Examkin

Question

Difficulty: MediumNetworking and Connectivity Design

An enterprise is designing a new multi-VPC architecture in the eu-west-1 Region. The design includes two application VPCs (vpc-hr-prod and vpc-finance-prod) and a central egress VPC (vpc-central-egress). The application VPCs do not have direct internet access. All VPCs are connected via a central AWS Transit Gateway. The application workloads are distributed across two Availability Zones for high availability.

The enterprise has the following requirements:
1. All outbound internet traffic from the application VPCs must route through the central egress VPC.
2. The egress configuration must remain highly available and resilient to Availability Zone outages.
3. Applications must resolve domain names within a private hosted zone named internal.globalcorp that is hosted in a centralized AWS Shared Services account.

Which networking architecture meets these requirements?

  1. A
    Deploy a single NAT Gateway in one Availability Zone in the central egress VPC to minimize idle costs. Route all outbound internet traffic from the application VPCs through this NAT Gateway via the Transit Gateway. Associate the central private hosted zone only with the central egress VPC.
  2. Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC. Configure Transit Gateway route tables to route outbound internet traffic from the application VPCs to the egress VPC, distributing the traffic across the NAT Gateways in each zone. Authorize and associate the central private hosted zone with all three VPCs.Answer
  3. C
    Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC. Connect the application VPCs to the egress VPC using a Direct Connect Gateway to enable transitive routing and resolve DNS queries. Create separate, identical private hosted zones in each VPC's account.
  4. D
    Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC. Configure Transit Gateway route tables to route outbound internet traffic from the application VPCs to the egress VPC. Create a Route 53 Resolver rule to forward DNS queries for internal.globalcorp to the egress VPC Transit Gateway interface, without associating the private hosted zone.

Answer

Deploy a NAT Gateway in each of the two Availability Zones within the central egress VPC, route outbound internet traffic to these NAT Gateways via the Transit Gateway, and authorize and associate the central private hosted zone with all three VPCs.
The correct architecture achieves high availability by utilizing redundant NAT Gateways across two Availability Zones in the egress VPC. It also satisfies the DNS requirement by associating the private hosted zone with all VPCs, which is required for cross-VPC and cross-account DNS resolution of private hosted zones.

Step-by-Step Solution

1
Evaluate the resiliency requirement for internet egress.
Identify that a NAT Gateway must be deployed in each Availability Zone of the central egress VPC to prevent a single Availability Zone outage from disrupting all outbound traffic.
Deploying a single NAT Gateway creates a single point of failure, violating the high availability requirement.
2
Configure Transit Gateway routing for egress.
Ensure Transit Gateway route tables direct outbound traffic (0.0.0.0/00.0.0.0/0) from the application VPCs to the central egress VPC.
This centralizes egress traffic and applies the NAT Gateway translation consistently.
3
Address cross-account DNS resolution requirements.
Associate the Route 53 private hosted zone with each VPC across both the Shared Services account and the application accounts.
VPCs cannot resolve records in a private hosted zone unless the zone is explicitly associated with them, even when connected via Transit Gateway.

Key Concept

Multi-AZ egress routing and cross-account Route 53 Private Hosted Zone association.
Estimated Time:2m 0s
Rate this question

Topics

Networking and Connectivity Design

More questions from this topic