Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-VPC networking environment on AWS. The environment consists of a central egress VPC (`vpc-egress-prod`) and two application spoke VPCs (`vpc-app-a` and `vpc-app-b`) across two Availability Zones in the `us-east-1` Region. An AWS Transit Gateway is deployed to interconnect all VPCs.

The application spoke VPCs host workloads that require:
1. Highly available outbound internet connectivity to download software patches.
2. Private DNS resolution for a domain named `corp.internal`, which is managed via a Route 53 Private Hosted Zone (PHZ) in a shared services AWS account.

Which of the following actions should the solutions architect take to meet these requirements with high availability and minimal operational overhead? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone `corp.internal` directly with both `vpc-app-a` and `vpc-app-b` from the shared services account where the zone is hosted.Answer
  2. Deploy a NAT Gateway in each of the two Availability Zones in `vpc-egress-prod` and configure the Transit Gateway route tables to route outbound internet traffic from the spoke VPCs to the NAT Gateway in the corresponding Availability Zone.Answer
  3. C
    Deploy a single NAT Gateway in one Availability Zone within `vpc-egress-prod` and route all outbound internet traffic from both spoke VPCs to this NAT Gateway through the AWS Transit Gateway.
  4. D
    Deploy Route 53 Resolver inbound endpoints in the shared services account and outbound endpoints in `vpc-app-a` and `vpc-app-b`, then configure Resolver rules to forward DNS queries for `corp.internal` across the endpoints.
  5. E
    Configure a Direct Connect Gateway directly connected to virtual private gateways (VGWs) in both spoke VPCs to handle transitive routing and resolve DNS between them without using the AWS Transit Gateway.

Answer

Associate the Route 53 Private Hosted Zone directly with the spoke VPCs, and deploy a NAT Gateway in each of the two Availability Zones in the egress VPC.
The correct solution involves associating the Private Hosted Zone directly with the spoke VPCs and deploying redundant NAT Gateways across two Availability Zones. Direct association allows local resolution of `corp.internal` via the built-in Route 53 Resolver in each VPC, which minimizes operational overhead and eliminates additional endpoint fees. Deploying one NAT Gateway in each Availability Zone of the egress VPC ensures that an outage in one zone does not impact outbound traffic from the other zone, fulfilling the requirement for high availability.

Step-by-Step Solution

1
Address private DNS resolution for `corp.internal` in a multi-account setup.
Authorize and associate the Private Hosted Zone in the shared services account with the consumer spoke VPCs (`vpc-app-a` and `vpc-app-b`).
This allows resources in the spoke VPCs to query the local Route 53 Resolver directly for the private domain, avoiding the complexity and costs of deploying Route 53 Resolver Endpoints.
2
Address outbound internet access requirements with high availability.
Deploy redundancy by placing one NAT Gateway in each of the two Availability Zones inside the egress VPC (`vpc-egress-prod`).
Deploying a single NAT Gateway creates a single point of failure, whereas multi-AZ NAT Gateways prevent a single AZ outage from disabling outbound traffic.
3
Configure the routing topology on the AWS Transit Gateway.
Create static routes in the spoke VPC route tables pointing outbound traffic (`0.0.0.0/00.0.0.0/0`) to the Transit Gateway, and configure the Transit Gateway to route outbound traffic to the respective NAT Gateways in `vpc-egress-prod`.
This ensures that traffic is distributed appropriately across both Availability Zones to maintain resilience.

Key Concept

Designing a resilient, cost-effective hybrid network architecture on AWS requires understanding Route 53 cross-account Private Hosted Zone association, multi-AZ NAT Gateway redundancy, and Transit Gateway routing capabilities.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic