Examkin

Question

Difficulty: HardOptimizing Network Performance and Latency

A financial services provider hosts a core trading application in the us-east-1 Region across three VPCs: TradeExecution, AccountLedger, and MarketData. The VPCs must exchange high-throughput, low-latency messages with each other, and also communicate with an on-premises datacenter over a 10 Gbps AWS Direct Connect connection. The application instances run in private subnets across multiple Availability Zones (AZs).

During high-volume events, the provider experiences several issues:
1. High packet loss and latency during sudden, massive traffic spikes on the front-end application layer, which runs behind Application Load Balancers (ALBs).
2. DNS resolution failures when on-premises systems attempt to resolve the private DNS names of the services hosted within the Route 53 Private Hosted Zone (PHZ).
3. Outbound security updates and third-party API calls fail or incur high latency when an AZ hosting the primary NAT Gateway experiences network degradation.
4. Latency-sensitive inter-VPC communication is currently routed via an on-premises firewall, causing a massive latency penalty.

Which set of actions should the solutions architect implement to optimize network performance, minimize latency, and resolve these issues?

  1. A
    Connect all three VPCs directly to the Direct Connect Gateway using private virtual interfaces to allow direct inter-VPC transitive routing and on-premises connectivity. Deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC and associate the Private Hosted Zone with all VPCs. Deploy redundant NAT Gateways in each Availability Zone for each VPC. Replace the front-end Application Load Balancers with Network Load Balancers.
  2. B
    Establish an AWS Transit Gateway to route inter-VPC and on-premises traffic via a Direct Connect Gateway. Deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC to handle DNS requests from on-premises, but omit associating the Private Hosted Zone with the other application VPCs to avoid DNS loop configurations. Deploy redundant NAT Gateways in each Availability Zone for each VPC. Replace the front-end Application Load Balancers with Network Load Balancers.
  3. Establish an AWS Transit Gateway to route inter-VPC and on-premises traffic via a Direct Connect Gateway, enabling high-throughput, low-latency transitive routing. Associate the Route 53 Private Hosted Zone with all three VPCs and deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Deploy redundant NAT Gateways in each Availability Zone for each VPC to keep outbound traffic local to the Availability Zone. Replace the front-end Application Load Balancers with Network Load Balancers.Answer
  4. D
    Establish an AWS Transit Gateway to route inter-VPC and on-premises traffic via a Direct Connect Gateway. Associate the Route 53 Private Hosted Zone with all three VPCs and deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Deploy a single central NAT Gateway in the Shared Services VPC and update the route tables of the other VPCs to route outbound internet traffic through this single gateway to reduce NAT Gateway hourly charges. Replace the front-end Application Load Balancers with Network Load Balancers.

Answer

Establish an AWS Transit Gateway to route inter-VPC and on-premises traffic via a Direct Connect Gateway, enabling high-throughput, low-latency transitive routing. Associate the Route 53 Private Hosted Zone with all three VPCs and deploy Route 53 Resolver Inbound Endpoints in the Shared Services VPC. Deploy redundant NAT Gateways in each Availability Zone for each VPC to keep outbound traffic local to the Availability Zone. Replace the front-end Application Load Balancers with Network Load Balancers.
The correct solution uses AWS Transit Gateway to enable low-latency transitive routing between the VPCs and the on-premises network via a Direct Connect Gateway. It correctly associates the Route 53 Private Hosted Zone with all VPCs and deploys Route 53 Resolver Inbound Endpoints in the Shared Services VPC to allow on-premises systems to resolve internal DNS names. Redundant NAT Gateways deployed in each Availability Zone ensure that outbound traffic does not cross Availability Zones, avoiding latency penalties and removing single points of failure. Finally, replacing the Application Load Balancers with Network Load Balancers ensures the architecture can handle instantaneous traffic spikes without pre-warming.

Step-by-Step Solution

1
Analyze inter-VPC routing requirements
Identify that inter-VPC traffic must bypass the on-premises firewall and that Direct Connect Gateway alone does not support transitive routing between VPCs. AWS Transit Gateway is selected to act as the central hub.
To achieve high-throughput and low-latency inter-VPC and hybrid communications, transitive routing via AWS Transit Gateway is the industry-standard architecture.
2
Address private DNS resolution from on-premises
Determine that a Route 53 Private Hosted Zone must be explicitly associated with each VPC in the network mesh, and Route 53 Resolver Inbound Endpoints must be deployed to receive DNS queries from on-premises DNS forwarders.
Without explicit association of the Private Hosted Zone to all member VPCs, resolution of private DNS names fails outside the hosting VPC.
3
Resolve outbound internet latency and single point of failure
Deploy NAT Gateways in every Availability Zone within each VPC, rather than routing outbound traffic through a single central NAT Gateway.
Cross-AZ traffic to a single NAT Gateway incurs latency fees and creates a single point of failure. Redundant NAT Gateways keep traffic local to the Availability Zone.
4
Address traffic spike handling
Replace Application Load Balancers with Network Load Balancers (NLBs) at the front-end layer.
Application Load Balancers scale gradually and require pre-warming to handle sudden, massive traffic spikes. Network Load Balancers scale instantaneously to millions of requests per second.

Key Concept

Optimizing hybrid and multi-VPC networks using Transit Gateway, localized Route 53 Resolver endpoints, redundant Availability Zone-specific NAT Gateways, and high-performance Network Load Balancers.
Rate this question

Topics

Optimizing Network Performance and Latency