Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

A financial services firm is building a new multi-account landing zone on AWS in the us-east-1 Region. The architecture requires connecting two spoke VPCs, Retail-App-VPC (Account A) and Wholesale-App-VPC (Account B), to a central hub VPC named Transit-Core-VPC (Account C) using an AWS Transit Gateway. Spoke-to-spoke IP routing between Retail-App-VPC and Wholesale-App-VPC is strictly prohibited due to compliance regulations.

All outbound internet traffic from the private subnets of both spoke VPCs must be inspected through a cluster of security firewalls hosted in Transit-Core-VPC. A 10 Gbps10\text{ Gbps} AWS Direct Connect connection terminates at an on-premises data center and is attached to a Direct Connect Gateway associated with the Transit Gateway. Additionally, DNS resolution must be configured such that resources in the spoke VPCs can resolve on-premises services in the corp.internal domain, while on-premises servers and the spoke VPCs must be able to resolve resource records in a Route 53 Private Hosted Zone (PHZ) for aws.platform.internal hosted in Account C.

Which of the following designs meets these requirements while ensuring maximum availability, preventing single points of failure, and minimizing operational and data transfer overhead?

  1. A
    Deploy an AWS Transit Gateway and attach Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Set up two Transit Gateway route tables to block spoke-to-spoke routing and direct outbound traffic to Transit-Core-VPC. Deploy NAT Gateways across multiple Availability Zones in Transit-Core-VPC, routing Transit Gateway attachment traffic in each Availability Zone to its corresponding local NAT Gateway. Configure the aws.platform.internal Private Hosted Zone in Account C and associate it only with Transit-Core-VPC. In Transit-Core-VPC, deploy Route 53 Resolver inbound and outbound endpoints across multiple Availability Zones to handle DNS queries with the on-premises data center, and associate the outbound Resolver rules with Retail-App-VPC and Wholesale-App-VPC.
  2. Deploy an AWS Transit Gateway and attach Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Configure two Transit Gateway route tables: one associated with the spoke VPCs directing 0.0.0.0/00.0.0.0/0 traffic to the Transit-Core-VPC attachment, and another associated with Transit-Core-VPC routing traffic back to the spokes. In Transit-Core-VPC, deploy NAT Gateways across multiple Availability Zones, and configure a dedicated route table for each Transit Gateway subnet attachment that routes 0.0.0.0/00.0.0.0/0 to the NAT Gateway in the same Availability Zone. Associate the aws.platform.internal Private Hosted Zone with Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Deploy Route 53 Resolver inbound and outbound endpoints across multiple Availability Zones in Transit-Core-VPC, and associate the outbound Resolver forwarding rules with all three VPCs.Answer
  3. C
    Connect the on-premises data center using a Direct Connect Gateway associated with virtual private gateways attached to Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Establish VPC Peering connections from Retail-App-VPC and Wholesale-App-VPC to Transit-Core-VPC. Configure the route tables in the spoke VPCs to point 0.0.0.0/00.0.0.0/0 to the peered Transit-Core-VPC, and deploy NAT Gateways across multiple Availability Zones in Transit-Core-VPC to handle internet egress. Associate the aws.platform.internal Private Hosted Zone with all three VPCs. Deploy Route 53 Resolver inbound and outbound endpoints in Transit-Core-VPC to manage DNS queries with the on-premises network.
  4. D
    Deploy an AWS Transit Gateway and attach Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Set up two Transit Gateway route tables to block spoke-to-spoke routing and direct outbound traffic to Transit-Core-VPC. Deploy a single NAT Gateway in one public subnet within a single Availability Zone of Transit-Core-VPC to reduce NAT Gateway costs. Configure the route tables of all Transit Gateway subnet attachments in Transit-Core-VPC to route 0.0.0.0/00.0.0.0/0 to this single NAT Gateway. Associate the aws.platform.internal Private Hosted Zone with Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC. Deploy Route 53 Resolver inbound and outbound endpoints across multiple Availability Zones in Transit-Core-VPC, and associate the outbound Resolver forwarding rules with all three VPCs.

Answer

Deploy an AWS Transit Gateway and attach all three VPCs. Configure Spoke and Hub Transit Gateway route tables to isolate spoke-to-spoke traffic while routing egress traffic to the hub. In the hub VPC, deploy NAT Gateways across multiple Availability Zones and configure dedicated route tables for each Transit Gateway subnet attachment to route default traffic locally to the NAT Gateway in the same zone. Explicitly associate the Private Hosted Zone with all three VPCs and configure Route 53 Resolver inbound and outbound endpoints across multiple Availability Zones.
The correct design uses Transit Gateway route tables to segment spoke-to-spoke traffic while routing outbound internet traffic to the central hub VPC. By deploying NAT Gateways across multiple Availability Zones in the central VPC and routing traffic from each Transit Gateway subnet attachment to its local NAT Gateway, Availability Zone redundancy is preserved, preventing a single point of failure and avoiding cross-AZ data transfer fees. Finally, associating the Private Hosted Zone with all three VPCs is required for private resolution across accounts, and Route 53 Resolver inbound and outbound endpoints facilitate hybrid resolution.

Step-by-Step Solution

1
Configure Transit Gateway routing to segregate spoke traffic and allow hub egress.
Create Spoke-TGW-RT and Hub-TGW-RT. Spoke-TGW-RT routes 0.0.0.0/00.0.0.0/0 to the hub VPC attachment and has no routes to other spokes, preventing spoke-to-spoke communication.
Ensures compliance requirements are met by isolating the spokes while forwarding egress traffic to the central security hub.
2
Design highly available egress within the Transit-Core-VPC using multi-AZ NAT Gateways.
Deploy NAT Gateways in multiple Availability Zones. Configure TGW subnet attachment route tables to route 0.0.0.0/00.0.0.0/0 to the NAT Gateway in the same Availability Zone.
Avoids cross-AZ data transfer fees and prevents a single Availability Zone outage from impacting outbound traffic across the entire architecture.
3
Configure Private Hosted Zone DNS associations.
Associate the aws.platform.internal Private Hosted Zone in Account C with Retail-App-VPC, Wholesale-App-VPC, and Transit-Core-VPC.
Route 53 Private Hosted Zones do not support transitive resolution across Transit Gateway attachments; they must be explicitly associated with each VPC requiring DNS resolution.
4
Establish hybrid DNS resolution via Route 53 Resolver endpoints.
Deploy Resolver inbound endpoints for on-premises DNS forwarding, and Resolver outbound endpoints with forwarding rules for corp.internal associated with all three VPCs.
Allows bi-directional DNS resolution between the on-premises network and the AWS VPCs over the AWS Direct Connect connection.

Key Concept

Multi-VPC hybrid routing and DNS resolution using Transit Gateway, multi-AZ NAT Gateways, and Route 53 Private Hosted Zone associations.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic