Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

A retail company is expanding its AWS footprint across a multi-account environment in the `eu-west-1` and `eu-central-1` Regions. The architecture consists of 4040 spoke VPCs spread across both regions, all managed under a AWS Organizations structure. The company must establish highly resilient hybrid connectivity to its on-premises corporate offices in Dublin and Frankfurt.

The connectivity requirements are as follows:
- Traffic from the Dublin corporate office must primarily use a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection to `eu-west-1`, with a backup Site-to-Site VPN connection.
- Traffic from the Frankfurt corporate office must primarily use a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection to `eu-central-1`, with a backup Site-to-Site VPN connection.
- Inter-VPC traffic across the two regions must be routed securely through peered AWS Transit Gateways (TGWs) located in each region.
- Spoke VPCs in both regions must resolve internal domain names hosted in a centralized Route 53 Private Hosted Zone (PHZ) created in a shared services AWS account.

Which TWO configurations must a Solutions Architect implement to meet these requirements with high availability and minimal administrative overhead?

  1. A
    Create a full mesh of VPC Peering connections across all 4040 spoke VPCs to handle cross-region and inter-VPC traffic. Deploy a Direct Connect Gateway in each region, establish Direct Connect Gateway peering between them, and route all hybrid traffic through these peered gateways.
  2. Attach a Transit Virtual Interface (Transit VIF) from each Direct Connect connection to a single Direct Connect Gateway, and associate this Direct Connect Gateway with the Transit Gateways in both regions. Configure AWS Site-to-Site VPN connections from each corporate office to the local Transit Gateway as a backup path.Answer
  3. C
    Deploy Route 53 Resolver outbound endpoints in each spoke VPC. In the shared services account, create a Route 53 Resolver forwarding rule for the private hosted zone domain, and share it with the spoke accounts using AWS Resource Access Manager (RAM) to redirect queries to the spoke VPCs.
  4. Authorize the cross-account association of the Route 53 Private Hosted Zone in the shared services account with the spoke VPCs in both regions using the AWS CLI or SDK, and then complete the association in each spoke account.Answer
  5. E
    Deploy a single NAT Gateway in a single public subnet in each spoke VPC, and configure the route tables of all private subnets in that VPC to route outbound internet traffic through this NAT Gateway to minimize cost.

Answer

The correct configurations are to associate the Transit Gateways in both regions with a single Direct Connect Gateway using Transit VIFs with backup Site-to-Site VPNs, and to perform cross-account Private Hosted Zone associations for all spoke VPCs.
To build a highly available and scalable hybrid network architecture, we associate the Transit Gateways in both regions with a single Direct Connect Gateway. Using Transit VIFs allows traffic to flow over the Direct Connect connections to both regions. Backup Site-to-Site VPNs terminate directly on the Transit Gateways. For DNS resolution, authorizing and completing the cross-account association of the Private Hosted Zone ensures spoke VPCs can resolve domains natively without the overhead of Route 53 Resolver endpoints.

Step-by-Step Solution

1
Configure hybrid connectivity using a single Direct Connect Gateway and Transit VIFs.
A single Direct Connect Gateway is associated with the Transit Gateways in both regions, enabling hybrid traffic routing between on-premises and all spoke VPCs.
Direct Connect Gateway supports transitive routing between on-premises and multiple regional Transit Gateways, simplifying hybrid routing.
2
Establish backup VPN paths terminating on the regional Transit Gateways.
Site-to-Site VPN connections from Dublin and Frankfurt offices terminate on their respective regional Transit Gateways.
Provides high availability and automatic failover from the Direct Connect path using BGP dynamic routing.
3
Associate the Route 53 Private Hosted Zone across accounts.
The Private Hosted Zone in the shared services account is associated with all spoke VPCs in the spoke accounts.
Allows spoke VPCs to resolve internal domain names natively without the cost and management overhead of Route 53 Resolver endpoints.

Key Concept

Hybrid network connectivity with multi-region Transit Gateways, Direct Connect Gateways, and cross-account DNS resolution using Route 53 Private Hosted Zones.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic