Examkin

Question

Difficulty: HardNetworking and Connectivity Design

A healthcare enterprise is designing a multi-account AWS environment in the us-east-1 Region. The architecture contains three application VPCs: a management VPC (vpc-mgt-prod) in Account A, a portal VPC (vpc-portal-prod) in Account B, and a secure data-processing VPC (vpc-data-prod) in Account C. The enterprise has established a 10 Gbps10\text{ Gbps} AWS Direct Connect connection to its on-premises network via a Direct Connect Gateway (dxgw-hybrid-core).

The network design must adhere to the following requirements:
- Instances in vpc-portal-prod and vpc-data-prod must resolve domain names under a Private Hosted Zone (PHZ) named corp.internal hosted in Account A.
- All outbound internet traffic from vpc-portal-prod and vpc-data-prod must pass through a centralized egress VPC (vpc-egress-prod) that has security monitoring tools.
- Direct VPC-to-VPC communication between vpc-portal-prod and vpc-data-prod must be prevented for compliance reasons.
- The solution must be highly available and minimize operational complexity.

Which TWO actions should the Solutions Architect take to meet these requirements?

  1. Associate the corp.internal Private Hosted Zone in Account A with vpc-portal-prod and vpc-data-prod by creating VPC association authorizations in Account A and executing the associations in Accounts B and C.Answer
  2. Deploy an AWS Transit Gateway (tgw-global-core) and create two Transit Gateway route tables. Associate vpc-portal-prod and vpc-data-prod with a spoke route table that has a default route (0.0.0.0/00.0.0.0/0) pointing to the vpc-egress-prod attachment, and do not propagate spoke routes to each other.Answer
  3. C
    In vpc-egress-prod, deploy a single NAT Gateway in one public subnet, and configure the route tables of the private subnets in all Availability Zones to point their default route (0.0.0.0/00.0.0.0/0) to this NAT Gateway.
  4. D
    Configure a single Transit Gateway route table associated with all VPC attachments, and enable route propagation across all VPCs to rely on the Direct Connect Gateway (dxgw-hybrid-core) to filter and block transitive traffic between the spokes.
  5. E
    Deploy Route 53 Resolver inbound endpoints in Account A and outbound endpoints in Accounts B and C, then create forwarding rules in Accounts B and C to route all DNS queries for corp.internal to the inbound endpoints.

Answer

The Solutions Architect should associate the corp.internal Private Hosted Zone in Account A with vpc-portal-prod and vpc-data-prod via cross-account VPC association authorizations, and deploy an AWS Transit Gateway with two Transit Gateway route tables where vpc-portal-prod and vpc-data-prod are associated with a spoke route table that directs default outbound traffic to the egress VPC without propagating spoke routes to each other.
The correct options implement a highly available, secure, and cost-effective multi-account architecture. Using cross-account VPC association authorizations allows spoke VPCs to natively resolve the private hosted zone without resolver endpoint costs. Isolating the spokes using Transit Gateway route tables with a default route to the egress VPC prevents spoke-to-spoke traffic while centralizing egress.

Step-by-Step Solution

1
Address DNS resolution requirements across multiple accounts natively and cost-effectively.
Associate the private hosted zone corp.internal in Account A with vpc-portal-prod (Account B) and vpc-data-prod (Account C) using VPC association authorizations and accepting them in the respective spoke accounts.
This avoids the cost, latency, and management overhead of deploying Route 53 Resolver endpoints and forwarding rules for same-Region resolution.
2
Design the network segmentation and routing topology using AWS Transit Gateway.
Create a Transit Gateway with two distinct route tables: one for the spokes (vpc-portal-prod and vpc-data-prod) and one for the hub/egress VPC (vpc-egress-prod).
This segregation allows custom routing behavior for different VPC attachments.
3
Enforce VPC-to-VPC isolation and centralize outbound traffic.
Associate the spoke VPC attachments with the spoke Transit Gateway route table. In this table, configure a default route (0.0.0.0/00.0.0.0/0) pointing to the egress VPC attachment and do not enable route propagation between the two spoke VPCs.
This setup prevents direct routing between the portal and data VPCs, forcing internet-bound traffic through the firewall and NAT Gateways in the egress VPC.

Key Concept

Multi-account hybrid networking design including Transit Gateway isolation, cross-account Route 53 Private Hosted Zone association, and highly available centralized egress.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic