An enterprise is designing a highly available, multi-account hybrid network architecture a… — AWS Certified Solutions Architect - Professional

An enterprise is designing a highly available, multi-account hybrid network architecture across two AWS Regions: `us-east-1` (the primary region with 50 spoke VPCs) and `us-west-2` (the secondary region with 30 spoke VPCs). A Shared Services VPC in `us-east-1` hosts a Route 53 Private Hosted Zone (PHZ) for `corp.internal` and an outbound Route 53 Resolver endpoint to resolve on-premises queries.

The enterprise has a 10 Gbps AWS Direct Connect (DX) connection at their on-premises data center (CIDR ` $10.0.0.0/8$ `). They want to use the DX connection as the primary path and deploy an AWS Site-to-Site VPN as a backup path. The solution must minimize latency for both regions under normal conditions, prevent asymmetric routing, support automatic failover, and ensure that resources in all spoke VPCs across both regions can resolve `corp.internal` and on-premises domain queries.

Which combination of steps meets these requirements?

A
Deploy an AWS Transit Gateway in `us-east-1` (TGW-East). Peer all spoke VPCs in `us-west-2` directly to TGW-East using inter-region VPC peering. Associate the Direct Connect Gateway (DXGW) only with TGW-East, and terminate the Site-to-Site VPN on TGW-East. Configure static routing in TGW-East for ` $10.0.0.0/8$ ` pointing to the DXGW. Associate the Route 53 PHZ only with the Shared Services VPC, and configure the spoke VPCs to use the Shared Services VPC's DNS servers as forwarders.
B
Deploy TGW-East and TGW-West and peer them. Associate the DXGW with TGW-East and TGW-West. Terminate the Site-to-Site VPN on TGW-East. To prevent asymmetric routing and secure egress, route all on-premises traffic from all VPCs through a single NAT Gateway deployed in a single Availability Zone in the Shared Services VPC. Recreate the `corp.internal` PHZ in each AWS account to ensure local resolution.
Deploy an AWS Transit Gateway in each region (TGW-East and TGW-West) and peer them. Associate the DXGW with both TGW-East and TGW-West. Terminate the Site-to-Site VPN on TGW-East. Configure BGP on-premises to advertise ` $10.0.0.0/8$ ` over both paths, prepending the AS path on the VPN session from AWS to on-premises. Authorize and associate the PHZ `corp.internal` with all spoke VPCs in both regions. Share the Route 53 Resolver forwarding rules via AWS Resource Access Manager (RAM) and associate them with all spoke VPCs.Answer
D
Deploy TGW-East and TGW-West. Associate the DXGW with TGW-East and terminate the Site-to-Site VPN on TGW-West. Peer TGW-East and TGW-West. Route all `us-west-2` traffic to on-premises via TGW-East's DXGW association, and route all `us-east-1` traffic via TGW-West's VPN as a primary path to balance load. On the on-premises customer gateway, use BGP Local Preference to prefer the VPN connection. For DNS, associate the Route 53 PHZ only with the Shared Services VPC.

Answer

Deploy Transit Gateways in both regions, peer them, and associate the Direct Connect Gateway with both. Use BGP AS path prepending on the VPN connection to make it less preferred, and associate the Private Hosted Zone and shared Resolver rules with all spoke VPCs in both regions.

The correct architecture deploys Transit Gateways in both regions peered together, with the Direct Connect Gateway associated with both TGWs to allow direct, low-latency paths. The backup Site-to-Site VPN terminates on TGW-East. To prevent asymmetric routing, BGP AS path prepending is applied to the VPN connection, ensuring that the on-premises router prefers the Direct Connect path. For DNS, the centralized Route 53 Private Hosted Zone is associated with all spoke VPCs across all accounts and regions, and the Route 53 Resolver forwarding rules are shared via AWS Resource Access Manager, allowing seamless name resolution of both AWS and on-premises resources.

Step-by-Step Solution

Configure the core network connectivity by deploying Transit Gateways (TGW-East and TGW-West) in both regions and peering them. Associate the DXGW with both TGWs to allow direct, low-latency hybrid access for all VPCs during normal operations.

Direct Connect traffic travels directly between on-premises and both regions without transiting the inter-region peering connection, minimizing latency and data transfer costs.

Associating the DXGW with multiple TGWs is the standard multi-region design pattern for Direct Connect.

Establish the backup VPN connection terminating on TGW-East, and configure BGP advertisements. Prepend the AS path on the VPN session advertised from AWS to on-premises.

The on-premises router prefers the Direct Connect path for inbound traffic because the VPN path has a longer AS path. AWS TGW-East prefers the DX path because it has a shorter AS path.

AS path prepending on the VPN connection ensures symmetric routing by making the VPN path less preferred for traffic in both directions.

Authorize and associate the centralized Private Hosted Zone `corp.internal` with all spoke VPCs in both regions using cross-account VPC association.

Spoke VPCs can resolve names in the `corp.internal` domain directly using the Route 53 Resolver.

Route 53 Private Hosted Zones must be associated with consumer VPCs to allow DNS resolution across accounts.

Share the Route 53 Resolver forwarding rules for on-premises domains using AWS Resource Access Manager (RAM) and associate them with all spoke VPCs.

Spoke VPCs forward queries for on-premises domains to the outbound resolver endpoint in the Shared Services VPC, which sends them to on-premises DNS servers.

Sharing forwarding rules via RAM allows consistent DNS resolution across a multi-account environment without duplicating resolver endpoints.

Key Concept

Multi-region hybrid connectivity using Direct Connect Gateway associated with multiple Transit Gateways, backup Site-to-Site VPN, BGP path selection, and cross-account DNS resolution using Route 53 PHZ association and RAM shared Resolver rules.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic