Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

FinTrace Analytics is modernizing its transaction-matching audit engine by migrating it from on-premises virtualized environments to AWS. The target architecture requires the ingestion and preprocessing service to be deployed on Amazon ECS using the AWS Fargate launch type across three Availability Zones in a private subnet in VPC-A. This service needs to communicate privately with a transaction-matching engine, also running on Amazon ECS with the AWS Fargate launch type across three Availability Zones in a private subnet in VPC-B.

Both VPCs are connected using an AWS Transit Gateway, with routing properly configured between the subnets. The matching engine must be resolvable via the private domain name engine.fintrace.local from the preprocessing tasks in VPC-A. The design must ensure high availability, zero exposure of the matching engine to the public internet, and minimal operational overhead.

Which of the following configurations should a Solutions Architect recommend?

  1. A
    Deploy the matching engine tasks using the bridge network mode to enable dynamic port mapping, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB.
  2. B
    Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated only with VPC-B containing an alias record pointing to the internal ALB, relying on Transit Gateway to propagate Route 53 DNS resolution across VPC boundaries.
  3. Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB.Answer
  4. D
    Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB, while routing all VPC-B outbound traffic through a single NAT Gateway in one Availability Zone.

Answer

Deploy the matching engine tasks using the awsvpc network mode, register them with an internal Application Load Balancer (ALB) in VPC-B, and create a Route 53 Private Hosted Zone for engine.fintrace.local associated with both VPC-A and VPC-B containing an alias record pointing to the internal ALB.
Deploying the tasks in awsvpc network mode satisfies Fargate's networking requirement. The internal ALB provides highly available distribution of traffic without exposing the backend to the public internet. Associating the Route 53 Private Hosted Zone with both VPCs ensures that client tasks in VPC-A can resolve the private domain name directly to the internal ALB in VPC-B across the Transit Gateway connection.

Step-by-Step Solution

1
Select the correct container network mode for Fargate.
Use awsvpc network mode for the ECS tasks.
AWS Fargate does not support host or bridge networking; tasks must run in awsvpc mode, giving each task its own elastic network interface (ENI).
2
Expose the backend container tasks within the VPC privately and highly available.
Register the tasks with an internal Application Load Balancer (ALB) in VPC-B.
An internal ALB allows load balancing across tasks in multiple Availability Zones within the private subnets without exposing them to the internet.
3
Configure the DNS resolution across VPC boundaries.
Create a Route 53 Private Hosted Zone and associate it with both VPC-A and VPC-B.
A Private Hosted Zone must be associated with any VPC from which you want to resolve records. Transit Gateway connects network pathways but does not propagate DNS queries across VPCs without explicit association.

Key Concept

Cross-VPC private container networking and name resolution
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic