Examkin

Question

Difficulty: EasyNetworking and Connectivity Design

An enterprise is designing a new VPC named `Production-VPC` in the `us-east-1` Region to host a web application across two Availability Zones, `us-east-1a` and `us-east-1b`. EC2 instances in the private subnets of both zones require outbound internet access to download software updates, but they must not be directly reachable from the internet. The solution must be highly resilient to Availability Zone outages and minimize operational overhead.

Which of the following configuration steps should the Solutions Architect perform to meet these requirements? (Select TWO.)

  1. Deploy a NAT Gateway named `nat-gw-az1` in a public subnet in `us-east-1a`, and configure the route table of the private subnet in `us-east-1a` with a route of `0.0.0.0/0` pointing to `nat-gw-az1`.Answer
  2. Deploy a NAT Gateway named `nat-gw-az2` in a public subnet in `us-east-1b`, and configure the route table of the private subnet in `us-east-1b` with a route of `0.0.0.0/0` pointing to `nat-gw-az2`.Answer
  3. C
    Deploy a single NAT Gateway named `nat-gw-central` in a public subnet in `us-east-1a`, and configure the route tables of the private subnets in both `us-east-1a` and `us-east-1b` to point outbound traffic to `nat-gw-central`.
  4. D
    Deploy an AWS Transit Gateway named `tgw-egress`, configure it to route all outbound internet traffic from both private subnets directly to the internet, and associate the Transit Gateway with an Internet Gateway.
  5. E
    Configure a Route 53 Private Hosted Zone named `internal.updates` to resolve external repositories, and configure the private subnets' route tables to point outbound traffic directly to the Route 53 Resolver.

Answer

Deploy two independent NAT Gateways (one in each Availability Zone) and configure the route tables of each private subnet to point outbound traffic to the local NAT Gateway in their respective Availability Zone.
The correct solution involves deploying a NAT Gateway in a public subnet in each Availability Zone and pointing the default route (0.0.0.0/0) of each private subnet to its local NAT Gateway. This ensures high availability because if one Availability Zone experiences an outage, outbound connectivity for the other Availability Zone is completely unaffected, satisfying the requirement to be highly resilient to AZ outages with minimal operational overhead.

Step-by-Step Solution

1
Analyze the requirements for high availability and zero direct inbound access.
Identified the need for NAT devices to translate private IP addresses for outbound-only internet communication without allowing direct inbound connections.
NAT Gateways are AWS-managed services that meet these criteria with low operational overhead.
2
Analyze the resiliency requirement against Availability Zone outages.
Determined that a NAT Gateway is redundant within a single zone but is a single point of failure if that zone fails.
To ensure AZ-resiliency, a separate NAT Gateway must be deployed in each of the active Availability Zones.
3
Configure the VPC route tables for the private subnets.
Updated the route table of the private subnet in the first Availability Zone to point its default route (0.0.0.0/0) to the NAT Gateway in the same zone, and repeated the configuration for the second Availability Zone.
This isolates the failure domain of each zone's outbound path to that zone itself.

Key Concept

Designing highly available outbound VPC internet connectivity using multi-AZ NAT Gateways to avoid single points of failure.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic