Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a multi-account, multi-VPC architecture in the us-east-1 Region. The design includes vpc-app-prod (10.100.0.0/16) in Account A, containing business-critical application instances in private subnets across two Availability Zones (us-east-1a and us-east-1b). Account B hosts vpc-shared-dns (10.200.0.0/16) containing a Route 53 Private Hosted Zone (PHZ) app.corp.internal. Account B also contains vpc-egress-inspect (10.250.0.0/16), which handles outbound traffic via a cluster of firewalls. All VPCs are interconnected using an AWS Transit Gateway (tgw-east-hub). The application instances must resolve domain names hosted in app.corp.internal, and all outbound internet traffic must be inspected by the firewalls in vpc-egress-inspect. The network architecture must be highly resilient, cost-effective, and avoid any single points of failure. Which two configurations should the solutions architect implement to establish connectivity and name resolution while meeting these requirements?

  1. Deploy one NAT Gateway in a public subnet in us-east-1a and another NAT Gateway in a public subnet in us-east-1b within vpc-egress-inspect. Configure the subnet route tables in vpc-app-prod to route 0.0.0.0/0 traffic to tgw-east-hub, and configure the Transit Gateway route tables to route all outbound traffic to the vpc-egress-inspect attachment.Answer
  2. B
    Deploy a single NAT Gateway in a public subnet within us-east-1a in vpc-egress-inspect to minimize running costs. Configure the private subnets in both Availability Zones of vpc-app-prod to route egress traffic through tgw-east-hub to this single NAT Gateway.
  3. Associate the Route 53 Private Hosted Zone app.corp.internal directly with both vpc-shared-dns and vpc-app-prod by creating VPC associations, enabling direct internal DNS resolution within both VPCs.Answer
  4. D
    Establish an AWS Direct Connect Gateway (DXGW) and associate it with the Virtual Private Gateways of both vpc-app-prod and vpc-egress-inspect. Configure the routing tables to route inter-VPC traffic and egress traffic transitively through the DXGW.
  5. E
    Deploy Route 53 Resolver inbound endpoints in vpc-shared-dns and outbound endpoints in vpc-app-prod. Create a Route 53 Resolver forwarding rule for app.corp.internal that targets the inbound endpoints to resolve DNS queries across the VPCs.

Answer

Deploy redundant NAT Gateways across Availability Zones in the egress VPC and configure routing via the Transit Gateway, while associating the Route 53 Private Hosted Zone directly with all required VPCs.
Deploying redundant NAT Gateways across multiple Availability Zones in the egress VPC provides highly available internet egress. Routing egress traffic via the Transit Gateway centralized route table satisfies the inspection and egress requirements. Direct VPC association of the Route 53 Private Hosted Zone (PHZ) with the application VPC provides the most direct and cost-effective DNS resolution strategy.

Step-by-Step Solution

1
Analyze high-availability egress requirements.
Identified that deploying a NAT Gateway in only one Availability Zone creates a single point of failure. Deploying one NAT Gateway in us-east-1a and one in us-east-1b ensures egress redundancy.
Production architectures require NAT Gateway redundancy across active Availability Zones to maintain egress connectivity during a zone outage.
2
Determine the optimal routing path for egress traffic through Transit Gateway.
Configure subnet route tables in vpc-app-prod to direct 0.0.0.0/0 to the Transit Gateway, and configure the Transit Gateway's route tables to route that traffic to the vpc-egress-inspect attachment.
Transit Gateway allows centralizing egress traffic from spoke VPCs to a central egress/security VPC.
3
Analyze DNS resolution requirements for the Private Hosted Zone.
Associate the Private Hosted Zone app.corp.internal directly with both vpc-shared-dns and vpc-app-prod.
Cross-account Private Hosted Zone association allows resources in consumer VPCs to resolve internal names natively and cost-effectively without deploying Route 53 Resolver endpoints.

Key Concept

Multi-AZ NAT Gateway deployment for resilient egress combined with cross-account Route 53 Private Hosted Zone association.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic