Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

A company is designing a new multi-VPC architecture on AWS in the eu-central-1 region. The architecture consists of vpc-app-prod (hosting production workloads across two Availability Zones) and vpc-shared-services (hosting centralized security tooling). The company has an on-premises data center that requires high-performance, private network connectivity to both VPCs using a dedicated AWS Direct Connect connection. Workloads in both VPCs must have outbound internet connectivity for software updates while maintaining high availability.

The DNS resolution requirements are as follows:
- Workloads in both VPCs must resolve private DNS names in the on-premises domain corp.internal.
- Workloads in vpc-app-prod must resolve private DNS hostnames for resources in vpc-shared-services hosted in a Route 53 Private Hosted Zone (PHZ) named shared.aws.internal.

Which design option meets these requirements with the lowest operational complexity while ensuring high availability and complete connectivity?

  1. A
    Connect both vpc-app-prod and vpc-shared-services directly to an AWS Direct Connect Gateway (DXGW) using Private Virtual Interfaces (Private VIFs), relying on the DXGW to route traffic between the VPCs. Associate the PHZ shared.aws.internal with vpc-shared-services only. Deploy a Route 53 Resolver outbound endpoint in vpc-shared-services across multiple Availability Zones, and associate the corp.internal forwarding rule with both VPCs. Deploy a NAT Gateway in each Availability Zone in both VPCs for outbound internet traffic.
  2. B
    Create an AWS Transit Gateway and attach both VPCs. Associate the Transit Gateway with an AWS Direct Connect Gateway (DXGW) connected via a Transit Virtual Interface (Transit VIF). Associate the PHZ shared.aws.internal with vpc-shared-services only, relying on Transit Gateway routing for resolution from vpc-app-prod. Deploy a Route 53 Resolver outbound endpoint in vpc-shared-services across multiple Availability Zones, and associate the corp.internal forwarding rule with both VPCs. Deploy a NAT Gateway in each Availability Zone in both VPCs for outbound internet traffic.
  3. Create an AWS Transit Gateway and attach both VPCs. Associate the Transit Gateway with an AWS Direct Connect Gateway (DXGW) connected via a Transit Virtual Interface (Transit VIF). Associate the PHZ shared.aws.internal with both vpc-app-prod and vpc-shared-services. Deploy a Route 53 Resolver outbound endpoint in vpc-shared-services across multiple Availability Zones, and configure a forwarding rule for corp.internal associated with both VPCs. Deploy a NAT Gateway in each Availability Zone in both VPCs for outbound internet traffic.Cevap
  4. D
    Create an AWS Transit Gateway and attach both VPCs. Associate the Transit Gateway with an AWS Direct Connect Gateway (DXGW) connected via a Transit Virtual Interface (Transit VIF). Associate the PHZ shared.aws.internal with both vpc-app-prod and vpc-shared-services. Deploy a Route 53 Resolver outbound endpoint in vpc-shared-services across multiple Availability Zones, and configure a forwarding rule for corp.internal associated with both VPCs. Deploy a single NAT Gateway in a single Availability Zone in each VPC, routing all outbound traffic from all private subnets within that VPC through the single NAT Gateway.

Cevap

The design utilizing AWS Transit Gateway with a Transit VIF to a Direct Connect Gateway, associating the Route 53 Private Hosted Zone with both VPCs, deploying Route 53 Resolver outbound endpoints across multiple Availability Zones, and deploying a NAT Gateway in each Availability Zone in both VPCs for high-availability egress.
The correct design utilizes an AWS Transit Gateway to interconnect the VPCs and routes hybrid traffic over a Transit VIF to the Direct Connect Gateway. It associates the Route 53 Private Hosted Zone with both VPCs to enable cross-VPC name resolution, and uses redundant NAT Gateways in each Availability Zone to eliminate single points of failure for outbound internet traffic.

Adım Adım Çözüm

1
Configure hybrid connectivity using AWS Transit Gateway.
Connect both VPCs to an AWS Transit Gateway (TGW). Associate the TGW with an AWS Direct Connect Gateway (DXGW) attached via a Transit VIF to route traffic privately between both VPCs and the on-premises data center.
Direct Connect Gateway alone does not support transitive VPC-to-VPC routing; a Transit Gateway is required for multi-VPC routing over Direct Connect.
2
Configure cross-VPC DNS resolution.
Associate the Route 53 Private Hosted Zone shared.aws.internal with both vpc-app-prod and vpc-shared-services.
Route 53 Private Hosted Zones require explicit association with every VPC that needs to resolve records within that hosted zone.
3
Configure outbound DNS resolution for the on-premises domain.
Deploy an outbound Route 53 Resolver endpoint in multiple Availability Zones in vpc-shared-services. Create a forwarding rule for corp.internal pointing to on-premises DNS servers, and associate the rule with both VPCs.
This allows resources in both VPCs to forward queries for corp.internal to the on-premises network securely and with high availability.
4
Establish highly available internet egress.
Deploy a NAT Gateway in each Availability Zone's public subnet in both VPCs, updating private subnet route tables to route 0.0.0.0/0 traffic to the local zone's NAT Gateway.
Deploying one NAT Gateway per Availability Zone ensures that an outage in a single Availability Zone does not disrupt outbound internet connectivity for workloads running in other zones.

Anahtar Kavram

Design of a highly available, multi-VPC hybrid network architecture utilizing AWS Transit Gateway, Direct Connect Gateway, Route 53 Resolver endpoints, and multi-AZ NAT Gateways.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru