Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new network architecture in the `us-east-1` region to support three spoke VPCs (`vpc-prod`, `vpc-dev`, and `vpc-test`) and a central egress VPC (`vpc-egress`). An AWS Transit Gateway (`tgw-central`) connects all four VPCs. The workloads in the spoke VPCs are distributed across two Availability Zones (AZ−AAZ-A and AZ−BAZ-B) and require outbound internet access to download software updates. The design must ensure that the failure of a single Availability Zone does not disrupt outbound internet connectivity for any of the workloads, while minimizing overall NAT Gateway costs. Which of the following architectures should the Solutions Architect recommend?

  1. Deploy two NAT Gateways in `vpc-egress`, with one in a public subnet in AZ−AAZ-A and the other in a public subnet in AZ−BAZ-B. Configure the Transit Gateway route table to route 0.0.0.0/00.0.0.0/0 traffic from the spoke VPCs to the `vpc-egress` attachment. Within `vpc-egress`, configure the route tables of the Transit Gateway subnets in each Availability Zone to route outbound traffic to the local NAT Gateway in the same zone.Answer
  2. B
    Deploy a single NAT Gateway in `vpc-egress` in a public subnet in AZ−AAZ-A. Configure the Transit Gateway route table to route all 0.0.0.0/00.0.0.0/0 traffic from the spoke VPCs to the `vpc-egress` attachment. Within `vpc-egress`, configure the route tables of the Transit Gateway subnets in both AZ−AAZ-A and AZ−BAZ-B to route outbound traffic to this single NAT Gateway.
  3. C
    Deploy two NAT Gateways in `vpc-egress`, with one in AZ−AAZ-A and one in AZ−BAZ-B. In the spoke VPCs, associate a Route 53 Private Hosted Zone (PHZ) for the update endpoints with `vpc-egress` only. Rely on the Transit Gateway to transitively forward the DNS queries from the spoke VPCs to the PHZ associated with `vpc-egress` to resolve update endpoint domain names.
  4. D
    Deploy two NAT Gateways in `vpc-egress` across AZ−AAZ-A and AZ−BAZ-B. Instead of using AWS Transit Gateway, configure AWS Direct Connect Gateway to establish transitive routing connections between the spoke VPCs and the central egress VPC for all outbound internet traffic.

Answer

Deploying two NAT Gateways in the central egress VPC (one in each Availability Zone) and routing traffic from the spoke VPCs through the Transit Gateway to the egress VPC, where zone-specific routing directs traffic to the local NAT Gateway.
The correct architecture centralizes outbound internet egress in a shared `vpc-egress` VPC by deploying two NAT Gateways across two Availability Zones (AZ−AAZ-A and AZ−BAZ-B). Outbound traffic from the spoke VPCs is sent to the AWS Transit Gateway, which routes it to the egress VPC. By configuring the route tables in `vpc-egress` to send traffic from the Transit Gateway subnet attachment in each zone to the corresponding local NAT Gateway, the architecture ensures full Availability Zone redundancy while keeping the NAT Gateway count to a minimum of two instead of deploying two per spoke VPC.

Step-by-Step Solution

1
Analyze the high availability requirement for outbound internet access across Availability Zones.
Determined that at least two NAT Gateways are required, distributed across two different Availability Zones to avoid a single point of failure.
If only one NAT Gateway is used, an outage in that Availability Zone would disrupt internet access for all workloads in all zones.
2
Evaluate the cost constraint of minimizing NAT Gateway deployment costs.
Centralizing egress traffic into a single shared Egress VPC requires only two NAT Gateways in total, rather than deploying two NAT Gateways in each of the three spoke VPCs (which would require six NAT Gateways).
NAT Gateways incur hourly charges and data processing rates. Minimizing the count of NAT Gateways reduces fixed hourly costs.
3
Configure Transit Gateway and local subnet routing for the egress path.
Workloads route 0.0.0.0/00.0.0.0/0 to the Transit Gateway, which forwards traffic to `vpc-egress`. Within `vpc-egress`, routing ensures that traffic originating from or landing in AZ−AAZ-A goes to the NAT Gateway in AZ−AAZ-A, and traffic for AZ−BAZ-B goes to the NAT Gateway in AZ−BAZ-B.
This keeps traffic within the same Availability Zone for resilience and lower latency, preventing cross-AZ traffic charges where possible and securing path isolation.

Key Concept

Centralized egress VPC architecture with multi-AZ NAT Gateway redundancy and Transit Gateway routing.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic