A biotechnology company is designing a hybrid, multi-account network topology in the `us-east-1` Region. The setup includes spoke VPCs and a centralized egress VPC, all connected via an AWS Transit Gateway (TGW). The company has the following requirements:
- Establish a primary AWS Direct Connect connection to the corporate datacenter, with an IPsec VPN over the internet serving as a backup path.
- Provide highly available and resilient outbound internet access for resources in all spoke VPCs while minimizing NAT Gateway costs.
- Centralize private DNS resolution for a private hosted zone `corp.internal` in a Shared Services VPC so that it can be resolved by resources in all spoke VPCs and the on-premises datacenter.
Which TWO options should the Solutions Architect implement to meet these requirements?
- Associate the Transit Gateway with a Direct Connect Gateway, configure a Transit Virtual Interface (Transit VIF) on the Direct Connect connection, and establish a Site-to-Site VPN connection to the Transit Gateway.Answer
- Deploy one NAT Gateway in each of two Availability Zones in the egress VPC, and associate the `corp.internal` private hosted zone with all spoke VPCs using cross-account hosted zone associations.Answer
- CAssociate all spoke VPCs directly with the Direct Connect Gateway using Private Virtual Interfaces (Private VIFs) to establish hybrid connectivity, bypassing the Transit Gateway to eliminate data transfer fees.
- DDeploy a single NAT Gateway in the egress VPC to minimize running costs, and route all outbound internet traffic from the spoke VPCs to this NAT Gateway via the Transit Gateway.
- ECreate Route 53 Resolver Outbound Endpoints in each of the spoke VPCs, and configure them to forward queries for `corp.internal` to the default VPC resolver IP address () located in the Shared Services VPC.