Examkin

Question

Difficulty: Very hardHybrid and Multi-Account Network Connectivity Design

A financial enterprise is designing a multi-account hybrid network to connect its on-premises data center to 2020 spoke VPCs distributed equally across the `us-east-1` and `us-west-2` Regions. The design must satisfy the following requirements:
- Hybrid Connectivity: Primary high-bandwidth path via a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection terminating near `us-east-1`. Backup connectivity using an AWS Site-to-Site VPN over the internet. Traffic must automatically fail over to the VPN if the DX connection fails.
- Routing: Inter-VPC communication across both regions must use the AWS private backbone. On-premises must access VPCs in both regions, preferring the DX path.
- Centralized Egress: All internet-bound traffic from all spoke VPCs must route through a centralized Security VPC in `us-east-1`. The egress path must be highly available and resilient to Availability Zone (AZ) failures.
- DNS Resolution: A single Route 53 Private Hosted Zone (PHZ) in a Shared Services account must be resolvable by all AWS resources in all VPCs and by on-premises clients.

Which architecture meets these requirements while ensuring correct routing, high availability, and DNS resolution?

  1. A
    Deploy an AWS Transit Gateway in `us-east-1` (TGW-East) and `us-west-2` (TGW-West), and peer them. Create a Direct Connect Gateway (DXGW) associated only with TGW-East, terminating a Transit VIF from the DX connection. Deploy a Site-to-Site VPN from on-premises only to TGW-East. Configure TGW-East to route `us-west-2` hybrid traffic over the TGW peering connection. In `us-east-1`, deploy a Security VPC with a NAT Gateway in each of the three active AZs, routing outbound traffic through TGW-East. Associate the Route 53 PHZ with all spoke VPCs in both regions, deploy Route 53 Inbound Resolvers in the Security VPC, and point on-premises DNS forwarders to these endpoints.
  2. B
    Deploy an AWS Transit Gateway in `us-east-1` (TGW-East) and `us-west-2` (TGW-West), and peer them. Create a Direct Connect Gateway (DXGW) associated with both TGWs, terminating a Transit VIF from the DX connection. Configure Site-to-Site VPNs from on-premises to both TGWs. In `us-east-1`, deploy a Security VPC with a NAT Gateway in each of the three active AZs, routing outbound traffic through TGW-East. Associate the Route 53 PHZ only with the Shared Services VPC. Rely on Transit Gateway routing to forward DNS queries from all other VPCs to the Shared Services VPC. Deploy Route 53 Inbound Resolvers in the Security VPC, and point on-premises DNS forwarders to these endpoints.
  3. Deploy an AWS Transit Gateway in `us-east-1` (TGW-East) and `us-west-2` (TGW-West), and peer them. Create a Direct Connect Gateway (DXGW) associated with both TGWs, terminating a Transit VIF from the DX connection. Configure Site-to-Site VPNs from on-premises to both TGWs. In `us-east-1`, deploy a Security VPC with TGW attachments, private subnets, and public subnets containing a NAT Gateway in each of the three active AZs. Configure TGW-East to route all 0.0.0.0/00.0.0.0/0 traffic to the Security VPC, where subnet route tables route traffic to the local NAT Gateway in the same AZ. Configure TGW-West to route 0.0.0.0/00.0.0.0/0 traffic via the peering connection to TGW-East. Associate the Route 53 PHZ with all spoke and transit VPCs in both regions, deploy Route 53 Inbound Resolvers in the Security VPC, and point on-premises DNS forwarders to these endpoints.Answer
  4. D
    Deploy an AWS Transit Gateway in `us-east-1` (TGW-East) and `us-west-2` (TGW-West), and peer them. Create a Direct Connect Gateway (DXGW) associated with both TGWs, terminating a Transit VIF from the DX connection. Configure Site-to-Site VPNs from on-premises to both TGWs. In `us-east-1`, deploy a Security VPC with TGW attachments, private subnets, and public subnets containing a single NAT Gateway in one AZ to minimize NAT Gateway hourly charges. Configure TGW-East to route all 0.0.0.0/00.0.0.0/0 traffic to the Security VPC, where subnet route tables in all AZs point to this single NAT Gateway. Configure TGW-West to route 0.0.0.0/00.0.0.0/0 traffic via the peering connection to TGW-East. Associate the Route 53 PHZ with all spoke and transit VPCs in both regions, deploy Route 53 Inbound Resolvers in the Security VPC, and point on-premises DNS forwarders to these endpoints.

Answer

The correct architecture associates the Direct Connect Gateway with both Transit Gateways, deploys redundant NAT Gateways across all active Availability Zones in the Security VPC, and associates the Private Hosted Zone with all VPCs.
The correct architecture establishes direct associations between the Direct Connect Gateway (DXGW) and both regional Transit Gateways (TGWs), ensuring that on-premises traffic to both regions is routed natively rather than crossing the TGW peering connection. It also implements high availability by deploying a NAT Gateway per Availability Zone within the Security VPC to avoid a single point of failure. Finally, it ensures DNS resolution by explicitly associating the Route 53 Private Hosted Zone (PHZ) with all spoke and transit VPCs and deploying Route 53 Inbound Resolvers for on-premises clients.

Step-by-Step Solution

1
Address the transit routing limitation of Transit Gateway Peering.
Since Transit Gateway peering does not support transitive routing for Direct Connect Gateway (DXGW) or VPN connections, the DXGW and Site-to-Site VPNs must be associated with both regional Transit Gateways (TGW-East and TGW-West) directly.
This ensures that on-premises traffic can reach both regions without relying on transit across the peering link, which AWS prohibits.
2
Design a highly available centralized internet egress architecture.
Deploy a Security VPC in `us-east-1` with TGW attachments in multiple Availability Zones (AZs) and a dedicated NAT Gateway in each active AZ.
Routing traffic to a local NAT Gateway in the same AZ prevents inter-AZ dependency and avoids introducing a single point of failure.
3
Establish the private DNS resolution across all accounts and regions.
Associate the Route 53 Private Hosted Zone (PHZ) with all spoke and transit VPCs across both regions.
A VPC must be explicitly associated with a PHZ for its instances to resolve queries for the private domain name, regardless of network connectivity.
4
Enable on-premises clients to resolve the private DNS domain.
Deploy Route 53 Inbound Resolvers in the central Security VPC and configure on-premises DNS servers to forward conditional queries for the private domain to the resolver endpoints.
On-premises clients cannot query the Route 53 private resolver IP directly without Inbound Resolvers acting as entry points.

Key Concept

AWS Transit Gateway transitive routing restrictions, high availability NAT Gateway patterns, and multi-region Route 53 Private Hosted Zone association.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic