An enterprise is designing a secure hybrid and multi-account network topology for spoke VPCs distributed across two AWS Regions: us-east-1 and us-west-2. The spoke VPCs are owned by different AWS accounts within an AWS Organization.
The network requirements are:
- High-throughput, private hybrid connectivity to an on-premises data center.
- Centralized egress to the internet through a dedicated Security VPC in us-east-1 using NAT Gateways.
- Private DNS resolution where all spoke VPCs must resolve internal AWS resources defined in a central Route 53 Private Hosted Zone (PHZ) under a Shared Services account, as well as on-premises domains ending in `.corp`.
- A highly resilient design with no single points of failure.
Which TWO of the following configurations should the Solutions Architect implement to meet these requirements?
- Deploy redundant NAT Gateways across multiple Availability Zones in the us-east-1 Security VPC, and configure the us-east-1 Transit Gateway (TGW) route tables to direct outbound internet traffic () to the Security VPC attachment.Answer
- Create Route 53 Resolver outbound endpoints in the Shared Services VPC, and use cross-account authorizations to associate the central Private Hosted Zone (PHZ) individually with all spoke VPCs.Answer
- CAssociate the central Private Hosted Zone (PHZ) with the regional Transit Gateways (TGWs) to allow all attached spoke VPCs to resolve the private hostnames transitively.
- DDeploy a single NAT Gateway in the us-east-1 Security VPC to minimize running costs, and configure the Transit Gateway (TGW) route table to direct outbound internet traffic () from all Availability Zones to the subnet hosting that NAT Gateway.
- EAssociate the Direct Connect Gateway (DXGW) directly with the Virtual Private Gateways (VGWs) of all spoke VPCs to route inter-VPC traffic transitively and provide hybrid connectivity.