Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A SaaS provider is setting up a new multi-VPC environment in the eu-west-1 Region. The environment consists of two spoke VPCs: vpc-payment-prd and vpc-booking-prd. Both VPCs are deployed across two Availability Zones (eu-west-1a and eu-west-1b). The workloads in these spoke VPCs require highly available, outbound-only internet access to communicate with external payment APIs, while minimizing cross-Availability Zone data transfer charges. Additionally, the workloads must resolve private domain names hosted in a Route 53 Private Hosted Zone (PHZ) corp.internal managed in a central Shared Services account. The solutions architect decides to use an AWS Transit Gateway to connect the VPCs.

Which configuration should the solutions architect implement to meet these requirements?

  1. A
    Deploy an AWS Transit Gateway and attach all three VPCs. In vpc-egress-shared, deploy a single NAT Gateway in eu-west-1a to minimize costs. Configure the Transit Gateway route table for the spoke VPC attachments to direct 0.0.0.0/0 traffic to the vpc-egress-shared attachment. Configure the route tables of the Transit Gateway subnets in vpc-egress-shared to route all outbound traffic to this single NAT Gateway. From the Shared Services account, associate the Private Hosted Zone corp.internal with both vpc-payment-prd and vpc-booking-prd.
  2. B
    Establish VPC peering connections between vpc-payment-prd and vpc-egress-shared, and between vpc-booking-prd and vpc-egress-shared. In vpc-egress-shared, deploy one NAT Gateway in eu-west-1a and one NAT Gateway in eu-west-1b. Configure the route tables in the spoke VPCs to direct 0.0.0.0/0 traffic to the VPC peering connections. From the Shared Services account, associate the Private Hosted Zone corp.internal with both vpc-payment-prd and vpc-booking-prd.
  3. Deploy an AWS Transit Gateway and attach all three VPCs. In vpc-egress-shared, deploy one NAT Gateway in eu-west-1a and one NAT Gateway in eu-west-1b. Configure the Transit Gateway route table for the spoke VPC attachments to direct 0.0.0.0/0 traffic to the vpc-egress-shared attachment. Configure the route tables of the Transit Gateway subnets in vpc-egress-shared to route traffic to the NAT Gateway in the same Availability Zone. From the Shared Services account, associate the Private Hosted Zone corp.internal with both vpc-payment-prd and vpc-booking-prd.Answer
  4. D
    Deploy an AWS Transit Gateway and attach all three VPCs. In vpc-egress-shared, deploy one NAT Gateway in eu-west-1a and one NAT Gateway in eu-west-1b. Configure the Transit Gateway route table for the spoke VPC attachments to direct 0.0.0.0/0 traffic to the vpc-egress-shared attachment. Configure the route tables of the Transit Gateway subnets in vpc-egress-shared to route traffic to the NAT Gateway in the same Availability Zone. In the Shared Services account, associate the Private Hosted Zone corp.internal with vpc-egress-shared only, relying on the Transit Gateway attachments to transitively resolve the internal domain names.

Answer

Deploy an AWS Transit Gateway to connect the VPCs, use multi-AZ NAT Gateways in the egress VPC, direct traffic to the local NAT Gateway in each Availability Zone to minimize cross-AZ charges, and associate the Private Hosted Zone with both spoke VPCs directly.
The correct configuration uses AWS Transit Gateway to interconnect the spoke VPCs and the shared egress VPC. High availability is achieved by deploying a NAT Gateway in both Availability Zones (eu-west-1a and eu-west-1b) within the egress VPC. Since Transit Gateway preserves the Availability Zone of originating traffic, routing the Transit Gateway subnets' traffic to the local NAT Gateway in the same Availability Zone eliminates cross-Availability Zone data transfer charges. Lastly, to resolve records in the central Private Hosted Zone, the zone must be directly associated with both spoke VPCs from the Shared Services account.

Step-by-Step Solution

1
Deploy redundant NAT Gateways.
Create one NAT Gateway in the public subnet of eu-west-1a and another in the public subnet of eu-west-1b within the shared egress VPC.
This establishes high availability for internet egress and ensures there is a local NAT Gateway in each Availability Zone to avoid cross-AZ data transfer charges.
2
Establish Transit Gateway connections and configure AZ-aligned routing.
Attach vpc-payment-prd, vpc-booking-prd, and vpc-egress-shared to an AWS Transit Gateway. Route 0.0.0.0/0 from the spoke VPCs to the egress VPC attachment, and configure the Transit Gateway subnet route tables in the egress VPC to direct traffic to their local NAT Gateways.
Transit Gateway maintains the Availability Zone affinity of the originating traffic. Directing traffic to the local NAT Gateway in the egress VPC ensures that traffic does not cross Availability Zones, minimizing latency and data transfer costs.
3
Associate the Route 53 Private Hosted Zone across accounts.
From the Shared Services account, associate the corp.internal Private Hosted Zone with the VPC IDs of vpc-payment-prd and vpc-booking-prd.
Private Hosted Zones must be explicitly associated with each VPC that needs to resolve the private DNS records. DNS resolution is not transitive over Transit Gateway attachments.

Key Concept

Centralized egress networking with Transit Gateway, maintaining Availability Zone affinity for cost optimization, and cross-account Route 53 Private Hosted Zone association.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic