Examkin

Question

Difficulty: MediumHybrid and Multi-Account Network Connectivity Design

A financial services company is designing a multi-account architecture in AWS for its applications across 1010 spoke VPCs in the us-east-1 region. The security team requires all outbound internet traffic to be routed through a centralized egress VPC for inspection, and all internal DNS queries for private resources to be resolved using a shared Route 53 Private Hosted Zone (PHZ) hosted in a Central Services account. The architecture must minimize cost, avoid single points of failure, and minimize administrative overhead. Which combination of actions should the network architect perform to meet these requirements? (Select TWO.)

  1. Deploy NAT Gateways in multiple Availability Zones within the centralized egress VPC, and configure a default route of 0.0.0.0/00.0.0.0/0 in the spoke Transit Gateway route table pointing to the egress VPC attachment.Answer
  2. Authorize and associate the Route 53 Private Hosted Zone from the Central Services account with each of the spoke VPCs across the different AWS accounts.Answer
  3. C
    Deploy a single NAT Gateway in the centralized egress VPC to reduce NAT Gateway hourly charges, and route all spoke VPC outbound traffic to it.
  4. D
    Deploy Route 53 Resolver inbound and outbound endpoints in each spoke VPC to forward all DNS queries to the Central Services account for resolution.
  5. E
    Establish VPC peering connections between the Central Services VPC and all spoke VPCs to allow the spokes to resolve DNS queries directly over the peering links.

Answer

Deploy NAT Gateways in multiple Availability Zones in the egress VPC with Transit Gateway routing, and associate the Route 53 Private Hosted Zone directly with all spoke VPCs.
Deploying NAT Gateways in multiple Availability Zones ensures high availability and eliminates a single point of failure for outbound traffic. Setting a default route (0.0.0.0/00.0.0.0/0) in the Transit Gateway route table directing traffic to the centralized egress VPC correctly routes all outbound internet traffic. Authorizing and associating the Route 53 Private Hosted Zone from the Central Services account directly with the spoke VPCs allows for cross-account DNS resolution of private records with minimal cost and administrative overhead.

Step-by-Step Solution

1
Deploy NAT Gateways in multiple Availability Zones within the centralized egress VPC and configure a default route pointing to them in the public subnet route tables.
Highly available outbound path is established in the egress VPC, preventing any single Availability Zone outage from disabling internet access for the spokes.
NAT Gateways are required to translate private IPs to public IPs for outbound traffic, and distributing them across Availability Zones ensures redundancy.
2
Attach the spoke VPCs and the egress VPC to the Transit Gateway, and configure a default route (0.0.0.0/00.0.0.0/0) in the spoke Transit Gateway route table targeting the egress VPC attachment.
Outbound traffic from all spoke VPCs is consolidated and forwarded to the egress VPC through the Transit Gateway.
This centralizes outbound traffic routing, enabling security inspection and reducing the cost of running NAT Gateways in every spoke VPC.
3
Authorize the cross-account association of the Route 53 Private Hosted Zone from the Central Services account using the AWS CLI or SDK, and then associate the zone with the spoke VPCs in the application accounts.
All spoke VPCs can directly resolve private DNS records defined in the shared hosted zone.
Direct association is the most cost-effective and operationally simple method to share a Private Hosted Zone across multiple AWS accounts, avoiding the cost of DNS Resolver endpoints.

Key Concept

Centralized egress network design with high availability NAT Gateways and multi-account Route 53 Private Hosted Zone sharing.
Rate this question

Topics

Hybrid and Multi-Account Network Connectivity Design

More questions from this topic