Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

An enterprise is building a global media streaming platform in the eu-west-1 Region. The architecture is deployed across three VPCs:

- vpc-ingest: Houses public-facing Application Load Balancers (ALBs) that receive high-throughput video streams.
- vpc-processing: Contains transcoding worker nodes running in private subnets across two Availability Zones (eu-west-1a and eu-west-1b). The workers require outbound internet connectivity to fetch libraries, but must not accept inbound connections.
- vpc-shared: Contains central security tools and a Route 53 Private Hosted Zone (PHZ) named internal.media.platform that resolves internal service endpoints.

An AWS Transit Gateway (tgw-central) is deployed to interconnect all three VPCs. The enterprise wants to centralize all egress internet traffic from vpc-processing through vpc-shared to reduce NAT Gateway costs and centralize security inspections. The egress routing must be highly available and resilient to Availability Zone failures. Additionally, resources in all three VPCs must be able to resolve DNS queries for internal.media.platform.

Which combination of actions must the Solutions Architect perform to configure the network routing and DNS resolution to meet these requirements? (Select TWO.)

  1. In vpc-shared, deploy a public NAT Gateway in both eu-west-1a and eu-west-1b. Configure the route tables of the Transit Gateway attachment subnets in vpc-shared such that the default route 0.0.0.0/0 in eu-west-1a points to the NAT Gateway in eu-west-1a, and the default route 0.0.0.0/0 in eu-west-1b points to the NAT Gateway in eu-west-1b.Answer
  2. B
    In vpc-shared, deploy a single public NAT Gateway in eu-west-1a. Configure a single route table shared across all Transit Gateway attachment subnets in vpc-shared with a default route 0.0.0.0/0 pointing to this NAT Gateway.
  3. Authorize the association of the Private Hosted Zone internal.media.platform in the Shared Services AWS account with vpc-ingest and vpc-processing using the AWS CLI or Route 53 API, and then associate the zone from the respective spoke accounts.Answer
  4. D
    Establish VPC Peering connections between vpc-processing and vpc-shared. In vpc-processing route tables, point 0.0.0.0/0 to the VPC Peering connection, and configure vpc-shared to route that traffic transitively to its NAT Gateways.
  5. E
    Create Route 53 Resolver outbound endpoints in vpc-processing and vpc-ingest, and inbound endpoints in vpc-shared to forward all DNS queries for the domain internal.media.platform without performing VPC associations.

Answer

Deploy a public NAT Gateway in both Availability Zones in vpc-shared and configure the route tables of the Transit Gateway attachment subnets to route traffic locally to each NAT Gateway. Additionally, authorize and associate the Private Hosted Zone with the spoke VPCs.
Deploying public NAT Gateways in both Availability Zones and pointing the respective Transit Gateway subnet route tables to the local NAT Gateway ensures that traffic remains within the same Availability Zone, eliminating cross-AZ dependencies and single points of failure. Associating the Route 53 Private Hosted Zone with the spoke VPCs via cross-account authorizations ensures that instances in all VPCs can natively resolve internal DNS records without incurring resolver endpoint costs.

Step-by-Step Solution

1
Configure centralized NAT Gateways in vpc-shared.
Two public NAT Gateways are created in eu-west-1a and eu-west-1b public subnets of vpc-shared.
This establishes redundant internet egress paths in each Availability Zone, removing single points of failure.
2
Configure Transit Gateway subnet routing in vpc-shared.
The route tables for the subnets containing the Transit Gateway elastic network interfaces (ENIs) are updated to point 0.0.0.0/0 to the local public NAT Gateway in the same Availability Zone.
This maintains AZ affinity and isolation, ensuring that traffic originating from an AZ in a spoke VPC remains in the same AZ when routed through Transit Gateway to the NAT Gateway.
3
Authorize and associate the Private Hosted Zone.
Create a VPC association authorization for vpc-ingest and vpc-processing in the Shared Services account, then run the associate command in the spoke accounts.
This allows instances in the spoke VPCs to query and resolve internal DNS hostnames in the private hosted zone.

Key Concept

Designing high-availability centralized egress architectures using AWS Transit Gateway and managing Route 53 Private Hosted Zones across multiple AWS accounts.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic