Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

An enterprise is setting up a new production workload in a newly created VPC named `vpc-billing-prod` within the `eu-central-1` region. The application runs across private subnets in three Availability Zones. The application must interact with:

1. An on-premises database via an existing AWS Site-to-Site VPN connection.
2. Amazon S3 to store large transaction logs.
3. A shared DNS domain (`internal.corp`) hosted on a Route 53 Private Hosted Zone (PHZ) in a separate AWS account managed by the network team.
4. The public internet to retrieve software updates.

To meet business requirements, the architecture must be highly available, avoid single points of failure, and minimize data transfer and operational costs.

Which TWO configurations should the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Deploy a NAT Gateway in a public subnet in each of the three Availability Zones, and update the private subnet route tables to direct outbound internet traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway in the same Availability Zone.Cevap
  2. Create Gateway VPC endpoints for Amazon S3, and associate them with the route tables of all private subnets containing the billing application.Cevap
  3. C
    Deploy a single NAT Gateway in the public subnet of a single Availability Zone, and configure a default route (0.0.0.0/00.0.0.0/0) pointing to this NAT Gateway across all private subnet route tables to minimize running costs.
  4. D
    Create a cross-account IAM role in the shared services account to allow `vpc-billing-prod` to query the Private Hosted Zone directly without associating the zone with the new VPC.
  5. E
    Configure a Virtual Private Gateway (VGW) attached to `vpc-billing-prod` to route S3 traffic transitively through the Site-to-Site VPN connection to an on-premises proxy, in order to bypass the need for VPC endpoints.

Cevap

To meet the requirements, the Solutions Architect should deploy a NAT Gateway in each of the three Availability Zones to ensure highly available outbound internet access, and create Gateway VPC endpoints for Amazon S3 associated with the private subnet route tables to minimize costs and optimize routing.
Deploying a NAT Gateway in each Availability Zone ensures that an outage in one zone does not impact the outbound internet connectivity of the other zones. Implementing Gateway VPC endpoints for Amazon S3 allows private subnets to route traffic directly to S3 at no additional cost, meeting the cost optimization and high availability constraints.

Adım Adım Çözüm

1
Ensure high availability for outbound internet traffic by provisioning a NAT Gateway in a public subnet within each of the three Availability Zones, rather than relying on a single NAT Gateway.
This eliminates the single point of failure for internet egress across the entire VPC.
Outages in a single Availability Zone will not impact the other zones' ability to reach the public internet.
2
Configure Gateway VPC endpoints for Amazon S3 and update the route tables of the private subnets.
S3 traffic is routed directly to the service over the AWS network without traversing NAT Gateways or the internet.
Gateway VPC endpoints do not incur hourly or data processing charges, satisfying the cost-minimization constraint.
3
Verify and associate Route 53 Private Hosted Zones for multi-account DNS resolution.
The Private Hosted Zone in the shared services account must be associated with the new VPC.
Simply using IAM roles or cross-account access does not enable local DNS resolution of private hosted zone records in another VPC.

Anahtar Kavram

Designing resilient, cost-effective VPC connectivity, NAT Gateway redundancy, and S3 Gateway VPC endpoints.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru