Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A logistics company is designing a new cloud architecture in the eu-west-1 region. The design includes two VPCs: vpc-prod-delivery (hosting critical backend applications across two Availability Zones) and vpc-shared-ops (hosting operational tools). The company has an on-premises data center that requires redundant, private connectivity to both VPCs. Additionally, applications in vpc-prod-delivery must resolve internal domain names managed in a Route 53 Private Hosted Zone (PHZ) ops.internal that is owned by vpc-shared-ops. Outbound internet egress for the application instances must be highly resilient against Availability Zone failures. Which of the following networking designs meets these requirements while ensuring maximum resiliency and minimum administrative overhead?

  1. A
    Deploy an AWS Transit Gateway and connect both VPCs to it. Associate the Transit Gateway with a Direct Connect Gateway connected to an AWS Direct Connect connection and a backup Site-to-Site VPN. Deploy a single NAT Gateway in a public subnet in one Availability Zone of vpc-prod-delivery, and configure all private subnet route tables to route outbound internet traffic (0.0.0.0/00.0.0.0/0) through this single NAT Gateway. Associate the private hosted zone ops.internal with both VPCs.
  2. B
    Connect both VPCs directly to a Direct Connect Gateway associated with an AWS Direct Connect connection and a backup Site-to-Site VPN. Configure the Direct Connect Gateway to route traffic transitively between vpc-prod-delivery and vpc-shared-ops. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-prod-delivery for outbound internet access, and associate the private hosted zone ops.internal with both VPCs.
  3. Deploy an AWS Transit Gateway and connect both VPCs to it. Associate the Transit Gateway with a Direct Connect Gateway connected to an AWS Direct Connect connection and a backup Site-to-Site VPN. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-prod-delivery, and configure the private route tables to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the local NAT Gateway in the same Availability Zone. Associate the private hosted zone ops.internal with both vpc-shared-ops and vpc-prod-delivery.Answer
  4. D
    Deploy an AWS Transit Gateway and connect both VPCs to it. Associate the Transit Gateway with a Direct Connect Gateway connected to an AWS Direct Connect connection and a backup Site-to-Site VPN. Deploy a NAT Gateway in a public subnet in each Availability Zone of vpc-prod-delivery for outbound internet access. Associate the private hosted zone ops.internal only with vpc-shared-ops, relying on the Transit Gateway attachment to transitively resolve DNS queries from vpc-prod-delivery.

Answer

The correct networking design utilizes an AWS Transit Gateway connected to a Direct Connect Gateway with a backup VPN to provide redundant hybrid connectivity, deploys a NAT Gateway in each Availability Zone of the delivery VPC to guarantee high availability for internet egress, and associates the private hosted zone with both VPCs to enable DNS resolution across accounts.
The correct design uses an AWS Transit Gateway to support multi-VPC hybrid routing over AWS Direct Connect and VPN. It ensures egress resiliency by deploying a NAT Gateway in each Availability Zone of the delivery VPC, protecting outbound internet access against single-zone failures. Finally, it permits proper internal name resolution by explicitly associating the Route 53 Private Hosted Zone with both VPCs.

Step-by-Step Solution

1
Evaluate hybrid connectivity requirements
Identify that AWS Transit Gateway is the standard mechanism to scale hybrid connectivity to multiple VPCs via a single Direct Connect Gateway association while maintaining backup VPN support.
Direct Connect Gateway alone does not support VPC-to-VPC transitive routing, meaning a Transit Gateway is necessary to bridge on-premises networks and both VPCs.
2
Design resilient outbound internet egress
Determine that deploying a NAT Gateway in each Availability Zone where application instances reside ensures that a single zone failure does not sever outbound internet access for the surviving zone.
A single NAT Gateway creates an architectural bottleneck and single point of failure, violating the high resiliency requirement.
3
Configure Route 53 DNS resolution across VPC boundaries
Associate the Route 53 Private Hosted Zone ops.internal with both vpc-shared-ops and vpc-prod-delivery.
Route 53 PHZ DNS resolution is not transitive across VPC attachments or peerings; it must be explicitly associated with each VPC that needs to resolve its resource records.

Key Concept

AWS Hybrid Networking and DNS Design
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic