Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

A gaming platform is launching a new multiplayer architecture in the `us-west-2` Region. The platform architecture requires two application VPCs (`vpc-game-prod-a` and `vpc-game-prod-b`) and one administrative management VPC (`vpc-mgmt-prod`). The management VPC hosts a Route 53 Private Hosted Zone (PHZ) `backend.gaming.internal` containing service endpoints that the application VPCs must resolve privately. The application VPCs must also access the internet for software updates through a centralized egress VPC (`vpc-egress-prod`) to minimize costs, but the egress path must survive a single Availability Zone (AZ) outage without disrupting egress traffic from unaffected AZs. Additionally, the game VPCs and management VPC must communicate with an on-premises graphics rendering cluster via a 10 Gbps AWS Direct Connect connection. Which TWO options should the Solutions Architect implement to satisfy these networking and DNS requirements?

  1. Deploy an AWS Transit Gateway (`tgw-main`) and attach `vpc-game-prod-a`, `vpc-game-prod-b`, and `vpc-egress-prod`. In `vpc-egress-prod`, deploy a NAT Gateway in Availability Zone `us-west-2a` and another in `us-west-2b`. In the subnet route tables for the Transit Gateway attachment in `vpc-egress-prod`, configure the route for `0.0.0.0/0` to point to the NAT Gateway in the respective Availability Zone. Configure the Transit Gateway route table associated with the game VPCs to route `0.0.0.0/0` to the `vpc-egress-prod` attachment.Answer
  2. In the management account, create a cross-account VPC association authorization for `vpc-game-prod-a` and `vpc-game-prod-b` to the Private Hosted Zone `backend.gaming.internal`. In each game account, associate the respective game VPC with the Private Hosted Zone using the AWS CLI or API.Answer
  3. C
    Deploy an AWS Transit Gateway (`tgw-main`) and attach `vpc-game-prod-a`, `vpc-game-prod-b`, and `vpc-egress-prod`. In `vpc-egress-prod`, deploy a single NAT Gateway in Availability Zone `us-west-2a`. Configure the Transit Gateway route table associated with the game VPCs to route `0.0.0.0/0` to the `vpc-egress-prod` attachment, and route all egress traffic in `vpc-egress-prod` to this single NAT Gateway.
  4. D
    Create a Route 53 Resolver Inbound Endpoint in `vpc-mgmt-prod` and a Route 53 Resolver Outbound Endpoint in each game VPC. Create a Route 53 Resolver rule in the management account to forward queries for `backend.gaming.internal` to the Outbound Endpoints in the game VPCs, and share the rule across the AWS Organization using AWS Resource Access Manager.
  5. E
    Create an AWS Direct Connect Gateway (`dxgw-main`) and associate it directly with the Virtual Private Gateways of `vpc-game-prod-a`, `vpc-game-prod-b`, and `vpc-mgmt-prod`. Configure the Direct Connect Gateway to route traffic transitively between these VPCs and the on-premises graphics rendering cluster.

Answer

Deploy an AWS Transit Gateway and establish a centralized egress VPC with redundant NAT Gateways configured with AZ-specific routing, combined with cross-account Private Hosted Zone VPC associations.
Centralizing outbound egress traffic using Transit Gateway requires deploying a NAT Gateway in each active Availability Zone of the egress VPC and ensuring the subnet route tables route traffic to the NAT Gateway in the same zone. This maintains AZ isolation and resilience. Sharing a Route 53 Private Hosted Zone across AWS accounts is most efficiently achieved by creating a cross-account VPC association authorization in the hosted zone owner's account and executing the association in the client VPCs' accounts.

Step-by-Step Solution

1
Analyze egress requirements
Identified that a single NAT Gateway violates the high availability requirement across Availability Zones. Redundant NAT Gateways must be deployed in each active Availability Zone within the egress VPC, and subnets must route traffic based on their respective zone.
Ensures that a failure in one Availability Zone does not impact outbound traffic originating from or routed through other zones.
2
Analyze private DNS requirements
Determined that Route 53 Private Hosted Zones can be shared cross-account by generating a VPC association authorization from the owner account and accepting it from the consumer accounts.
Avoids the unnecessary deployment costs and management overhead of Route 53 Resolver Inbound and Outbound Endpoints for simple internal resolution.
3
Verify transitive routing constraints
Confirmed that Direct Connect Gateway alone does not support transitive routing between associated virtual private gateways. AWS Transit Gateway must be used for transit routing.
Adheres to AWS architectural constraints regarding the non-transitive nature of Direct Connect Gateway.

Key Concept

Designing highly resilient, cost-effective centralized egress topologies using AWS Transit Gateway and managing cross-account private DNS resolution without adding operational complexity.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic