A healthcare enterprise is building a diagnostics imaging platform across multiple AWS acc… — AWS Certified Solutions Architect - Professional

A healthcare enterprise is building a diagnostics imaging platform across multiple AWS accounts in the `us-east-1` region. The architecture contains `vpc-diagnostics-prod` (CIDR $10.100.0.0/16$ ) with EC2 instances processing images in private subnets across two Availability Zones (`us-east-1a` and `us-east-1b`), `vpc-shared-services` (CIDR $10.200.0.0/16$ ) hosting core infrastructure including a Route 53 Private Hosted Zone (PHZ) `imaging.internal`, and `vpc-security-egress` (CIDR $10.250.0.0/16$ ) dedicated to outbound inspection using AWS Network Firewall and NAT Gateways. The corporate on-premises datacenter is connected via AWS Direct Connect (DX) terminating on a Direct Connect Gateway (DXGW) associated with an AWS Transit Gateway (`tgw-us-east-1`). The enterprise requires: (1) Image processing instances in `vpc-diagnostics-prod` must resolve names in `imaging.internal` and the on-premises domain `corp.local`. (2) On-premises servers must be able to resolve names in `imaging.internal`. (3) All outbound internet traffic from `vpc-diagnostics-prod` must be inspected by AWS Network Firewall in `vpc-security-egress` in a manner that tolerates a single Availability Zone outage without losing internet connectivity or violating security requirements. Which TWO network configurations should the solutions architect implement to meet these requirements?

In `vpc-security-egress`, deploy AWS Network Firewall endpoints and NAT Gateways across both Availability Zones. Configure the Transit Gateway route table for `vpc-diagnostics-prod` with a default route ( $0.0.0.0/0$ ) pointing to the Transit Gateway attachment for `vpc-security-egress`. In `vpc-security-egress`, route traffic from the Transit Gateway attachment subnets to the local Network Firewall endpoint, then to the local NAT Gateway, and configure NAT Gateway subnet route tables to route outbound traffic through the Internet Gateway.Answer
Associate the `imaging.internal` Private Hosted Zone with both `vpc-shared-services` and `vpc-diagnostics-prod`. In `vpc-shared-services`, create a Route 53 Resolver Inbound Endpoint and configure on-premises DNS servers to forward queries for `imaging.internal` to its IP addresses. Create a Route 53 Resolver Outbound Endpoint in `vpc-diagnostics-prod` and a Resolver rule that forwards queries for `corp.local` to the on-premises DNS servers over the Direct Connect connection.Answer
C
In `vpc-security-egress`, deploy AWS Network Firewall endpoints in both Availability Zones and a single NAT Gateway in the `us-east-1a` public subnet. Configure the Transit Gateway route table for `vpc-diagnostics-prod` to route all internet-bound traffic through the `vpc-security-egress` attachment, routing all firewall-inspected traffic to the single NAT Gateway to minimize NAT Gateway hourly charges.
D
Associate the `imaging.internal` Private Hosted Zone only with `vpc-shared-services`. Create a Route 53 Resolver Outbound Endpoint in `vpc-diagnostics-prod` and configure a forwarding rule for `imaging.internal` that forwards DNS requests directly to the Route 53 Resolver IP address ( $169.254.169.253$ ) in `vpc-shared-services` via the Transit Gateway connection.
E
Associate the Direct Connect Gateway directly with the Virtual Private Gateways (VGWs) attached to `vpc-diagnostics-prod` and `vpc-shared-services`. Use the Direct Connect Gateway to enable transitive routing and pass DNS queries directly between the on-premises network and the VPCs, bypassing the Transit Gateway for DNS traffic to reduce latency.

Answer

To satisfy all requirements, the solutions architect must deploy redundant AWS Network Firewall endpoints and NAT Gateways across both Availability Zones in the egress VPC and configure Transit Gateway route tables accordingly. For DNS, the solutions architect must associate the private hosted zone with the consumer VPCs, create an Inbound Endpoint for on-premises-to-AWS queries, and create an Outbound Endpoint with a forwarding rule for AWS-to-on-premises queries.

For resilient egress filtering, the correct configurations establish redundant, local-zone processing by routing through local AWS Network Firewall endpoints and local NAT Gateways within each Availability Zone. For hybrid and cross-account DNS resolution, the correct approach involves associating the Route 53 Private Hosted Zone directly with all consumer VPCs, deploying a Route 53 Resolver Inbound Endpoint to allow on-premises systems to resolve AWS records, and deploying a Route 53 Resolver Outbound Endpoint with a forwarding rule to resolve on-premises DNS records.

Step-by-Step Solution

Configure highly available outbound internet inspection by deploying AWS Network Firewall endpoints and NAT Gateways in each Availability Zone within the egress VPC.

Avoids cross-Availability Zone dependencies, ensuring that an outage in one zone does not impact the outbound traffic flow of the other zone.

Meets the high availability requirement and eliminates single points of failure for egress traffic.

Associate the Route 53 Private Hosted Zone directly with all participating VPCs that require name resolution.

Instances in the diagnostics production VPC can resolve records in the shared services private hosted zone locally.

Route 53 Private Hosted Zones cannot be resolved transitively across VPCs without direct association or a resolver endpoint routing architecture.

Set up Route 53 Resolver Inbound and Outbound Endpoints in the appropriate VPCs to bridge DNS resolution between AWS and the on-premises datacenter.

On-premises servers can resolve private AWS DNS names by forwarding queries to the Inbound Endpoint, and AWS workloads can resolve corporate domains by forwarding requests through the Outbound Endpoint.

Allows bidirectional DNS resolution between the on-premises network and AWS over the Direct Connect hybrid link.

Key Concept

Designing highly available, secure hybrid network routing and DNS resolution using AWS Transit Gateway, AWS Network Firewall, NAT Gateways, and Route 53 Resolver endpoints.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic