Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a highly resilient multi-account network architecture in the ap-southeast-1 Region. The design includes two application VPCs: vpc-app-hr in AWS Account A and vpc-app-finance in AWS Account B. A third VPC, vpc-shared-services in AWS Account C, hosts a centralized repository and a Route 53 Private Hosted Zone (PHZ) named services.internal.

An AWS Transit Gateway named tgw-hub in Account C connects all three VPCs. The application VPCs must have private DNS resolution for services.internal and require highly available, cost-effective outbound internet access for downloading patches. To centralize egress control, the security team mandates using NAT Gateways deployed in vpc-shared-services.

Which combination of configurations will meet these requirements while ensuring resilience to Availability Zone (AZ) failures? (Select TWO.)

  1. Deploy one NAT Gateway in each of two Availability Zones within the public subnets of vpc-shared-services. Configure the subnet route tables in the private subnets of vpc-shared-services to route outbound traffic through their respective zone's NAT Gateway. Set a route for 0.0.0.0/0 in the application VPC subnet route tables pointing to tgw-hub.Answer
  2. From AWS Account C, authorize the association of services.internal with vpc-app-hr and vpc-app-finance using the Route 53 API. Then, from Accounts A and B, accept the association requests using the AWS CLI or SDK to link the application VPCs to the Private Hosted Zone.Answer
  3. C
    Deploy a single NAT Gateway in the ap-southeast-1a subnet of vpc-shared-services to minimize cost. In the private subnet route tables of vpc-shared-services across all Availability Zones, configure a route pointing all 0.0.0.0/0 traffic to this single NAT Gateway.
  4. D
    Associate the services.internal Private Hosted Zone with vpc-shared-services only, and enable DNS support on the Transit Gateway attachments to transitively resolve queries from vpc-app-hr and vpc-app-finance.
  5. E
    In the Transit Gateway route table associated with the application VPCs, configure a static route for 0.0.0.0/0 targeting the NAT Gateway resource identifiers located in the public subnets of vpc-shared-services.

Answer

The correct configurations are to deploy one NAT Gateway in each of the two Availability Zones within the public subnets of the shared services VPC, routing traffic to them via the Transit Gateway, and to perform cross-account Private Hosted Zone association by authorizing the association from the owner account and accepting it from the application accounts.
The solution requires high availability and cross-account DNS resolution. Deploying a NAT Gateway per Availability Zone in the shared services VPC ensures zone redundancy, preventing single-AZ failures from causing outage cascades. Cross-account Private Hosted Zone association requires creating an authorization from the hosting account (Account C) and then creating the association from the consumer accounts (Accounts A and B). This resolves DNS queries natively and cost-effectively.

Step-by-Step Solution

1
Configure the cross-account Private Hosted Zone association.
Generate association authorizations from Account C for vpc-app-hr and vpc-app-finance, then associate the VPCs in Accounts A and B.
Allows resource DNS resolution of services.internal in the application VPCs without incurring endpoint charges.
2
Deploy zone-redundant NAT Gateways.
Two NAT Gateways are created in separate Availability Zones in the public subnets of the shared services VPC.
Ensures that internet egress remains functional even during a single Availability Zone outage.
3
Configure Transit Gateway and subnet routing tables.
Application VPC subnet route tables direct 0.0.0.0/0 to the Transit Gateway, which routes the traffic to the shared services VPC attachment, where local private subnet route tables forward the traffic to their respective zone's NAT Gateway.
Enforces centralized egress controls through the shared security boundaries.

Key Concept

Multi-account private DNS resolution and highly available centralized internet egress architecture using AWS Transit Gateway and zone-redundant NAT Gateways.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic