Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A financial services company is designing a new cloud infrastructure in the eu-west-3 Region. The architecture requires two application spoke VPCs (vpc-payment-processing and vpc-user-portal) to access the internet for software updates and third-party API integration. The solution must prevent direct inbound connections from the internet to the application instances. Additionally, the company has a centralized shared services VPC (vpc-shared-core) hosting a Route 53 Private Hosted Zone named internal.fintech.aws. The application instances in both spoke VPCs must resolve names within this Private Hosted Zone. An AWS Transit Gateway named tgw-central connects all three VPCs. The solution must be highly available across two Availability Zones (eu-west-3a and eu-west-3b) and minimize latency and cross-AZ data transfer costs. Which two configurations should the solutions architect implement to meet these requirements?

  1. In vpc-shared-core, deploy a NAT Gateway in a public subnet in each Availability Zone (eu-west-3a and eu-west-3b). Configure the Transit Gateway attachment subnets in vpc-shared-core with route tables that direct egress traffic to the local NAT Gateway in the same Availability Zone.Answer
  2. Associate the Route 53 Private Hosted Zone internal.fintech.aws with the spoke VPCs (vpc-payment-processing and vpc-user-portal) as well as the shared services VPC (vpc-shared-core).Answer
  3. C
    In vpc-shared-core, deploy a single NAT Gateway in eu-west-3a and configure all Transit Gateway attachment subnet route tables to route outbound traffic to this single NAT Gateway.
  4. D
    Associate the Route 53 Private Hosted Zone internal.fintech.aws only with vpc-shared-core, and rely on the Transit Gateway route propagation to transitively resolve DNS queries from the spoke VPCs.
  5. E
    Establish VPC peering connections between vpc-payment-processing and vpc-user-portal, and configure the spoke VPC route tables to route all outbound internet traffic transitively through the peering connection to vpc-shared-core.

Answer

Deploy a NAT Gateway in each Availability Zone in the shared services VPC and associate the Private Hosted Zone with all VPCs.
To satisfy the requirements of high availability, minimized latency, and reduced cross-AZ data transfer costs, a solutions architect should deploy a NAT Gateway in a public subnet within each Availability Zone in the centralized egress VPC. The routing for the Transit Gateway attachment subnets in the egress VPC must point to the local NAT Gateway in the same Availability Zone. Furthermore, to enable DNS resolution of private domain names hosted in a Private Hosted Zone (PHZ) in other VPCs, the PHZ must be explicitly associated with each VPC that needs to perform DNS resolution. Transitive DNS resolution is not supported natively over Transit Gateway attachments without PHZ association or Route 53 Resolver endpoints.

Step-by-Step Solution

1
Configure the centralized egress routing infrastructure by deploying a NAT Gateway in a public subnet in both Availability Zones (eu-west-3a and eu-west-3b) of the shared services VPC.
Redundant NAT gateways are available, ensuring high availability and local AZ egress routes.
To satisfy high availability and prevent cross-AZ data transfer costs, traffic must stay within its local AZ.
2
Configure the Transit Gateway attachment subnets' route tables in the shared services VPC to point their default route (0.0.0.0/0) to the NAT Gateway in their respective Availability Zone.
Egress traffic from the Transit Gateway is routed to the local NAT Gateway within the same AZ.
This guarantees that outbound internet traffic from the spoke VPCs is processed by the local NAT Gateway, preventing cross-AZ charges.
3
Associate the Route 53 Private Hosted Zone internal.fintech.aws with vpc-payment-processing and vpc-user-portal in addition to vpc-shared-core.
Private DNS resolution for internal.fintech.aws works successfully across all spoke VPCs.
Route 53 Private Hosted Zones require explicit association with consumer VPCs to resolve records inside them.

Key Concept

Centralized VPC egress architecture and Route 53 Private Hosted Zone cross-VPC association.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic