A retail company is launching a new hybrid Point-of-Sale (POS) backend platform on AWS. Th… — AWS Certified Solutions Architect - Professional

A retail company is launching a new hybrid Point-of-Sale (POS) backend platform on AWS. The cloud architecture consists of a primary API VPC (`vpc-api-prod` with CIDR block $10.80.0.0/20$ ) in the `us-west-2` Region, which communicates with on-premises inventory systems via a $1\text{ Gbps}$ AWS Direct Connect connection. The company has also deployed a partner integration VPC (`vpc-partner` with CIDR block $10.90.0.0/20$ ) in the same region.

The platform must satisfy the following design requirements:
1. Production API instances in `vpc-api-prod` are distributed across two Availability Zones (`us-west-2a` and `us-west-2b`). They must have highly available, resilient outbound internet access to perform third-party payment processor API calls.
2. Partner integration services in `vpc-partner` must securely connect to the API servers in `vpc-api-prod` but must be strictly prevented from accessing any on-premises networks.
3. Private DNS resolution for the internal domain `api.internal` must be resolvable from both `vpc-api-prod` and `vpc-partner`.

Which TWO network architecture decisions should a solutions architect recommend to satisfy these requirements?

Deploy a NAT Gateway in the public subnet of each Availability Zone in `vpc-api-prod`. Configure the route tables of the private subnets in each Availability Zone to route $0.0.0.0/0$ traffic through the NAT Gateway in the same Availability Zone.Answer
B
Deploy a single NAT Gateway in the public subnet of the `us-west-2a` Availability Zone in `vpc-api-prod`. Configure the private subnet route tables in both `us-west-2a` and `us-west-2b` to route all $0.0.0.0/0$ traffic through this single NAT Gateway.
Associate the Route 53 Private Hosted Zone `api.internal` directly with both `vpc-api-prod` and `vpc-partner` in the Route 53 service configuration.Answer
D
Deploy Route 53 Resolver inbound endpoints in `vpc-api-prod` and outbound endpoints in `vpc-partner`, then configure a forwarding rule in `vpc-partner` to route queries for `api.internal` to the inbound endpoints.
E
Connect `vpc-api-prod` and `vpc-partner` to an AWS Transit Gateway, attach the Direct Connect Gateway to the Transit Gateway, and configure a single Transit Gateway route table with automatic route propagation enabled for all attachments.

Answer

Deploy a NAT Gateway in the public subnet of each Availability Zone in the API VPC, configure private route tables to route internet traffic to the local zone's NAT Gateway, and associate the Route 53 Private Hosted Zone directly with both the API and partner VPCs.

Deploying a NAT Gateway in each Availability Zone where the API instances are hosted prevents a single Availability Zone outage from disrupting outbound internet traffic for the entire VPC. Associating the Route 53 Private Hosted Zone directly with both the production and partner VPCs allows resources in both environments to resolve the internal domain name with minimal operational overhead and zero additional infrastructure cost.

Step-by-Step Solution

Ensure highly available outbound connectivity for the API VPC.

A NAT Gateway is deployed in each Availability Zone's public subnet, and private route tables point to the corresponding local NAT Gateway.

This mitigates Availability Zone failures and avoids cross-AZ data transfer charges for internet egress.

Associate the Route 53 Private Hosted Zone with all required VPCs.

The Route 53 Private Hosted Zone is associated with both the API VPC and the partner VPC.

This allows resources in both VPCs to resolve the local private DNS names without needing DNS forwarders or endpoints.

Verify network routing isolation rules.

The partner VPC is kept isolated from the on-premises network because VPC peering is non-transitive, or because Transit Gateway routing segments the traffic.

This meets the constraint of preventing the partner VPC from accessing the Direct Connect connection to the on-premises network.

Key Concept

Designing resilient egress routing and simplified cross-VPC private DNS resolution under strict access constraints.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic