Examkin

Question

Difficulty: Very hardModernizing Workloads using Containers (ECS and EKS)

AeroTelemetry Systems is modernizing its on-premises SCADA telemetry pipeline by migrating its ingestion microservices to an Amazon EKS cluster. Due to strict data residency regulations and sub-10 ms10\text{ ms} latency requirements for local factory machinery, the EKS worker nodes are deployed on an AWS Outposts rack in the local facility, while the EKS control plane is hosted in the parent AWS Region. The ingestion pods running on the Outposts nodes must securely and privately connect to an Amazon Aurora PostgreSQL database located in a database VPC within the parent Region. An Amazon Route 53 Private Hosted Zone (PHZ) for 'telemetry-db.internal' is hosted in a central shared services AWS account. The EKS Outposts VPC and the database VPC are connected via an AWS Transit Gateway. The system must maintain an SLA of 99.99%99.99\% ingestion availability, survive WAN connectivity drops of up to 2 hours2\text{ hours} to the parent AWS Region without failing local DNS resolution, and comply with data residency standards that prohibit telemetry data transit over the public internet. Which architecture meets these requirements while ensuring local DNS resilience and private connectivity?

  1. Authorize and associate the Private Hosted Zone 'telemetry-db.internal' in the shared services account with the EKS Outposts VPC. Deploy a Route 53 Resolver on Outposts in the EKS Outposts VPC. Configure the CoreDNS ConfigMap in the EKS cluster to forward DNS queries for 'telemetry-db.internal' to the Route 53 Resolver on Outposts endpoint, and configure Transit Gateway static routes to route database-bound traffic between the EKS Outposts VPC and the database VPC.Answer
  2. B
    Create Route 53 Resolver inbound endpoints in the shared services VPC and outbound endpoints in the EKS Outposts VPC. Set up a Route 53 Resolver forwarding rule in the EKS Outposts VPC to forward queries for 'telemetry-db.internal' to the inbound endpoints in the shared services account over Transit Gateway, and configure Transit Gateway static routes to route database-bound traffic.
  3. C
    Authorize and associate the Private Hosted Zone 'telemetry-db.internal' in the shared services account with the EKS Outposts VPC. Deploy a Route 53 Resolver on Outposts in the EKS Outposts VPC. Configure the CoreDNS ConfigMap in the EKS cluster to forward DNS queries to the Route 53 Resolver on Outposts endpoint. Connect the EKS Outposts VPC and the database VPC to an AWS Direct Connect Gateway directly to enable transitive VPC-to-VPC routing for database traffic, bypassing the Transit Gateway.
  4. D
    Deploy an AWS Fargate profile on EKS to run the ingestion pods on the Outposts rack, configuring the tasks with the 'bridge' network mode to minimize VPC IP address consumption. Authorize and associate the Private Hosted Zone 'telemetry-db.internal' in the shared services account with the EKS Outposts VPC. Set up a Route 53 Resolver on Outposts to handle DNS queries locally, and configure Transit Gateway static routes to route database-bound traffic.

Answer

The correct option is the one that authorizes the private hosted zone in the shared services account, associates it with the EKS Outposts VPC, deploys a Route 53 Resolver on Outposts to ensure local DNS resolution during WAN outages, and utilizes Transit Gateway for private cross-VPC routing.
The correct option is correct because Route 53 Resolver on Outposts provides local DNS caching and resolution within the Outpost environment, ensuring that the EKS pods can resolve the database domain even during a WAN link failure to the parent Region. Associating the cross-account Private Hosted Zone directly with the EKS Outposts VPC enables local resolution of the private DNS name. Transit Gateway static routing allows secure, private cross-VPC communication between the Outposts VPC and the database VPC.

Step-by-Step Solution

1
Enable cross-account VPC association for the Route 53 Private Hosted Zone.
The EKS Outposts VPC can be associated with the 'telemetry-db.internal' hosted zone from the shared services account.
Private Hosted Zones must be explicitly authorized and associated to VPCs across accounts to allow resolution of private domain names.
2
Deploy Route 53 Resolver on Outposts in the EKS Outposts VPC and point CoreDNS to its endpoint.
Pods resolve DNS queries locally on the Outposts hardware, cache results, and maintain resolution capabilities during WAN outages.
Outposts require a local resolver to satisfy sub-10 ms10\text{ ms} latency and survive parent Region connectivity drops.
3
Configure Transit Gateway routing between the EKS Outposts VPC and the Database VPC.
Network packets route privately over AWS networks without using the public internet.
Transit Gateway is required to establish private VPC-to-VPC communication.

Key Concept

Local VPC DNS resolution and private cross-account container communication on AWS Outposts.

Alternative Method

Alternatively, Route 53 Resolver endpoints can be deployed locally on AWS Outposts to resolve DNS queries from on-premises clients, but for pods inside the EKS cluster running in the VPC, using the Local VPC Resolver (Route 53 Resolver on Outposts) is the standard and most resilient method.
Estimated Time:3m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic