Examkin

Soru

Zorluk: ZorNetworking and Connectivity Design

An enterprise is designing a secure, multi-VPC platform in the `us-west-2` Region. The architecture includes `vpc-app-prod` for private containerized workloads across two Availability Zones (`us-west-2a` and `us-west-2b`), and `vpc-shared-egress` for centralized internet egress inspection via AWS Network Firewall and NAT Gateways. An AWS Transit Gateway (`tgw-us-west-2`) interconnects the VPCs. In a separate AWS account, `vpc-mgmt-shared` hosts a Route 53 Private Hosted Zone (PHZ) named `corp.internal`.

The design must meet the following requirements:
- Outbound internet traffic from `vpc-app-prod` must be inspected by AWS Network Firewall in `vpc-shared-egress`.
- High availability must be maintained across Availability Zones for internet egress.
- Asymmetric routing through the stateful Network Firewall must be avoided.
- Workloads in `vpc-app-prod` must resolve names in `corp.internal` with minimum latency and without routing DNS traffic over the hybrid connection.

Which architecture satisfies these requirements?

  1. A
    Deploy redundant NAT Gateways and AWS Network Firewall endpoints in `vpc-shared-egress`. Attach `vpc-app-prod` and `vpc-shared-egress` to a Direct Connect Gateway (dxgw-global) instead of Transit Gateway, and configure routing tables to send outbound internet traffic from `vpc-app-prod` transitively through dxgw-global to `vpc-shared-egress`. Associate the corp.internal Private Hosted Zone with `vpc-app-prod`.
  2. B
    Deploy a single NAT Gateway in `us-west-2a` and AWS Network Firewall endpoints in both Availability Zones in `vpc-shared-egress` to reduce costs. Route outbound traffic from `vpc-app-prod` via `tgw-us-west-2` to `vpc-shared-egress` without enabling Appliance Mode. Associate the corp.internal Private Hosted Zone with `vpc-app-prod`.
  3. Deploy a NAT Gateway and an AWS Network Firewall endpoint in both `us-west-2a` and `us-west-2b` in `vpc-shared-egress`. Route outbound traffic from `vpc-app-prod` via `tgw-us-west-2` to `vpc-shared-egress`. Enable Appliance Mode on the Transit Gateway VPC attachment for `vpc-shared-egress` to ensure symmetric routing. Associate the corp.internal Private Hosted Zone with `vpc-app-prod`.Cevap
  4. D
    Deploy redundant NAT Gateways and AWS Network Firewall endpoints in both Availability Zones in `vpc-shared-egress`. Route outbound traffic from `vpc-app-prod` via `tgw-us-west-2` to `vpc-shared-egress` with Appliance Mode enabled. Establish a virtual private gateway in `vpc-app-prod` and route all internal DNS queries for corp.internal to the on-premises DNS servers, which will resolve them using a Route 53 Resolver inbound endpoint in `vpc-mgmt-shared`.

Cevap

Deploy a NAT Gateway and an AWS Network Firewall endpoint in both `us-west-2a` and `us-west-2b` in `vpc-shared-egress`. Route outbound traffic from `vpc-app-prod` via `tgw-us-west-2` to `vpc-shared-egress`. Enable Appliance Mode on the Transit Gateway VPC attachment for `vpc-shared-egress` to ensure symmetric routing. Associate the corp.internal Private Hosted Zone with `vpc-app-prod`.
The correct solution deploys a NAT Gateway and an AWS Network Firewall endpoint in both Availability Zones in the egress VPC, routes outbound traffic via the Transit Gateway, enables Appliance Mode on the egress VPC attachment, and associates the Private Hosted Zone directly with the application VPC. This configuration ensures Availability Zone redundancy, prevents asymmetric routing issues with the stateful firewall, and provides low-latency DNS resolution.

Adım Adım Çözüm

1
Deploy redundant NAT Gateways and AWS Network Firewall endpoints in each Availability Zone (us-west-2a and us-west-2b) within the egress VPC.
Eliminates single points of failure for outbound internet routing, ensuring high availability in case of a zone outage.
To satisfy the high availability constraint for internet egress.
2
Enable Appliance Mode on the AWS Transit Gateway VPC attachment for the egress VPC (vpc-shared-egress).
Forces Transit Gateway to direct both ingress and egress traffic for a given network flow through the same Availability Zone and firewall endpoint.
To prevent stateful security inspection failures caused by asymmetric routing across different Availability Zones.
3
Associate the Private Hosted Zone (PHZ) `corp.internal` from the management account with `vpc-app-prod`.
Enables private DNS resolution for application workloads in the production VPC directly through the Route 53 Resolver.
To resolve internal hostnames with minimum latency without sending DNS traffic over the hybrid connection.

Anahtar Kavram

Centralized egress security with symmetric routing and cross-account Private Hosted Zone association in a Transit Gateway architecture.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru