Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a new multi-account, multi-region architecture on AWS to support its migration. The architecture consists of 10 VPCs in `us-east-1` and 10 VPCs in `us-west-2`, each deployed across two Availability Zones. The design must satisfy the following requirements:
1. Low-latency, private connectivity between all VPCs and the on-premises data center using an existing 10 Gbps AWS Direct Connect (DX) connection terminated in `us-east-1`.
2. VPCs within the same region must be able to communicate with each other, but cross-region VPC-to-VPC communication must be prevented.
3. High availability for outbound-only internet traffic from private subnets in all VPCs must be maintained during Availability Zone outages.
4. Internal DNS resolution for a single private namespace (`corp.internal`) must be available across all VPCs and on-premises.

Which of the following designs meets these requirements with the lowest operational complexity and cost?

  1. A
    Deploy an AWS Transit Gateway (TGW) in each region and attach the local VPCs. Associate both TGWs with a single Direct Connect Gateway connected to the Direct Connect connection. To minimize costs, deploy a single NAT Gateway in the first Availability Zone of a centralized egress VPC in `us-east-1` to route all internet traffic from both regions. Create a Route 53 Private Hosted Zone (PHZ) for the namespace and associate it with all 20 VPCs, and deploy Route 53 Inbound Resolver endpoints in a shared VPC in `us-east-1`.
  2. B
    Associate all 20 VPCs directly to a single Direct Connect Gateway using Virtual Private Gateways (VGWs) over a private virtual interface. Deploy a NAT Gateway in each Availability Zone of each VPC. Create a Route 53 Private Hosted Zone (PHZ) for the namespace and associate it with all 20 VPCs, and deploy Route 53 Inbound Resolver endpoints in a shared VPC in `us-east-1`.
  3. Deploy an AWS Transit Gateway (TGW) in each region and attach the local VPCs. Associate both TGWs with a single Direct Connect Gateway connected to the Direct Connect connection. Deploy a NAT Gateway in each Availability Zone of each VPC. Create a Route 53 Private Hosted Zone (PHZ) for the namespace and associate it with all 20 VPCs, and deploy Route 53 Inbound Resolver endpoints in a shared VPC in `us-east-1`.Answer
  4. D
    Deploy an AWS Transit Gateway (TGW) in each region and attach the local VPCs. Associate both TGWs with a single Direct Connect Gateway connected to the Direct Connect connection. Deploy a NAT Gateway in each Availability Zone of each VPC. Create a Route 53 Private Hosted Zone (PHZ) for the namespace and associate it only with a single shared services VPC in `us-east-1` to simplify administration, and deploy Route 53 Inbound Resolver endpoints in that shared VPC.

Answer

Deploying an AWS Transit Gateway in each region connected to a single Direct Connect Gateway provides local VPC-to-VPC routing and hybrid connectivity without cross-region VPC communication. Deploying a NAT Gateway in each Availability Zone of each VPC maintains high availability, and associating the Route 53 Private Hosted Zone with all 20 VPCs ensures correct DNS resolution.
The correct design uses a Transit Gateway (TGW) in each region to route traffic between local VPCs, fulfilling the requirement for intra-region VPC-to-VPC communication. By connecting both TGWs to a single Direct Connect Gateway (DXGW), the architecture establishes on-premises connectivity. Since a DXGW does not route traffic between associated Transit Gateways, cross-region VPC-to-VPC communication is prevented by default. Deploying a NAT Gateway in each Availability Zone of every VPC ensures that outbound internet access is resilient to Availability Zone failures. Finally, associating the Route 53 Private Hosted Zone (PHZ) with all 20 VPCs ensures that DNS resolution for the `corp.internal` namespace works everywhere, as PHZs must be associated with each VPC in which resolution is needed.

Step-by-Step Solution

1
Design regional transit routing and hybrid connectivity.
Deploy a Transit Gateway (TGW) in each region and associate both TGWs with a single Direct Connect Gateway (DXGW) connected to the on-premises Direct Connect location.
This setup enables VPC-to-VPC communication within each region via the local TGW. Since the DXGW does not route traffic transitively between associated TGWs, cross-region VPC-to-VPC traffic is prevented, and hybrid connectivity is securely established.
2
Implement highly available outbound internet egress.
Deploy a NAT Gateway in each Availability Zone of each VPC and update private route tables to route egress traffic (0.0.0.0/00.0.0.0/0) to the local NAT Gateway in the same zone.
This guarantees that if an Availability Zone experiences an outage, instances in the remaining zones can still access the internet, satisfying the high availability constraint.
3
Configure private DNS resolution across all VPCs and on-premises.
Create a Route 53 Private Hosted Zone for `corp.internal` and associate it with all 20 VPCs across both regions. Deploy Route 53 Inbound Resolver endpoints in a shared VPC in `us-east-1` to process queries from on-premises DNS forwarders.
Private Hosted Zones do not support transitive resolution across Transit Gateway attachments; they must be explicitly associated with each VPC that needs name resolution.

Key Concept

Multi-region hybrid network design with Transit Gateway, Direct Connect Gateway, redundant NAT Gateways, and cross-account Route 53 Private Hosted Zone association.
Estimated Time:2m 30s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic