Examkin

Question

Difficulty: Very hardEnhancing Reliability and Disaster Recovery

An enterprise runs a critical tracking application across two AWS accounts in an AWS Organization. Account A hosts the primary production workload in the ap-southeast-1 region, consisting of Amazon ECS Fargate tasks in a private VPC. The application writes to an Amazon Aurora PostgreSQL Global Database with the primary cluster in Account A (ap-southeast-1) and a secondary read-replica cluster in Account B (ap-northeast-1). A Route 53 Private Hosted Zone (PHZ) named db.logistics.internal is hosted in Account A and is associated only with Account A's VPC. During a disaster recovery drill, the primary region experienced a simulated failure. The solutions architect promoted the database cluster in ap-northeast-1 to primary, but the ECS Fargate tasks in Account B (ap-northeast-1) failed to resolve db.logistics.internal. Additionally, an earlier localized Availability Zone outage in ap-southeast-1 had caused all outbound API integration traffic from the remaining zones to fail. The business requires an RTO of 10 minutes and an RPO of 1 minute. Which combination of actions should the solutions architect take to resolve these issues and satisfy the reliability requirements?

  1. Authorize the cross-account association of the db.logistics.internal Private Hosted Zone in Account A with Account B's VPC in ap-northeast-1 using the Route 53 API. Associate the VPC with the zone in Account B. In Account A, deploy a NAT Gateway in each Availability Zone's public subnet and update the private route tables to route outbound traffic to the local NAT Gateway within the same zone.Answer
  2. B
    Create a duplicate Private Hosted Zone named db.logistics.internal in Account B's VPC in ap-northeast-1 with identical CNAME records. In Account A, deploy a NAT Gateway in each Availability Zone's public subnet and configure the private route tables to route traffic to the local NAT Gateway within each zone.
  3. C
    Authorize the cross-account association of the db.logistics.internal Private Hosted Zone in Account A with Account B's VPC in ap-northeast-1 using the Route 53 API. Associate the VPC with the zone in Account B. In Account A, deploy a single NAT Gateway in one public subnet and update the private route tables across all Availability Zones to route outbound traffic through this single gateway to optimize running costs.
  4. D
    Authorize the cross-account association of the db.logistics.internal Private Hosted Zone in Account A with Account B's VPC in ap-northeast-1 using the Route 53 API. Replace the Aurora Global Database with a nightly snapshot replication process to Account B to reduce continuous cross-region data transfer costs, and recover the database by restoring the snapshot to a new Aurora cluster during failover.

Answer

Authorize the cross-account association of the db.logistics.internal Private Hosted Zone in Account A with Account B's VPC in ap-northeast-1 using the Route 53 API, associate the VPC with the zone in Account B, and deploy a NAT Gateway in each Availability Zone's public subnet in Account A while updating route tables to route outbound traffic through the local NAT Gateway within each zone.
The correct action resolves both critical issues while maintaining the active-standby database replication scheme needed to satisfy the RTO and RPO. First, by authorizing the cross-account association of the Route 53 Private Hosted Zone from Account A and associating it with the VPC in Account B, the ECS Fargate tasks in the recovery region can successfully resolve the database endpoint domain. Second, by deploying a NAT Gateway in each Availability Zone's public subnet in Account A and updating the corresponding route tables, outbound internet traffic is kept within the same zone, which removes the single point of failure and ensures that an outage in one zone does not disrupt outbound integrations for tasks running in the remaining healthy zones.

Step-by-Step Solution

1
Authorize cross-account Private Hosted Zone (PHZ) association.
Generate a VPC association authorization from Account A (which owns the PHZ) for the VPC in Account B using the Route 53 API.
By default, Route 53 Private Hosted Zones cannot be associated with VPCs in other AWS accounts without explicit cross-account authorization.
2
Associate the target VPC with the authorized PHZ.
Accept the association from Account B for its VPC in the ap-northeast-1 region.
This establishes cross-account DNS resolution, allowing the ECS Fargate tasks in the recovery region to resolve the database domain.
3
Deploy multiple NAT Gateways for redundancy.
Provision a NAT Gateway in a public subnet for each Availability Zone in Account A's VPC.
A single NAT Gateway is localized to a single Availability Zone. To ensure that an AZ outage does not drop traffic for all other AZs, each zone must have its own NAT Gateway.
4
Update private route tables.
Configure the route table of each private subnet to point its 0.0.0.0/0 route to the NAT Gateway in the corresponding Availability Zone.
This ensures localized outbound traffic routing and removes the single point of failure.

Key Concept

Cross-account Route 53 Private Hosted Zone association combined with multi-AZ redundant NAT Gateway architecture for high availability and disaster recovery.
Estimated Time:3m 0s
Rate this question

Topics

Enhancing Reliability and Disaster Recovery