Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new cloud infrastructure on AWS. The design consists of a central Shared Services VPC and two spoke VPCs (Spoke-A and Spoke-B) in the `us-east-1` Region, all connected via an AWS Transit Gateway. The application servers in the spoke VPCs must resolve internal domain names registered in a Route 53 Private Hosted Zone (`corp.internal`) that is hosted in the Shared Services AWS account. Additionally, all spoke VPCs must route outbound internet traffic through the Shared Services VPC, which must be highly resilient against an Availability Zone outage.

Which two configurations should a solutions architect implement to satisfy these requirements? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone `corp.internal` with both Spoke-A VPC and Spoke-B VPC.Answer
  2. Deploy a NAT Gateway in each Availability Zone of the Shared Services VPC, and route outbound traffic from each private subnet to its corresponding local NAT Gateway.Answer
  3. C
    Configure a single Direct Connect Gateway to establish transitive routing for internet-bound traffic from the spoke VPCs to the Shared Services VPC.
  4. D
    Rely on the AWS Transit Gateway to automatically propagate DNS records from the `corp.internal` Private Hosted Zone to all attached spoke VPCs without manual VPC association.
  5. E
    Deploy a single NAT Gateway in the Shared Services VPC to reduce cost, and point the default route `0.0.0.0/0` of all subnets across all Availability Zones to this single NAT Gateway.

Answer

Associate the Route 53 Private Hosted Zone with the spoke VPCs, and deploy a NAT Gateway in each Availability Zone of the Shared Services VPC.
To satisfy the requirements, the solutions architect must configure Route 53 Private Hosted Zone associations and highly available NAT Gateways. First, the Private Hosted Zone `corp.internal` must be associated with both spoke VPCs to allow Route 53 to resolve internal domain names within those networks. Second, deploying a NAT Gateway in each Availability Zone of the Shared Services VPC ensures that outbound traffic routes to a local gateway, eliminating cross-AZ dependencies and ensuring high availability during an Availability Zone outage.

Step-by-Step Solution

1
Associate the Private Hosted Zone `corp.internal` in the Shared Services account with the spoke VPCs (Spoke-A and Spoke-B).
DNS queries for the `corp.internal` domain originating from the spoke VPCs can be resolved by AWS Route 53 resolver endpoints.
By default, a Private Hosted Zone is only accessible within the VPCs to which it is explicitly associated.
2
Deploy multiple NAT Gateways, one in each public subnet across the Availability Zones in the Shared Services VPC.
Availability Zone redundancy is established for outbound traffic, ensuring no single AZ outage disrupts internet egress for the entire VPC mesh.
A single NAT Gateway deployment introduces an AZ-level single point of failure.
3
Configure the route tables in the private subnets of the Shared Services VPC to route outbound traffic to their local NAT Gateways, and configure Transit Gateway route tables to route spoke VPC egress traffic to the Shared Services VPC.
Outbound traffic from all spoke VPCs is routed to the Shared Services VPC and egresses highly available NAT Gateways.
This establishes the complete end-to-end egress path through Transit Gateway and ensures AZ-independent routing paths.

Key Concept

Multi-VPC DNS resolution with Private Hosted Zones and highly available centralized egress architecture using AWS Transit Gateway and NAT Gateways.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic