed in the network security account and shared with the organization. The company has the following requirements:
1. Production workloads in vpc-payment-prod and vpc-analytics-prod must be able to resolve domain names in core.internal.
2. All outbound internet traffic from the production VPCs must be inspected by the firewalls in vpc-security-egress before exiting through NAT Gateways.
3. The design must be highly resilient to Availability Zone outages and minimize cross-AZ data transfer costs.

Which two configuration steps should a solutions architect perform to meet these requirements?

  1. In the vpc-security-egress VPC, deploy a NAT Gateway in a public subnet in each Availability Zone (AZ-A and AZ-B). Configure the route tables of the private firewall subnets in each AZ to route outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway in their respective AZ.Answer
  2. From the shared services account, associate the Route 53 Private Hosted Zone core.internal with vpc-payment-prod and vpc-analytics-prod by submitting cross-account VPC association requests and accepting them in the respective workload accounts.Answer
  3. C
    In the vpc-security-egress VPC, deploy a single NAT Gateway in the public subnet of AZ-A. Configure the route tables of all private firewall subnets across both AZ-A and AZ-B to route outbound traffic (0.0.0.0/00.0.0.0/0) to this single NAT Gateway to minimize idle NAT Gateway hourly charges.
  4. D
    Rely on Transit Gateway routing to automatically propagate DNS resolution for the core.internal domain from vpc-shared-core to the workload VPCs without associating the Private Hosted Zone, as they are attached to the same Transit Gateway.
  5. E
    Create a Direct Connect Gateway in the shared services account, associate it directly with the Transit Gateway, and configure it to route DNS traffic between the workload VPCs and the private hosted zone using Transit Gateway route propagation.

Answer

Deploy a NAT Gateway in each Availability Zone in the egress VPC and route traffic locally, and associate the Route 53 Private Hosted Zone with the workload VPCs.
The correct configuration requires deploying a NAT Gateway in each Availability Zone within the egress VPC. This eliminates cross-AZ charges for outbound traffic and prevents a single AZ outage from taking down internet connectivity. Additionally, cross-account Route 53 Private Hosted Zone association must be established by creating association authorizations in the hosted zone's account and accepting them in the workload accounts.

Step-by-Step Solution

1
Ensure outbound resiliency and minimize cross-AZ costs by deploying redundant NAT Gateways.
Each Availability Zone in the egress VPC has its own local NAT Gateway to route outbound internet traffic (0.0.0.0/00.0.0.0/0).
This setup prevents a single point of failure and avoids cross-AZ data transfer fees for outbound traffic.
2
Establish cross-account DNS resolution for the private hosted zone.
The Route 53 Private Hosted Zone in the shared services account is associated with the production workload VPCs.
VPCs must be explicitly associated with a Private Hosted Zone to resolve its records, regardless of Transit Gateway attachments.

Key Concept

Centralized egress architectures using AWS Transit Gateway require redundant NAT Gateways per Availability Zone to prevent single points of failure and eliminate cross-AZ traffic charges. Additionally, Route 53 Private Hosted Zones require explicit VPC associations for cross-account DNS resolution.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic