Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

A retail corporation is designing a new multi-account AWS environment in the us-west-2 Region. The architecture contains three spoke VPCs named vpc-prod-spoke, vpc-dev-spoke, and vpc-test-spoke, along with a central shared services VPC named vpc-shared-services. The spoke VPCs require outbound internet access to download software updates and must resolve internal domain names hosted in a Route 53 Private Hosted Zone (PHZ) named corp.internal that is managed within vpc-shared-services. The solution must be highly resilient across multiple Availability Zones, minimize configuration complexity, and prevent transitive routing limitations. Which architecture meets these requirements?

  1. Establish an AWS Transit Gateway named tgw-central and attach vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services. In vpc-shared-services, deploy redundant NAT Gateways across two Availability Zones. Route outbound traffic (0.0.0.0/00.0.0.0/0) from the spoke VPCs to tgw-central, which directs it to the NAT Gateways in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone with all four VPCs.Cevap
  2. B
    Establish an AWS Transit Gateway named tgw-central and attach vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services. In vpc-shared-services, deploy a single NAT Gateway in a single Availability Zone. Route outbound traffic (0.0.0.0/00.0.0.0/0) from the spoke VPCs to tgw-central, which directs it to the single NAT Gateway in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone with all four VPCs.
  3. C
    Establish an AWS Transit Gateway named tgw-central and attach vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services. In vpc-shared-services, deploy redundant NAT Gateways across two Availability Zones. Route outbound traffic (0.0.0.0/00.0.0.0/0) from the spoke VPCs to tgw-central, which directs it to the NAT Gateways in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone only with vpc-shared-services, relying on Transit Gateway to route DNS queries transitively from the spoke VPCs.
  4. D
    Establish VPC Peering connections between each spoke VPC and vpc-shared-services. In vpc-shared-services, deploy redundant NAT Gateways across two Availability Zones. Route outbound traffic (0.0.0.0/00.0.0.0/0) from the spoke VPCs transitively through the VPC Peering connections to the NAT Gateways in vpc-shared-services. Associate the corp.internal Route 53 Private Hosted Zone with all four VPCs.

Cevap

Establish an AWS Transit Gateway named tgw-central and attach all four VPCs. Deploy redundant NAT Gateways in two Availability Zones in the shared services VPC to route outbound traffic, and associate the Private Hosted Zone with all four VPCs.
The correct solution uses AWS Transit Gateway to interconnect the VPCs and direct outbound traffic to the central shared services VPC. Redundant NAT Gateways deployed across two Availability Zones guarantee that outbound connectivity is highly available and resilient to AZ failures. Associating the Route 53 Private Hosted Zone with all four VPCs ensures that resources in all VPCs can resolve the internal domain names.

Adım Adım Çözüm

1
Configure AWS Transit Gateway attachments for all spoke VPCs and the shared services VPC.
Establishes a hub-and-spoke topology allowing VPC-to-VPC and egress connectivity.
Provides a scalable, non-transitive route path to route traffic from spokes to the central egress VPC.
2
Deploy redundant NAT Gateways in different Availability Zones within the public subnets of the shared services VPC.
Ensures that if an Availability Zone fails, outbound traffic can still route through the NAT Gateway in the remaining Availability Zone.
Meets the high resiliency requirement for outbound traffic egress.
3
Associate the Route 53 Private Hosted Zone with all VPCs (vpc-prod-spoke, vpc-dev-spoke, vpc-test-spoke, and vpc-shared-services).
Enables resources in all four VPCs to resolve queries for the corp.internal domain.
Route 53 PHZ resolution is local to associated VPCs and cannot be routed transitively via Transit Gateway.

Anahtar Kavram

Multi-VPC architecture utilizing AWS Transit Gateway for centralized egress with redundant NAT Gateways, combined with cross-account Route 53 Private Hosted Zone association.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru