Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-account network topology in the us-east-1 region. The architecture requires connecting three spoke VPCs (vpc-spoke-a in Account A, vpc-spoke-b in Account B, and vpc-spoke-c in Account C) to a central egress VPC (vpc-egress-shared) in a Shared Services Account to enable outbound internet access and shared DNS resolution. The spoke VPCs contain private workloads that must resolve a private hosted zone (PHZ) corp.internal hosted in the Shared Services Account. The design must be highly available across two Availability Zones and minimize administrative overhead. Which of the following actions should the Solutions Architect perform to implement this architecture? (Select TWO.)

  1. Deploy an AWS Transit Gateway named tgw-central-egress in the Shared Services account, share it with the spoke accounts using AWS Resource Access Manager, and attach the spoke and egress VPCs. In the egress VPC vpc-egress-shared, deploy a NAT Gateway in each of the two Availability Zones, and configure the spoke VPC route tables to route all outbound traffic (0.0.0.0/0) to the Transit Gateway.Answer
  2. For the private hosted zone corp.internal in the Shared Services account, create a VPC association authorization for each spoke VPC (vpc-spoke-a, vpc-spoke-b, and vpc-spoke-c), and then associate the hosted zone with the spoke VPCs using the AWS CLI, SDK, or API.Answer
  3. C
    Deploy a single NAT Gateway in one Availability Zone of the egress VPC vpc-egress-shared, and configure all spoke VPC route tables to route outbound internet traffic to this NAT Gateway via the Transit Gateway to minimize operational costs.
  4. D
    Establish VPC Peering connections between each spoke VPC (vpc-spoke-a, vpc-spoke-b, vpc-spoke-c) and the egress VPC vpc-egress-shared, and configure the spoke route tables to route 0.0.0.0/0 traffic through the peering connections to the NAT Gateways.
  5. E
    Associate the Private Hosted Zone corp.internal with the spoke VPCs (vpc-spoke-a, vpc-spoke-b, and vpc-spoke-c) directly from the Route 53 console within Accounts A, B, and C to enable cross-account DNS resolution.

Answer

Deploying a shared AWS Transit Gateway with multi-AZ NAT Gateways in the egress VPC, and establishing cross-account Private Hosted Zone associations using VPC association authorizations.
The correct solutions involve configuring an AWS Transit Gateway to act as a hub for transitive routing and setting up cross-account VPC associations for the Private Hosted Zone. By sharing the Transit Gateway via AWS Resource Access Manager and attaching the spoke VPCs and the central egress VPC, all spoke VPCs can route internet-bound traffic to the egress VPC. Deploying NAT Gateways in multiple Availability Zones in the egress VPC ensures high availability. To resolve DNS queries for the private hosted zone in the spoke VPCs, a VPC association authorization must be created in the Shared Services account, allowing the spoke VPCs to be associated with the hosted zone.

Step-by-Step Solution

1
Deploy and share the AWS Transit Gateway using AWS Resource Access Manager (RAM).
Spoke VPCs and the central egress VPC can attach to the Transit Gateway, enabling centralized connectivity.
This establishes the physical and logical hub-and-spoke networking foundation for transitive traffic.
2
Deploy NAT Gateways in multiple Availability Zones of the central egress VPC and update route tables.
Outbound internet traffic is routed from spokes through the Transit Gateway to the NAT Gateways in a highly available manner.
This satisfies the requirement for resilient internet egress across two Availability Zones.
3
Create VPC association authorizations for the Private Hosted Zone (PHZ) and associate the spoke VPCs.
The spoke VPCs are associated with the PHZ in the Shared Services account.
This allows workloads in spoke VPCs to resolve DNS queries for the corp.internal domain.

Key Concept

Designing multi-account network architectures with centralized egress, resilient routing, and cross-account DNS resolution.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic