Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

A financial services firm is launching a high-frequency trading analytics platform in the `eu-west-1` region across three VPCs: `vpc-trading-prod`, `vpc-marketdata-prod`, and `vpc-shared-mgmt`. The architecture has the following requirements:

1. All private resources must resolve internal service endpoints under the private domain `trading.local` which is managed in the `vpc-shared-mgmt` account.
2. The trading and market data applications require highly resilient, multi-AZ outbound connectivity to retrieve external financial feeds, ensuring that an outage in one Availability Zone does not impact egress in other zones.
3. Network latency between the VPCs must be minimized for inter-service communication.

Which two configurations should the solutions architect implement to satisfy these requirements? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone for `trading.local` with `vpc-trading-prod`, `vpc-marketdata-prod`, and `vpc-shared-mgmt` to allow direct DNS resolution in all VPCs.Answer
  2. Deploy a NAT Gateway in each active Availability Zone within `vpc-trading-prod` and `vpc-marketdata-prod` public subnets, and configure the private route tables to route default traffic to the local NAT Gateway in the same zone.Answer
  3. C
    Deploy a single NAT Gateway in a public subnet of `vpc-shared-mgmt`, and route all outbound internet traffic from `vpc-trading-prod` and `vpc-marketdata-prod` through an AWS Transit Gateway to this centralized NAT Gateway.
  4. D
    Set up Route 53 Resolver inbound and outbound endpoints in all three VPCs, and create forwarding rules to route queries for `trading.local` from the production VPCs to the inbound endpoint in `vpc-shared-mgmt`.
  5. E
    Use an AWS Direct Connect Gateway to establish transitive routing between the three VPCs and handle all inter-VPC private communication.

Answer

Associate the Route 53 Private Hosted Zone for `trading.local` with all three VPCs, and deploy a NAT Gateway in each active Availability Zone within `vpc-trading-prod` and `vpc-marketdata-prod` public subnets.
Directly associating the Route 53 Private Hosted Zone with all target VPCs provides a native, low-latency, and cost-effective DNS resolution without requiring Resolver endpoints. Furthermore, deploying a NAT Gateway in each active Availability Zone for the production VPCs ensures that outbound traffic remains resilient to a single zone outage.

Step-by-Step Solution

1
Analyze the DNS resolution requirement for the private domain `trading.local` across multiple VPCs in the same region.
Identify that a Route 53 Private Hosted Zone (PHZ) can be associated with multiple VPCs across different accounts, providing a simple, cost-effective, and native DNS resolution mechanism.
This avoids the complexity and cost of deploying Route 53 Resolver endpoints for intra-region cross-VPC DNS resolution.
2
Evaluate the egress internet connectivity requirements for the private workloads.
Determine that deploying a NAT Gateway in each Availability Zone in both production VPCs satisfies the high-resiliency constraint.
Deploying a single NAT Gateway or routing egress traffic through a centralized gateway in another VPC would introduce a single point of failure, violating the multi-AZ resilience requirement.

Key Concept

Designing highly resilient multi-VPC networking topologies on AWS, focusing on redundant NAT Gateways for internet egress and Route 53 Private Hosted Zone sharing across multiple VPCs.
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic