Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-VPC AWS environment in the `us-west-2` Region. The architecture includes a shared services VPC (`vpc-shared-services`), two workload VPCs (`vpc-prod-app` and `vpc-stage-app`), and a centralized egress VPC (`vpc-egress`). The workloads are deployed across two Availability Zones. An AWS Transit Gateway (`tgw-core`) interconnects all VPCs. The enterprise must meet the following requirements:
1. Allow resources in all VPCs to resolve on-premises DNS hostnames ending in `.corp.internal`.
2. Allow on-premises servers to resolve AWS resources in a Route 53 Private Hosted Zone (PHZ) named `aws.corp.internal` that contains records for resources in the workload VPCs.
3. Provide outbound internet access for private subnets in the workload VPCs while minimizing NAT Gateway costs and maintaining High Availability (HA) across both Availability Zones.

Which configuration satisfies these requirements?

  1. A
    Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers. Associate the resolver rule and the `aws.corp.internal` Private Hosted Zone only with `vpc-shared-services`, relying on the Transit Gateway (`tgw-core`) to transitively forward Route 53 DNS queries from the workload VPCs. In `vpc-egress`, deploy one NAT Gateway in each of the two Availability Zones to handle outbound internet traffic.
  2. B
    Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers, and associate the rule and the `aws.corp.internal` Private Hosted Zone with all three workload and shared services VPCs. In `vpc-egress`, deploy a single NAT Gateway in one Availability Zone to minimize AWS resource costs, and update the Transit Gateway route tables to route all outbound internet traffic from both Availability Zones to this single NAT Gateway.
  3. Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers, and associate the rule and the `aws.corp.internal` Private Hosted Zone with all three workload and shared services VPCs. In `vpc-egress`, deploy one NAT Gateway in each of the two Availability Zones. Configure the Transit Gateway route tables to route outbound internet traffic from the workload VPCs to `vpc-egress`, forwarding the traffic to the NAT Gateway in the same Availability Zone.Answer
  4. D
    Deploy Route 53 Resolver Inbound and Outbound Endpoints in `vpc-shared-services` across two Availability Zones. Create a Resolver rule to forward `.corp.internal` queries to on-premises DNS servers, and associate the rule and the `aws.corp.internal` Private Hosted Zone with all three workload and shared services VPCs. Attach the workload VPCs and `vpc-egress` directly to an AWS Direct Connect Gateway (`dxgw-core`) using Virtual Private Gateways, and configure the Direct Connect Gateway to route outbound internet traffic transitively to the NAT Gateways in `vpc-egress` without using `tgw-core`.

Answer

Deploy Route 53 Resolver Inbound and Outbound Endpoints across two Availability Zones in the shared services VPC, associate the private hosted zone and resolver rule with all VPCs, and deploy one NAT Gateway per Availability Zone in the centralized egress VPC using the Transit Gateway for cross-VPC routing.
The correct configuration deploys Route 53 Resolver inbound and outbound endpoints across two Availability Zones to ensure high availability and eliminate EC2 management overhead. Private Hosted Zones must be associated with every VPC from which DNS resolution is required because DNS queries to the Route 53 Resolver IP (169.254.169.253169.254.169.253) are resolved locally within each VPC. For internet egress, deploying one NAT Gateway in each of the two Availability Zones in the centralized egress VPC maintains high availability and leverages Transit Gateway for cross-VPC routing.

Step-by-Step Solution

1
Configure bidirectional hybrid DNS resolution
Deploy Route 53 Resolver Inbound and Outbound Endpoints across two Availability Zones in `vpc-shared-services`, and associate the `aws.corp.internal` Private Hosted Zone with all three VPCs.
Enables DNS query exchange between the on-premises environment and AWS, and ensures that the workload VPCs can resolve the private hosted zone locally, since Route 53 DNS queries to the resolver IP (169.254.169.253169.254.169.253) cannot be transitively routed.
2
Design high-availability centralized egress
Deploy one NAT Gateway in each of the two Availability Zones within the centralized egress VPC (`vpc-egress`). Configure Route Tables on the Transit Gateway (`tgw-core`) to forward outbound internet traffic from the workload VPCs to the egress VPC.
Provides a highly available path for outbound internet traffic across two Availability Zones while centralizing NAT Gateways to minimize costs, compared to deploying separate NAT Gateways in every workload VPC.

Key Concept

Multi-VPC hybrid routing, Route 53 Resolver endpoints, Private Hosted Zone association, and high-availability centralized egress design.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic