Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A healthcare provider is deploying a patient management platform across multiple AWS accounts in the us-east-1 region. The platform requires high-speed, secure, and private connectivity between three Application VPCs (vpc-app-a, vpc-app-b, vpc-app-c) and a Shared Services VPC (vpc-shared). The application instances must resolve internal domain names registered in a Route 53 Private Hosted Zone (PHZ) hosted in vpc-shared. Additionally, instances in the Application VPCs must access the internet for software updates, but they do not have public IP addresses and cannot receive inbound connections from the internet. The architecture must minimize latency, ensure high availability across Availability Zones, and avoid single points of failure.

Which combination of networking actions should a Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone in the Shared Services account with vpc-app-a, vpc-app-b, and vpc-app-c by creating VPC associations.Answer
  2. Create an AWS Transit Gateway, attach all four VPCs, and route egress traffic from the Application VPCs to a centralized egress VPC containing a NAT Gateway in each Availability Zone.Answer
  3. C
    Create an AWS Transit Gateway, attach all four VPCs, and route egress traffic from the Application VPCs to a centralized egress VPC containing a single NAT Gateway in one Availability Zone to minimize NAT hourly costs.
  4. D
    Rely on the Transit Gateway to automatically propagate DNS queries from the Application VPCs to the Shared Services VPC where the Private Hosted Zone is located, without creating VPC associations.
  5. E
    Configure VPC Peering connections between the Application VPCs and the Shared Services VPC, and use a Direct Connect Gateway to enable transitive VPC-to-VPC routing and internet egress.

Answer

The correct actions are to associate the Route 53 Private Hosted Zone in the Shared Services account with all Application VPCs, and to deploy an AWS Transit Gateway with a centralized egress VPC that contains redundant NAT Gateways across multiple Availability Zones.
Associating the Route 53 Private Hosted Zone with each Application VPC allows the instances inside those VPCs to resolve internal domain names hosted in the Shared Services account. Deploying an AWS Transit Gateway and using a centralized egress VPC with multiple NAT Gateways (one per Availability Zone) provides high availability and eliminates single points of failure for outbound internet traffic.

Step-by-Step Solution

1
Configure DNS resolution for the private hosted zone across VPC boundaries.
Create VPC associations between the Route 53 Private Hosted Zone and vpc-app-a, vpc-app-b, and vpc-app-c.
This allows instances in the application VPCs to use the local Route 53 Resolver to resolve the custom domains hosted in the shared services VPC.
2
Establish transitive routing across the multi-account mesh.
Deploy an AWS Transit Gateway and attach all four VPCs to it.
Transit Gateway enables scalable, hub-and-spoke connectivity between multiple VPCs without the limitation of non-transitive VPC peering.
3
Configure resilient internet egress routing.
Deploy a NAT Gateway in each Availability Zone of the centralized egress VPC and update Transit Gateway route tables to send outbound traffic through them.
Using multiple NAT Gateways distributed across Availability Zones ensures that an outage in one zone does not disrupt internet egress for the rest of the application VPCs.

Key Concept

Multi-VPC Route 53 Private Hosted Zone association and high-availability centralized NAT egress routing using AWS Transit Gateway.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic