Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A company is designing the network architecture for a new AWS deployment in the `us-west-2` Region. The deployment consists of three VPCs: `vpc-app-prod`, `vpc-app-test`, and `vpc-shared-services`. An on-premises data center is connected to AWS via an AWS Direct Connect connection. The networking requirements are:
1. Enable routing between the on-premises data center and all three VPCs.
2. Enable direct routing between `vpc-app-prod` and `vpc-shared-services`.
3. Provide redundant outbound internet connectivity for resources in private subnets across multiple Availability Zones in `vpc-app-prod` and `vpc-app-test`.
4. Allow both the on-premises servers and resources in all three VPCs to resolve DNS hostnames within a Route 53 Private Hosted Zone (PHZ) named `cloud.internal`.

Which of the following designs meets these requirements with the least operational overhead?

  1. Deploy an AWS Transit Gateway (TGW) and attach all three VPCs. Associate an AWS Direct Connect Gateway (DXGW) with the TGW to enable on-premises connectivity. In `vpc-shared-services`, deploy a NAT Gateway in each public subnet across multiple Availability Zones, and configure route tables in the spoke VPCs to direct internet traffic through the TGW. Create a Route 53 Resolver Inbound Endpoint in `vpc-shared-services` across multiple Availability Zones, associate the Private Hosted Zone `cloud.internal` with all three VPCs, and configure the on-premises DNS servers to forward queries for `cloud.internal` to the inbound endpoint.Answer
  2. B
    Deploy an AWS Transit Gateway (TGW) and attach all three VPCs. Associate an AWS Direct Connect Gateway (DXGW) with the TGW to enable on-premises connectivity. In `vpc-shared-services`, deploy a single NAT Gateway in a single Availability Zone to minimize ongoing hourly costs, and configure route tables in the spoke VPCs to direct internet traffic through the TGW. Create a Route 53 Resolver Inbound Endpoint in `vpc-shared-services` across multiple Availability Zones, associate the Private Hosted Zone `cloud.internal` with all three VPCs, and configure the on-premises DNS servers to forward queries for `cloud.internal` to the inbound endpoint.
  3. C
    Associate an AWS Direct Connect Gateway (DXGW) directly with Virtual Private Gateways (VGWs) attached to each of the three VPCs. In each VPC, deploy a NAT Gateway in each public subnet across multiple Availability Zones for outbound internet access. Create a Route 53 Resolver Inbound Endpoint in `vpc-shared-services` across multiple Availability Zones, associate the Private Hosted Zone `cloud.internal` with all three VPCs, and configure the on-premises DNS servers to forward queries for `cloud.internal` to the inbound endpoint.
  4. D
    Deploy an AWS Transit Gateway (TGW) and attach all three VPCs. Associate an AWS Direct Connect Gateway (DXGW) with the TGW to enable on-premises connectivity. In `vpc-shared-services`, deploy a NAT Gateway in each public subnet across multiple Availability Zones, and configure route tables in the spoke VPCs to direct internet traffic through the TGW. Create a Route 53 Resolver Inbound Endpoint in `vpc-shared-services` across multiple Availability Zones, associate the Private Hosted Zone `cloud.internal` only with `vpc-shared-services`, and configure the on-premises DNS servers to forward queries for `cloud.internal` to the inbound endpoint.

Answer

Deploy an AWS Transit Gateway connected to a Direct Connect Gateway, use multiple NAT Gateways across Availability Zones in the shared services VPC, and associate the Private Hosted Zone with all three VPCs while using a multi-AZ Route 53 Resolver Inbound Endpoint.
The correct design uses an AWS Transit Gateway (TGW) to route traffic transitively between the on-premises network (via a Direct Connect Gateway) and all three VPCs, while also allowing direct communication between the application and shared services VPCs. To ensure high availability and redundancy for outbound egress, it deploys a NAT Gateway in each Availability Zone within the shared services VPC. Finally, it ensures complete internal name resolution by creating a multi-AZ Route 53 Resolver Inbound Endpoint and associating the Private Hosted Zone with all three VPCs.

Step-by-Step Solution

1
Determine the routing mechanism that supports transitive routing between the VPCs and the on-premises network, as well as inter-VPC traffic.
An AWS Transit Gateway (TGW) associated with an AWS Direct Connect Gateway (DXGW) is identified as the solution because it supports transitive routing, whereas DXGW with VGWs does not allow inter-VPC traffic.
To satisfy the requirement of direct routing between `vpc-app-prod` and `vpc-shared-services` alongside on-premises connectivity.
2
Evaluate the configuration of the NAT Gateways for outbound internet connectivity.
Deploying a NAT Gateway in each Availability Zone (AZ) in `vpc-shared-services` ensures there is no single point of failure.
The requirement specifies redundant outbound internet connectivity across multiple AZs.
3
Configure private DNS resolution for both on-premises servers and the three AWS VPCs.
Associate the Route 53 Private Hosted Zone (PHZ) `cloud.internal` with all three VPCs and configure Route 53 Resolver Inbound Endpoints in `vpc-shared-services` across multiple AZs.
Failing to associate the PHZ with the spoke VPCs will prevent resources in those VPCs from resolving the hostnames, even if they can route to the inbound endpoint.

Key Concept

AWS Transit Gateway transitive routing, centralized NAT Gateway redundancy, and cross-account Route 53 Private Hosted Zone association.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic