Examkin

Soru

Zorluk: ZorNetworking and Connectivity Design

An enterprise is launching a new platform in the us-east-1 Region across three AWS accounts. The network architecture consists of a production application VPC (vpc-production-app) running workloads in private subnets across three Availability Zones, a PCI-compliant payment processing VPC (vpc-payment-processing) running workloads in private subnets across two Availability Zones, and a shared egress VPC (vpc-shared-egress) containing NAT Gateways and AWS Network Firewall endpoints. Outbound internet access from the application and payment VPCs must be routed through the central firewall in vpc-shared-egress. The latency between vpc-production-app and vpc-payment-processing must be minimized, and data transfer costs must be optimized by keeping direct VPC-to-VPC traffic off the Transit Gateway. Finally, all VPCs must resolve DNS records in a Route 53 Private Hosted Zone (PHZ) named corp.internal hosted in a centralized services AWS account. The entire architecture must remain resilient to Availability Zone failures.

Which two design strategies should the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Establish a VPC Peering connection directly between vpc-production-app and vpc-payment-processing for local VPC-to-VPC traffic. Create a Transit Gateway (TGW) and attach all three VPCs. Route all outbound internet traffic (0.0.0.0/0) from the spoke VPCs to the TGW, which forwards it to the vpc-shared-egress VPC.Cevap
  2. Enable DNS support and DNS hostnames in all three VPCs. Authorize and associate the Route 53 Private Hosted Zone corp.internal in the central services account with the VPCs in the application and payment processing accounts, allowing native cross-account resolution via the default VPC Route 53 Resolver.Cevap
  3. C
    Deploy a single NAT Gateway in one Availability Zone of the vpc-shared-egress VPC, and route all outbound internet traffic (0.0.0.0/0) from both spoke VPCs to this NAT Gateway using a shared Transit Gateway route table to minimize NAT gateway hourly charges.
  4. D
    Associate a single Direct Connect Gateway with both vpc-production-app and vpc-payment-processing to route VPC-to-VPC traffic directly between them, bypassing the Transit Gateway and optimizing internal data transfer costs.
  5. E
    Configure Route 53 Resolver inbound and outbound endpoints in each of the three VPCs, and create Route 53 forwarding rules pointing to the central services account's resolver to resolve queries for the corp.internal domain.

Cevap

Establish a VPC Peering connection directly between the production application VPC and the payment processing VPC for local VPC-to-VPC traffic, and route outbound internet traffic through a Transit Gateway to the shared egress VPC. In addition, enable DNS support and DNS hostnames, and associate the central services Private Hosted Zone with the application and payment VPCs.
The correct strategy combines a direct VPC Peering connection to route low-latency, cost-optimized inter-spoke VPC traffic (bypassing the Transit Gateway processing fees) with a Transit Gateway to centralize all outbound internet egress through the centralized shared egress VPC. In addition, configuring cross-account Route 53 Private Hosted Zone associations directly with the consumer VPCs enables native, cost-free DNS resolution of the internal domain without the overhead of Resolver endpoints.

Adım Adım Çözüm

1
Address direct VPC-to-VPC latency and cost constraints by establishing a direct VPC Peering connection between the production application VPC and the payment processing VPC.
Enables direct routing for local subnet traffic between the two VPCs, bypassing Transit Gateway data processing fees and minimizing latency.
Direct VPC Peering provides the lowest latency and is free for data transfer within the same Availability Zone, satisfying the requirement to keep direct inter-VPC traffic off the Transit Gateway.
2
Configure Transit Gateway attachments for the application, payment, and shared egress VPCs, and define a default route (0.0.0.0/0) in the spoke VPC route tables targeting the Transit Gateway.
Outbound internet traffic is centralized and directed to the shared egress VPC where it can be inspected by AWS Network Firewall and sent through multi-AZ NAT Gateways.
Satisfies the requirement for secure, centralized egress filtering via the firewall and NAT gateways while preserving Availability Zone resilience.
3
Establish cross-account DNS resolution by authorizing the central services account's Private Hosted Zone to be associated with the application and payment VPCs, then performing the association.
Allows resources in the spoke VPCs to natively resolve DNS queries for the internal domain using the standard AWS-provided DNS server (Route 53 Resolver at the .2 IP address).
Eliminates the cost and administrative overhead of creating Route 53 Resolver endpoints and forwarding rules, which would otherwise incur continuous hourly charges.

Anahtar Kavram

Multi-VPC hybrid and egress networking design, optimizing for latency and cost (avoiding Transit Gateway processing fees via VPC Peering), resilience (multi-AZ NAT Gateways), and cross-account DNS resolution using Route 53 Private Hosted Zone associations.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru