Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-VPC environment in the `eu-west-1` Region. The architecture consists of three spoke VPCs (`vpc-finance-prod`, `vpc-hr-prod`, and `vpc-shared-services`) connected via an AWS Transit Gateway. The network design must satisfy the following requirements:
- Establish a primary, high-bandwidth connection using a dedicated AWS Direct Connect connection via a Direct Connect Gateway, and a backup AWS Site-to-Site VPN connection over the internet.
- Prevent asymmetric routing between the on-premises corporate network and AWS.
- Ensure secure, highly available, and cost-effective outbound internet egress for resources in all three VPCs.
- Provide private DNS resolution for a Private Hosted Zone (`corp.internal`) hosted in the `vpc-shared-services` account to all resources across the three VPCs.

Which of the following configuration steps should the solutions architect implement to satisfy these requirements? (Select TWO.)

  1. Configure the on-premises router to assign a higher BGP Local Preference to routes received via the Direct Connect Gateway compared to the Site-to-Site VPN, and propagate both connections into the AWS Transit Gateway route table.Answer
  2. Deploy a NAT Gateway in each active Availability Zone within the public subnets of the shared services VPC for outbound egress, and perform Route 53 cross-account associations to associate the Private Hosted Zone with each individual spoke VPC.Answer
  3. C
    Deploy a single NAT Gateway in the shared services VPC to route all internet-bound traffic from the spoke VPCs through the Transit Gateway to minimize monthly elastic IP and gateway hourly charges.
  4. D
    Configure the Direct Connect Gateway to act as a transitive router, enabling the spoke VPCs to route inter-VPC traffic directly through the Direct Connect Gateway to optimize network path latency.
  5. E
    Share the Route 53 Private Hosted Zone with the other accounts using AWS Resource Access Manager (RAM) and associate it with the Transit Gateway to enable DNS resolution across all VPCs.

Answer

The correct configuration requires setting a higher BGP Local Preference on the on-premises router for Direct Connect routes, propagating both paths to the Transit Gateway, deploying multi-AZ NAT Gateways in the shared services VPC, and associating the Route 53 Private Hosted Zone with all spoke VPCs using cross-account associations.
The configuration of BGP Local Preference on the customer gateway ensures symmetric routing by directing outbound corporate traffic through the Direct Connect connection. Simultaneously, AWS Transit Gateway naturally prefers Direct Connect Gateway attachments over VPN attachments for returning traffic, preventing asymmetric routing. High availability for egress is achieved by deploying a NAT Gateway in each active Availability Zone, while cross-account Route 53 hosted zone associations allow resources in all spoke VPCs to resolve private domain names.

Step-by-Step Solution

1
Prevent asymmetric routing for hybrid traffic.
Traffic flows symmetrically over Direct Connect for both inbound and outbound directions, falling back to VPN only when Direct Connect is offline.
Setting a higher BGP Local Preference on the on-premises router controls outbound traffic from on-premises to AWS. On the AWS side, Transit Gateway automatically prioritizes Direct Connect Gateway over VPN for returning traffic.
2
Design a highly available NAT architecture.
Redundant NAT Gateways are deployed in multiple Availability Zones.
A single NAT Gateway creates a single point of failure, violating high availability design patterns.
3
Configure cross-account DNS resolution for Private Hosted Zones.
The Private Hosted Zone is associated with all target VPCs.
Private Hosted Zones cannot be shared via AWS RAM or associated with Transit Gateways; they must be associated with each VPC directly.

Key Concept

AWS hybrid connectivity path selection, NAT Gateway redundancy, and cross-account Route 53 Private Hosted Zone associations.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic