Examkin

Question

Difficulty: HardNetworking and Connectivity Design

An enterprise is designing a new multi-account architecture in the `ap-northeast-1` region. The architecture contains:

* An application VPC (`vpc-tokyo-app`, CIDR 10.200.0.0/1610.200.0.0/16) spanning two Availability Zones (`ap-northeast-1a` and `ap-northeast-1c`).
* A shared services VPC (`vpc-tokyo-shared`, CIDR 10.210.0.0/1610.210.0.0/16) spanning `ap-northeast-1a` and `ap-northeast-1c`, which hosts a centralized Route 53 Private Hosted Zone (PHZ) named `corp.internal`.
* An on-premises datacenter connected via a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection terminating at a Direct Connect Gateway (DXGW).

The requirements are:
1. All spoke VPCs must route outbound internet traffic through centralized NAT Gateways in `vpc-tokyo-shared`.
2. The network architecture must be highly resilient against Availability Zone failures.
3. Resources in both `vpc-tokyo-app` and the on-premises datacenter must be able to resolve DNS queries for `corp.internal`.
4. Route propagation must be automated to minimize administrative routing overhead.

Which of the following designs best meets these requirements?

  1. A
    Deploy an AWS Transit Gateway (TGW) and attach `vpc-tokyo-app` and `vpc-tokyo-shared`. Deploy a NAT Gateway in each Availability Zone of `vpc-tokyo-shared`. In the spoke TGW route table, point 0.0.0.0/00.0.0.0/0 to the `vpc-tokyo-shared` attachment. Associate the `corp.internal` PHZ with `vpc-tokyo-shared` only. Deploy a Route 53 Resolver Inbound Endpoint in `vpc-tokyo-shared` across both Availability Zones, and forward on-premises DNS queries for `corp.internal` to these endpoints. Connect the DXGW to the TGW using a Transit Virtual Interface.
  2. B
    Deploy an AWS Transit Gateway (TGW) and attach `vpc-tokyo-app` and `vpc-tokyo-shared`. In `vpc-tokyo-shared`, deploy a single NAT Gateway in `ap-northeast-1a`. In the spoke TGW route table, point 0.0.0.0/00.0.0.0/0 to the `vpc-tokyo-shared` attachment. Associate the `corp.internal` PHZ with both `vpc-tokyo-app` and `vpc-tokyo-shared`. Deploy a Route 53 Resolver Inbound Endpoint in `vpc-tokyo-shared` across both Availability Zones and forward on-premises queries to it. Connect the DXGW to the TGW using a Transit Virtual Interface.
  3. Deploy an AWS Transit Gateway (TGW) and attach `vpc-tokyo-app` and `vpc-tokyo-shared`. In `vpc-tokyo-shared`, deploy a NAT Gateway in each Availability Zone. In the spoke TGW route table, point 0.0.0.0/00.0.0.0/0 to the `vpc-tokyo-shared` attachment. In `vpc-tokyo-shared`, configure subnet route tables to direct outbound traffic to the local NAT Gateway in that Availability Zone. Associate the `corp.internal` PHZ with both `vpc-tokyo-app` and `vpc-tokyo-shared`. Deploy a Route 53 Resolver Inbound Endpoint in `vpc-tokyo-shared` across both Availability Zones and forward on-premises DNS queries for `corp.internal` to these endpoints. Connect the DXGW to the TGW using a Transit Virtual Interface.Answer
  4. D
    Connect the Direct Connect Gateway (DXGW) directly to both `vpc-tokyo-app` and `vpc-tokyo-shared` using Private Virtual Interfaces. In `vpc-tokyo-shared`, deploy a NAT Gateway in each Availability Zone. Associate the `corp.internal` PHZ with both VPCs. Rely on the DXGW to route transitive traffic between `vpc-tokyo-app` and `vpc-tokyo-shared` for internet egress and DNS resolution. Deploy a Route 53 Resolver Inbound Endpoint in `vpc-tokyo-shared` to handle on-premises queries.

Answer

The correct design implements AWS Transit Gateway to orchestrate connectivity, deploys redundant NAT Gateways in each Availability Zone of the shared services VPC, associates the Private Hosted Zone with both the application and shared services VPCs, and configures a Route 53 Resolver Inbound Endpoint in the shared services VPC to allow resolution from the on-premises datacenter.
The correct design utilizes AWS Transit Gateway to route traffic transitively between the application VPC, the shared services VPC, and the on-premises datacenter via a Transit Virtual Interface. It maintains high availability by deploying a NAT Gateway in each Availability Zone in the shared services VPC. It ensures complete DNS resolution by associating the Private Hosted Zone with both VPCs and deploying a Route 53 Resolver Inbound Endpoint across multiple Availability Zones to handle queries from the on-premises datacenter.

Step-by-Step Solution

1
Configure hybrid and multi-VPC transit routing using AWS Transit Gateway.
Create an AWS Transit Gateway, attach both VPCs, and connect the Direct Connect Gateway to the Transit Gateway using a Transit Virtual Interface.
This establishes a scalable transit routing architecture that handles traffic between the VPCs and the on-premises datacenter without relying on unsupported transitive routing patterns.
2
Implement redundant outbound internet routing.
Deploy a NAT Gateway in each public subnet across the two Availability Zones in the shared services VPC, and route spoke internet-bound traffic through the Transit Gateway pointing to these gateways.
This architecture ensures outbound internet traffic remains highly available and resilient to an Availability Zone failure.
3
Set up private DNS resolution for hybrid environments.
Associate the Route 53 Private Hosted Zone with both VPCs, and deploy a Route 53 Resolver Inbound Endpoint across two Availability Zones in the shared services VPC.
Associating the Private Hosted Zone with both VPCs allows local DNS resolution for resources within the cloud, while the Inbound Endpoint allows the on-premises DNS servers to forward queries for the internal domain.

Key Concept

Centralized egress and hybrid DNS resolution in a multi-VPC environment using AWS Transit Gateway and Route 53 Resolver Endpoints.
Estimated Time:3m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic