A financial services company operates a latency-critical application in the us-east-1 Regi… — AWS Certified Solutions Architect - Professional

A financial services company operates a latency-critical application in the us-east-1 Region. The application's core components are split across two AWS accounts: Account A hosts the real-time processing fleet on Amazon EC2 instances in private subnets across three Availability Zones in VPC-Processing, and Account B hosts a caching layer in VPC-Cache. Currently, the two VPCs are connected via an AWS Transit Gateway.

During high-volume events, the platform experiences increased latency and packet drops. A network audit reveals the following:
* Outbound internet traffic from all private subnets in VPC-Processing is routed through a single NAT Gateway located in Availability Zone us-east-1a.
* Large database synchronization streams between the processing fleet and the caching layer are capped at $1.25\text{ Gbps}$ per connection, even though the EC2 instances support up to $25\text{ Gbps}$ network bandwidth.
* EC2 instances in VPC-Processing resolve the private IP addresses of the caching layer by querying a Route 53 Private Hosted Zone (PHZ) created in Account B, but queries are currently traversing public resolvers, causing elevated DNS resolution times.

Which combination of actions will resolve the latency and throughput bottlenecks while ensuring high availability?

Replace the Transit Gateway connection between VPC-Processing and VPC-Cache with a VPC Peering connection. Deploy a NAT Gateway in each of the three Availability Zones in VPC-Processing, and update the private route tables to route outbound traffic to the local NAT Gateway in the same zone. Authorize and associate the Route 53 Private Hosted Zone in Account B with VPC-Processing.Cevap
B
Request AWS Support to pre-warm the Application Load Balancer in VPC-Processing to handle traffic surges. Retain the Transit Gateway connection and request a bandwidth limit increase. Keep the single NAT Gateway in Availability Zone us-east-1a to control costs, and authorize and associate the Route 53 Private Hosted Zone in Account B with VPC-Processing.
C
Replace the Transit Gateway connection between VPC-Processing and VPC-Cache with a VPC Peering connection. Retain the single NAT Gateway in Availability Zone us-east-1a to minimize Elastic IP usage, but update route tables to use inter-AZ routes for resiliency. Configure Route 53 Resolver outbound endpoints in VPC-Processing and inbound endpoints in VPC-Cache to handle DNS queries across the peering connection.
D
Establish connections from both VPC-Processing and VPC-Cache to a central AWS Direct Connect Gateway to enable low-latency transitive routing between the VPCs. Deploy a NAT Gateway in each of the three Availability Zones in VPC-Processing. Authorize and associate the Route 53 Private Hosted Zone in Account B with VPC-Processing.

Cevap

Replace the Transit Gateway connection with a VPC Peering connection, deploy a NAT Gateway in each of the three Availability Zones, and authorize and associate the Route 53 Private Hosted Zone in Account B with VPC-Processing.

The correct solution resolves the three latency and throughput bottlenecks. Replacing the Transit Gateway with a VPC Peering connection removes the

1.25\text{ Gbps}

single-flow TCP limit that Transit Gateway VPC attachments enforce, enabling single-flow replication to scale up to the EC2 instances' maximum bandwidth. Deploying a NAT Gateway in each Availability Zone removes the single point of failure, prevents cross-AZ data transfer latency, and distributes egress load. Authorizing and associating the Route 53 Private Hosted Zone in Account B directly with VPC-Processing in Account A allows local DNS queries to be resolved directly by the Route 53 resolver (

169.254.169.253

), minimizing lookup latency.

Adım Adım Çözüm

Address the single-flow replication throughput bottleneck by replacing the Transit Gateway attachment.

Create a VPC Peering connection between VPC-Processing and VPC-Cache, enabling single-flow TCP traffic to utilize the full network bandwidth capacity of the EC2 instances, bypassing the Transit Gateway

1.25\text{ Gbps}

single-flow limit.

Transit Gateway imposes a hard limit of

1.25\text{ Gbps}

per single 5-tuple stream, whereas VPC Peering has no such limitation.

Resolve the single point of failure and cross-AZ egress latency.

Deploy one NAT Gateway in the public subnet of each of the three Availability Zones in VPC-Processing. Update the route tables of the private subnets to send outbound internet traffic (

0.00.0/0

) to the local NAT Gateway in their respective zone.

This removes cross-AZ data transfer latency/charges and ensures high availability if one Availability Zone experiences an outage.

Optimize cross-account DNS resolution for the caching layer.

Create a Private Hosted Zone association authorization in Account B for VPC-Processing, and accept the association from Account A.

Associating the Route 53 PHZ directly with VPC-Processing ensures DNS queries are answered locally by the Route 53 resolver (

169.254.169.253

) without traversing public networks or requiring extra resolver endpoints.

Anahtar Kavram

Removing single-stream bandwidth limits using VPC Peering, ensuring high availability with multi-AZ NAT Gateways, and optimizing cross-account DNS with Route 53 Private Hosted Zone associations.

Tahmini Süre:3m 0s

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular