Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

TerraGrid Energy is modernizing its local power-grid telemetry processing application by migrating it to AWS. The workload requires low-latency connectivity (under 10 ms10\text{ ms}) to physical on-premises SCADA systems and must comply with local regulations that mandate all raw data storage and processing remain within the physical facility. The company has deployed an AWS Outposts rack in their local data center. The Solutions Architect needs to run the containerized application on Amazon EKS using worker nodes on the Outposts rack while managing the control plane from the parent AWS Region. The architecture must ensure that the worker nodes can privately communicate with the EKS control plane and write data directly to the local SCADA network without routing local traffic through the parent Region. Which network and compute architecture should the Solutions Architect implement to meet these requirements?

  1. A
    Deploy the Amazon EKS control plane in the parent AWS Region. Create an Amazon EKS node group using AWS Fargate profiles in the AWS Outposts subnets. Configure Fargate to use host network mode to route SCADA telemetry directly to the local network, and communicate with the EKS control plane over a public virtual interface.
  2. B
    Deploy the Amazon EKS control plane in the parent AWS Region. Launch EKS worker nodes on EC2 instances within the AWS Outposts subnets. Set up an AWS Transit Gateway in the parent Region and route all SCADA telemetry traffic from the Outpost nodes back to the parent Region's Transit Gateway, then forward it back to the local data center over an AWS Direct Connect connection with a public virtual interface.
  3. Deploy the Amazon EKS control plane in the parent AWS Region. Launch EKS worker nodes on EC2 instances within the subnets associated with the AWS Outposts rack. Enable private cluster endpoint access and associate the Route 53 Private Hosted Zone for the cluster endpoint with the Outposts VPC. Configure the AWS Outposts Local Gateway to route SCADA-bound telemetry traffic directly to the local network, and use a private virtual interface over AWS Direct Connect for control plane communication.Answer
  4. D
    Deploy the Amazon EKS control plane in a dedicated Shared Services VPC in the parent Region, and the EKS worker nodes in a Spoke VPC on the AWS Outposts rack. Create a Route 53 Private Hosted Zone for the EKS cluster endpoint in the Shared Services VPC. Connect the VPCs using VPC Peering. Rely on the default DNS resolution settings in the Spoke VPC without manually associating the Private Hosted Zone to the Spoke VPC.

Answer

Deploy the Amazon EKS control plane in the parent AWS Region, run worker nodes on EC2 instances in the AWS Outposts subnets, associate the Route 53 Private Hosted Zone with the Outposts VPC, and route telemetry traffic directly to the local SCADA network using the Outposts Local Gateway.
The correct solution correctly targets worker nodes on EC2 instances within the AWS Outposts subnets, ensuring physical data residency and low-latency access. By leveraging the Outposts Local Gateway (LGW), local SCADA traffic bypasses the parent AWS Region completely, staying under the 10 ms10\text{ ms} latency limit. Private EKS cluster connectivity over AWS Direct Connect requires the Route 53 Private Hosted Zone containing the cluster endpoint to be associated with the Outposts VPC so that the worker nodes can privately resolve and connect to the regional EKS control plane.

Step-by-Step Solution

1
Deploy EKS worker nodes on EC2 instances inside subnets mapped to the AWS Outposts rack.
The workload runs physically on-premises, satisfying the local data residency and low-latency execution requirements.
AWS Fargate is not supported on Outposts for EKS, making EC2 worker nodes on the Outpost subnets the correct compute platform.
2
Configure the AWS Outposts Local Gateway (LGW) route tables to direct SCADA network ranges directly to the local gateway.
Telemetry traffic is routed directly to the on-premises SCADA system with a latency of less than 10 ms10\text{ ms}.
Using the LGW keeps local traffic on the local network rather than routing it through the parent AWS Region.
3
Associate the Route 53 Private Hosted Zone for the EKS cluster endpoint with the VPC containing the Outposts subnets.
Worker nodes on the Outpost can resolve the cluster endpoint DNS to the private ENI IP addresses in the VPC.
Private Hosted Zones must be explicitly associated with a VPC to allow instances within that VPC to resolve those private domain names.

Key Concept

Amazon EKS on AWS Outposts local gateway (LGW) routing and private cluster endpoint resolution via Route 53 Private Hosted Zone associations.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic