Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-account AWS environment in the us-east-1 Region. The design features a Central Services VPC (vpc-shared-services) and two application VPCs (vpc-app-a and vpc-app-b), all interconnected via an AWS Transit Gateway (tgw-central). A Route 53 Private Hosted Zone (PHZ) named corp.internal is created in vpc-shared-services. Workloads in all VPCs must be able to resolve DNS queries for corp.internal. Furthermore, workloads in the private subnets of vpc-app-a and vpc-app-b require highly available outbound internet access, while minimizing NAT Gateway deployment costs across the architecture. Which two actions should the Solutions Architect take to design a solution that meets these requirements? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone corp.internal with vpc-app-a and vpc-app-b using cross-account association authorizations.Answer
  2. Deploy one NAT Gateway in each of the two Availability Zones within the public subnets of vpc-shared-services, and route all internet-bound traffic from the spoke VPCs to the Transit Gateway.Answer
  3. C
    Deploy a single NAT Gateway in one public subnet of vpc-shared-services to centralize internet egress and minimize NAT Gateway hourly fees.
  4. D
    Rely on AWS Transit Gateway's default routing behavior to automatically resolve DNS queries for corp.internal across all attached VPCs without associating the Private Hosted Zone.
  5. E
    Configure the Transit Gateway to perform transitive routing by pointing the default route (0.0.0.0/0) in the spoke VPCs directly to the Internet Gateway attached to vpc-shared-services.

Answer

Associate the Route 53 Private Hosted Zone corp.internal with the application VPCs, and deploy redundant NAT Gateways across two Availability Zones in the central services VPC to route all internet-bound traffic from the spoke VPCs.
The correct solution involves associating the Private Hosted Zone with the application VPCs using cross-account authorizations, which allows them to resolve the internal domain. It also implements highly available egress by deploying NAT Gateways in multiple Availability Zones in the central VPC and routing spoke internet traffic through them via Transit Gateway, achieving redundancy while keeping NAT Gateway costs lower than deploying them in all VPCs.

Step-by-Step Solution

1
Enable cross-account DNS resolution for the Private Hosted Zone.
Authorize the association of the corp.internal Private Hosted Zone in the shared services account with the application VPCs, then associate them.
This allows instances in the application VPCs to resolve internal DNS records hosted in the central VPC.
2
Implement a highly available egress routing architecture in the shared services VPC.
Deploy a NAT Gateway in each public subnet across two Availability Zones, and update the private route tables of the central VPC to point to their respective NAT Gateways.
This removes single points of failure for egress traffic at the Availability Zone level.
3
Configure spoke VPC and Transit Gateway routing.
Point the 0.0.0.0/0 route in the spoke VPC subnets to the Transit Gateway, and configure the Transit Gateway route tables to forward internet-bound traffic to the shared services VPC.
This routes all internet egress traffic centrally through the redundant NAT Gateways, reducing cost compared to deploying NAT Gateways in every VPC.

Key Concept

Centralized, highly available internet egress combined with cross-account Route 53 Private Hosted Zone association.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic