Examkin

Question

Difficulty: Very hardNetworking and Connectivity Design

An enterprise is designing a highly secure and regulated payment processing network on AWS. The architecture is deployed across three AWS Regions (us-east-1, eu-west-1, and ap-southeast-1) and utilizes a multi-account structure managed under AWS Organizations. A dedicated Shared Services account hosts core services, including a Route 53 Private Hosted Zone (PHZ) named payment.internal. Multiple application accounts contain spoke VPCs that run transactional workloads across multiple Availability Zones. These workloads require resolution of names within payment.internal, resilient outbound internet access, and low-latency hybrid connectivity to an on-premises partner data center via AWS Direct Connect. Which TWO configurations should a solutions architect implement to meet these requirements while preventing single points of failure and routing limitations?

  1. In the Shared Services account, create a Route 53 Private Hosted Zone association authorization for each application spoke VPC, and then associate the zone with those VPCs from their respective application accounts using the Route 53 API or AWS CLI.Answer
  2. In each application spoke VPC, deploy a NAT Gateway in each Availability Zone where application workloads are running, and configure the route table of the private subnets in each Availability Zone to route default outbound traffic (0.0.0.0/0) to the local NAT Gateway in that same Availability Zone.Answer
  3. C
    Deploy a Route 53 Resolver inbound endpoint in the Shared Services VPC, and configure Route 53 Resolver outbound endpoints in the application spoke VPCs to forward queries for payment.internal directly to the inbound endpoint without associating the Private Hosted Zone with the spoke VPCs.
  4. D
    Deploy a single NAT Gateway in the Shared Services VPC, and configure the regional Transit Gateways to route all default outbound traffic (0.0.0.0/0) from the application spoke VPCs to this central NAT Gateway to minimize NAT processing costs.
  5. E
    Configure the Direct Connect Gateway to act as a transitive hub between the application spoke VPCs and the on-premises partner network, allowing direct VPC-to-VPC routing over the Direct Connect Gateway without using AWS Transit Gateway.

Answer

To satisfy the requirements, the solutions architect must associate the Private Hosted Zone with the consumer VPCs using cross-account association authorizations, and deploy redundant, independent NAT Gateways in each Availability Zone for private subnet outbound routing.
To achieve secure, cross-account resolution of names within the Private Hosted Zone, the zone must be associated with the application spoke VPCs. Since the VPCs and the zone reside in different AWS accounts, the zone owner must first create a Private Hosted Zone association authorization, and then the spoke VPC owners must associate the zone. Additionally, to avoid a single point of failure for outbound internet traffic, NAT Gateways must be deployed in each active Availability Zone with local subnet routing. This setup prevents an outage in one Availability Zone from taking down egress connectivity for workloads in other Availability Zones.

Step-by-Step Solution

1
Establish cross-account DNS resolution
Authorize the association of the Private Hosted Zone from the Shared Services account to the spoke VPCs, then submit the association requests from the application accounts.
Route 53 Private Hosted Zones require direct VPC association to resolve queries locally. In a multi-account environment, this is achieved via the association authorization workflow.
2
Ensure NAT Gateway redundancy
Deploy a NAT Gateway in each active Availability Zone within each spoke VPC and map local private subnet route tables to their respective zone's NAT Gateway.
This configuration ensures that an outage in one Availability Zone does not impact egress network paths for workloads running in different Availability Zones, avoiding a single point of failure.
3
Acknowledge transitive routing limits of Direct Connect Gateway
Ensure AWS Transit Gateway is used for multi-VPC routing instead of attempting to use Direct Connect Gateway for VPC-to-VPC routing.
Direct Connect Gateway does not support transitive VPC-to-VPC routing.

Key Concept

Multi-account private DNS resolution and high-availability egress routing
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic