Examkin

Question

Difficulty: HardHybrid and Multi-Account Network Connectivity Design

A multinational company is designing a hybrid network architecture to connect two on-premises data centers (located in New York and London) to its AWS multi-account environment. The AWS environment consists of 3030 VPCs distributed across the `us-east-1` and `eu-west-2` regions.

The connectivity requirements are:
- Primary connectivity must use AWS Direct Connect (DX) links with a minimum bandwidth of 10 Gbps10\text{ Gbps} at each location.
- AWS Site-to-Site VPN connections over the internet must serve as the backup path.
- The New York data center must primarily access resources in `us-east-1`, and the London data center must primarily access resources in `eu-west-2`.
- Direct communication between the New York and London data centers through the AWS network must be prevented for regulatory compliance.
- Outbound internet access from the VPCs must be centralized through a shared services VPC in each region, ensuring high availability and resilience against Availability Zone (AZ) failures.

Which TWO steps should the Solutions Architect take to configure the routing and connectivity to meet these requirements?

  1. Deploy AWS Transit Gateway in both regions, peered together, and associate them with a Direct Connect Gateway. Use separate Transit Gateway route tables for VPC attachments and hybrid attachments to prevent routing traffic between the two on-premises data centers.Answer
  2. Deploy redundant NAT Gateways across multiple Availability Zones in a central egress VPC in each region, and configure the route tables of the spoke VPCs to route outbound 0.0.0.0/00.0.0.0/0 traffic through the Transit Gateway to the local NAT Gateways.Answer
  3. C
    Connect the spoke VPCs in both regions directly to a single shared Direct Connect Gateway (DXGW) using private virtual interfaces (VIFs) to establish routing between the VPCs and the data centers.
  4. D
    Create a Route 53 Private Hosted Zone (PHZ) for internal service resolution and associate the PHZ directly with the Transit Gateway attachments in both regions to enable cross-account DNS resolution.
  5. E
    Centralize internet egress by deploying a single NAT Gateway in the shared services VPC of the primary region, and route all outbound internet traffic from both regions to this NAT Gateway.

Answer

Deploy AWS Transit Gateway in both regions, peered together, and associate them with a Direct Connect Gateway. Use separate Transit Gateway route tables for VPC attachments and hybrid attachments to prevent routing traffic between the two on-premises data centers. Deploy redundant NAT Gateways across multiple Availability Zones in a central egress VPC in each region, and configure the route tables of the spoke VPCs to route outbound 0.0.0.0/00.0.0.0/0 traffic through the Transit Gateway to the local NAT Gateways.
The correct solution involves deploying AWS Transit Gateways in both regions, peered together, to support the multi-region, multi-account scale. By associating them with a Direct Connect Gateway and setting up isolated Transit Gateway route tables (associating the hybrid attachments with a route table that does not propagate routes to the other data center), we prevent transitive communication between the New York and London data centers. Additionally, deploying redundant NAT Gateways across multiple Availability Zones in a centralized egress VPC in each region provides a highly available egress path that is resilient to Availability Zone failures.

Step-by-Step Solution

1
Configure Transit Gateway and Direct Connect Gateway associations for hybrid connectivity.
Each region has an AWS Transit Gateway connected via a Direct Connect Gateway using Transit Virtual Interfaces (transit VIFs), enabling high-bandwidth hybrid communication.
Direct Connect Gateway with Transit Gateways is required to connect multiple VPCs (beyond the 1010-VPC limit of a Direct Connect Gateway with private VIFs) across multiple accounts and regions.
2
Implement Transit Gateway route table isolation to prevent inter-data-center transitive routing.
A 'VPC Route Table' associates with VPC attachments and propagates routes to the on-premises networks. A separate 'Hybrid Route Table' associates with the DXGW and VPN attachments, propagates VPC routes, but does not propagate the other hybrid attachments' routes.
Separate route tables isolate the on-premises attachments from each other, preventing traffic from New York routing to London through AWS.
3
Design and implement highly available centralized egress.
Centralized egress VPCs are deployed in both regions containing redundant NAT Gateways across multiple Availability Zones. Route tables in spoke VPCs point 0.0.0.0/00.0.0.0/0 traffic to their local Transit Gateway, which forwards it to the centralized NAT Gateways.
This guarantees that outbound internet traffic is secure, centralized, and resilient against single Availability Zone outages without introducing cross-region latency.

Key Concept

Multi-region hybrid network design with Transit Gateway routing isolation and high-availability centralized egress.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic