An enterprise is designing a highly available, multi-account network architecture in the `us-east-1` Region. The architecture consists of one Shared Services VPC in Account A and three spoke application VPCs in Account B. An AWS Transit Gateway in Account A is used to interconnect all VPCs. The spoke VPCs require private DNS resolution of the `corp.internal` domain, which is managed in a Route 53 Private Hosted Zone in Account A. Additionally, all spoke VPCs must route outbound internet traffic through a centralized set of NAT Gateways in the Shared Services VPC. Spoke-to-spoke network communication must be blocked, but spoke-to-shared communication must be allowed. The design must be resilient to Availability Zone outages and minimize operational overhead.
Which TWO steps should the solutions architect take to meet these requirements? (Select TWO.)
- AConfigure the spoke VPCs to route all DNS traffic on port directly to the Transit Gateway IP address, which will automatically forward the queries to the Shared Services VPC without any Route 53 Private Hosted Zone association or Route 53 Resolver endpoints.
- In the Shared Services VPC, deploy a NAT Gateway in a public subnet in each Availability Zone. In the private subnets hosting the Transit Gateway attachments, create Availability Zone-specific route tables that route traffic to the NAT Gateway located in the corresponding Availability Zone.Answer
- CTo minimize costs, deploy a single NAT Gateway in a public subnet of one Availability Zone in the Shared Services VPC, and configure all private subnet route tables across all Availability Zones to route outbound traffic to this single NAT Gateway.
- In Account A, authorize the association of the spoke VPCs with the `corp.internal` Private Hosted Zone. In Account B, associate each spoke VPC with the `corp.internal` Private Hosted Zone using the AWS CLI or Route 53 API.Answer
- EAssociate all spoke VPCs and the Shared Services VPC with a single Transit Gateway route table, and attach an AWS network security group directly to the Transit Gateway resource to block spoke-to-spoke traffic while permitting spoke-to-shared traffic.