Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new hybrid network architecture to connect three spoke VPCs (`vpc-app-prod`, `vpc-web-prod`, and `vpc-db-prod`) in the `us-west-2` Region to an on-premises data center. The design must satisfy the following requirements:
1. Provide outbound internet access for all spoke VPCs that is both highly available and cost-effective.
2. Establish transitive hybrid connectivity between all spoke VPCs and the on-premises network.
3. Enable private DNS resolution for an internal domain (`aws.corp.internal`) hosted in a Route 53 Private Hosted Zone (PHZ) across all three spoke VPCs.

Which design should the solutions architect choose to meet these requirements?

  1. Deploy an AWS Transit Gateway. Attach the three spoke VPCs and a centralized egress VPC containing a NAT Gateway in each Availability Zone to the Transit Gateway. Connect the Transit Gateway to an AWS Direct Connect Gateway for on-premises connectivity. Associate the Route 53 Private Hosted Zone `aws.corp.internal` directly with the three spoke VPCs.Answer
  2. B
    Deploy an AWS Transit Gateway. Attach the three spoke VPCs and a centralized egress VPC containing a single NAT Gateway in one Availability Zone to the Transit Gateway. Connect the Transit Gateway to an AWS Direct Connect Gateway for on-premises connectivity. Associate the Route 53 Private Hosted Zone `aws.corp.internal` directly with the three spoke VPCs.
  3. C
    Attach the three spoke VPCs directly to an AWS Direct Connect Gateway using Virtual Private Gateways. Deploy a centralized egress VPC with a NAT Gateway in each Availability Zone. Associate the Route 53 Private Hosted Zone `aws.corp.internal` directly with the three spoke VPCs.
  4. D
    Deploy an AWS Transit Gateway. Attach the three spoke VPCs and a centralized egress VPC containing a NAT Gateway in each Availability Zone to the Transit Gateway. Connect the Transit Gateway to an AWS Direct Connect Gateway for on-premises connectivity. Configure Route 53 Resolver outbound and inbound endpoints in each VPC to resolve the domain names without associating the Private Hosted Zone.

Answer

Deploy an AWS Transit Gateway, attach the spoke VPCs and a centralized egress VPC containing redundant NAT Gateways (one per Availability Zone) to the Transit Gateway, connect the Transit Gateway to an AWS Direct Connect Gateway, and associate the Route 53 Private Hosted Zone directly with all three spoke VPCs.
The correct design uses AWS Transit Gateway to enable transitive connectivity to the on-premises network via a Direct Connect Gateway. It routes outbound internet traffic through a centralized egress VPC that contains a NAT Gateway in each Availability Zone, ensuring high availability. Private DNS resolution is achieved simply and cost-effectively by directly associating the Route 53 Private Hosted Zone with the spoke VPCs.

Step-by-Step Solution

1
Select the hub-and-spoke component for transitive routing.
AWS Transit Gateway is chosen to connect the three spoke VPCs and the egress VPC, enabling centralized traffic flow and hybrid routing.
Transit Gateway acts as a cloud router that scales network connections transitively, allowing all spoke VPCs to share resources like Direct Connect and egress VPCs.
2
Design the outbound internet access path with redundancy.
Deploy NAT Gateways in multiple Availability Zones within the centralized egress VPC.
This configuration avoids a single point of failure and ensures that outbound internet traffic is highly available across Availability Zone outages.
3
Configure private DNS resolution across all spoke VPCs.
Associate the Route 53 Private Hosted Zone directly with all three spoke VPCs (`vpc-app-prod`, `vpc-web-prod`, and `vpc-db-prod`).
Direct VPC association allows instances in all spoke VPCs to resolve domain names in the Private Hosted Zone privately without the added cost and complexity of Route 53 Resolver endpoints.

Key Concept

Centralized egress design with redundant NAT Gateways combined with Transit Gateway and multi-VPC Private Hosted Zone association.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic