Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A solutions architect is designing a new AWS networking infrastructure for an enterprise. The architecture includes three VPCs in the us-west-2 region: VPC-Production, VPC-UAT, and VPC-SharedServices. The design must support:
- Private, scalable VPC-to-VPC routing.
- Hybrid connectivity to an on-premises data center via a new AWS Direct Connect connection.
- Outbound internet access from private subnets in all VPCs that is highly available, resilient to Availability Zone outages, and avoids cross-AZ data transfer charges.
- Resolution of a Route 53 Private Hosted Zone (PHZ) managed in the VPC-SharedServices account by resources in both VPC-Production and VPC-UAT.

Which design satisfies these requirements?

  1. A
    Deploy an AWS Direct Connect Gateway and attach it to virtual private gateways (VGWs) in VPC-Production, VPC-UAT, and VPC-SharedServices using a private virtual interface (private VIF). Deploy a NAT Gateway in each active Availability Zone's public subnet in VPC-Production, VPC-UAT, and VPC-SharedServices. Authorize and associate the Route 53 Private Hosted Zone in VPC-SharedServices with VPC-Production and VPC-UAT.
  2. B
    Deploy an AWS Transit Gateway (TGW) to connect the three VPCs. Set up a Transit Gateway attachment to an AWS Direct Connect Gateway connected to a transit virtual interface (transit VIF). Deploy a single NAT Gateway in one Availability Zone of the VPC-SharedServices public subnets. Configure Transit Gateway route tables to forward all outbound internet traffic from VPC-Production and VPC-UAT to the VPC-SharedServices NAT Gateway. Authorize and associate the Route 53 Private Hosted Zone in VPC-SharedServices with VPC-Production and VPC-UAT.
  3. C
    Deploy an AWS Transit Gateway (TGW) to connect the three VPCs. Set up a Transit Gateway attachment to an AWS Direct Connect Gateway connected to a transit virtual interface (transit VIF). Deploy a NAT Gateway in each active Availability Zone's public subnet in VPC-Production, VPC-UAT, and VPC-SharedServices, configuring private subnet route tables to point outbound traffic to the local NAT Gateway. Rely on the Transit Gateway attachments to automatically propagate and resolve the Route 53 Private Hosted Zone from VPC-SharedServices to VPC-Production and VPC-UAT.
  4. Deploy an AWS Transit Gateway (TGW) to connect the three VPCs. Set up a Transit Gateway attachment to an AWS Direct Connect Gateway connected to a transit virtual interface (transit VIF). Deploy a NAT Gateway in each active Availability Zone's public subnet in VPC-Production, VPC-UAT, and VPC-SharedServices, configuring private subnet route tables to point outbound traffic to the local NAT Gateway. Authorize and associate the Route 53 Private Hosted Zone in VPC-SharedServices with VPC-Production and VPC-UAT.Answer

Answer

Deploy an AWS Transit Gateway to connect the VPCs, use a Direct Connect Gateway with a transit VIF for hybrid routing, deploy a NAT Gateway in each active Availability Zone of each VPC for redundant and cost-efficient egress, and associate the Route 53 Private Hosted Zone with the consumer VPCs.
The correct design uses AWS Transit Gateway to establish transitive routing between the VPCs and to integrate with a Direct Connect Gateway using a transit virtual interface (transit VIF) for hybrid connectivity. To ensure high availability and prevent cross-AZ data transfer charges, NAT Gateways must be deployed in each active Availability Zone in each VPC. Lastly, the Route 53 Private Hosted Zone (PHZ) in VPC-SharedServices must be explicitly associated with VPC-Production and VPC-UAT using cross-account VPC association, allowing direct DNS resolution without endpoint costs.

Step-by-Step Solution

1
Select the appropriate hybrid and VPC-to-VPC routing component.
AWS Transit Gateway (TGW) attached to the VPCs and to a Direct Connect Gateway via a transit VIF.
Transit Gateway is required to support both scalable VPC-to-VPC transitive routing and hybrid connectivity over a single Direct Connect connection.
2
Design the outbound internet egress architecture.
Deploy a NAT Gateway in each active Availability Zone's public subnet within each VPC.
This guarantees high availability against Availability Zone outages and prevents cross-AZ data transfer charges.
3
Establish DNS resolution for the shared Private Hosted Zone.
Authorize and associate the Private Hosted Zone in VPC-SharedServices with VPC-Production and VPC-UAT.
Cross-account PHZ association allows the consumer VPCs to natively resolve domains in the private hosted zone without additional routing or endpoint costs.

Key Concept

Designing highly available, scalable hybrid network topologies with AWS Transit Gateway, redundant NAT Gateways, and cross-account Private Hosted Zone association.

Alternative Method

Instead of direct PHZ association, Route 53 Resolver Inbound and Outbound Endpoints could be used to forward queries, but this introduces additional cost, management overhead, and latency compared to native cross-account PHZ association.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic