Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a high-performance network topology to connect its on-premises corporate offices to three VPCs in the `eu-west-1` Region: a shared services VPC and two application spoke VPCs. The architecture requires resilient, private, bidirectional connectivity between the on-premises networks and all VPCs, as well as private DNS resolution. Specifically, DNS queries for the private on-premises domain `corp.internal` must resolve from the application spoke VPCs, and DNS queries for the AWS private domain `aws.internal` must resolve from the on-premises network. The design must also enforce that outbound internet egress from the spoke VPCs is centralized through a firewall cluster in the shared services VPC.

Which of the following configurations should the solutions architect implement to satisfy these requirements? (Select TWO.)

  1. Deploy an AWS Transit Gateway, and attach the shared services VPC and both application spoke VPCs to it. Establish a Transit Virtual Interface (Transit VIF) on the Direct Connect connection, associate it with a Direct Connect Gateway, and attach the Direct Connect Gateway to the Transit Gateway. In the application spoke VPC route tables, route default traffic (0.0.0.0/0) to the Transit Gateway.Answer
  2. Create the Route 53 Private Hosted Zone aws.internal and associate it with all three VPCs. Deploy Route 53 Resolver inbound endpoints in the shared services VPC to receive queries from the on-premises DNS servers. Deploy Route 53 Resolver outbound endpoints in the shared services VPC, create a forwarding rule for corp.internal pointing to the on-premises DNS servers, and associate this rule with all three VPCs.Answer
  3. C
    Create the Route 53 Private Hosted Zone aws.internal and associate it only with the shared services VPC. Deploy Route 53 Resolver inbound endpoints in the shared services VPC. Configure a custom DHCP options set in the application spoke VPCs pointing to the inbound endpoint IP addresses to enable DNS resolution of the private domain.
  4. D
    Establish a Private Virtual Interface (Private VIF) on the Direct Connect connection, associate it with a Direct Connect Gateway, and attach the Direct Connect Gateway directly to all three VPCs. Configure the Direct Connect Gateway to route traffic between the spoke VPCs and to route outbound internet traffic through the shared services VPC.
  5. E
    Deploy a single NAT Gateway in a public subnet of the shared services VPC. Configure the application spoke VPC route tables to route all outbound internet traffic to the Transit Gateway, and configure a single Transit Gateway route table to direct all default route (0.0.0.0/0) traffic to the NAT Gateway.

Answer

Deploy an AWS Transit Gateway, connect the spoke and shared services VPCs, and associate it with a Direct Connect Gateway using a Transit VIF. Additionally, associate the Private Hosted Zone with all three VPCs, and set up Route 53 Resolver inbound and outbound endpoints with forwarding rules associated with the VPCs.
To connect multiple VPCs transitively to an on-premises data center over AWS Direct Connect, a Transit Gateway must be used in conjunction with a Direct Connect Gateway and a Transit VIF. Additionally, Route 53 Private Hosted Zones must be associated with all VPCs that need to resolve the records. Deploying inbound and outbound Route 53 Resolver endpoints in the shared services VPC allows bidirectional DNS resolution between the on-premises network and AWS.

Step-by-Step Solution

1
Analyze hybrid connectivity requirements and select the appropriate AWS Direct Connect configuration.
Determine that an AWS Transit Gateway combined with a Direct Connect Gateway and a Transit VIF is required to support transitive routing between multiple VPCs and the on-premises network.
Direct Connect Gateway alone cannot route traffic transitively between VPCs or support centralized egress, and Transit Gateway requires a Transit VIF.
2
Analyze private DNS resolution requirements between the on-premises network and AWS VPCs.
Establish Route 53 Resolver inbound endpoints for on-premises-to-AWS queries, outbound endpoints with forwarding rules for AWS-to-on-premises queries, and associate the Private Hosted Zone with all three VPCs.
AWS Private Hosted Zones are not transitively resolvable and must be explicitly associated with each consumer VPC, and Resolver endpoints are required to bridge hybrid DNS resolution.
3
Evaluate resiliency requirements for centralized outbound internet traffic.
Determine that deploying NAT Gateways across multiple Availability Zones in the shared services VPC is required to avoid a single point of failure.
A single NAT Gateway in one Availability Zone represents a single point of failure, violating the resiliency constraints of the scenario.

Key Concept

Designing highly resilient hybrid network architectures with centralized egress and bidirectional DNS resolution across multiple VPCs.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic