Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

A financial services firm is designing its AWS network architecture in the `us-east-1` Region. The architecture consists of 2020 VPCs split equally between production and development accounts. The firm has an existing 1 Gbps1\text{ Gbps} AWS Direct Connect connection with a Private Virtual Interface (VIF) terminated at a Direct Connect Gateway (DXGW). All 2020 VPCs are currently associated with the DXGW via Virtual Private Gateways (VGWs) to access the on-premises network.

The firm has the following new requirements:
- All production VPCs must be able to communicate with each other, and all development VPCs must be able to communicate with each other. Production and development VPC traffic must remain isolated.
- All VPCs must resolve domain names hosted in a single Route 53 Private Hosted Zone (PHZ) managed in a centralized shared services account.
- Administrative overhead must be minimized.

Which network design solution meets these requirements?

  1. A
    Deploy an AWS Transit Gateway. Create a Transit VIF on the Direct Connect connection, associate the Direct Connect Gateway with the Transit Gateway, and attach all 2020 VPCs to the Transit Gateway. Configure two separate Transit Gateway route tables to isolate production and development traffic. Rely on the Transit Gateway attachments to automatically forward DNS queries for the Route 53 Private Hosted Zone from all VPCs without manual VPC association.
  2. B
    Keep the existing Virtual Private Gateway associations with the Direct Connect Gateway. Enable transitive VPC-to-VPC routing on the Direct Connect Gateway to allow production-to-production and development-to-development communication. Authorize and associate the Route 53 Private Hosted Zone with each of the 2020 VPCs.
  3. Deploy an AWS Transit Gateway. Create a Transit VIF on the Direct Connect connection, associate the Direct Connect Gateway with the Transit Gateway, and attach all 2020 VPCs to the Transit Gateway. Configure two separate Transit Gateway route tables to isolate production and development traffic. Authorize and associate the Route 53 Private Hosted Zone in the shared services account with each of the 2020 VPCs.Cevap
  4. D
    Establish a full mesh of VPC peering connections among the 1010 production VPCs and another full mesh among the 1010 development VPCs. Keep the existing Direct Connect Gateway associations for hybrid connectivity. Associate the Route 53 Private Hosted Zone with only the shared services VPC, and route all DNS queries through a single NAT Gateway deployed in that shared services VPC.

Cevap

Deploy AWS Transit Gateway, connect the VPCs using separate route tables for production and development to ensure isolation, associate the Direct Connect Gateway with the Transit Gateway using a Transit VIF, and associate the Route 53 Private Hosted Zone with all VPCs.
The correct option correctly uses AWS Transit Gateway to handle routing between the 2020 VPCs. By deploying two Transit Gateway route tables, the architecture achieves complete isolation between the production and development networks while allowing all VPCs to access the on-premises data center. Additionally, it properly addresses DNS requirements by explicitly associating the Route 53 Private Hosted Zone with all 2020 VPCs across the accounts.

Adım Adım Çözüm

1
Consolidate multi-VPC routing by deploying AWS Transit Gateway.
Simplifies connection management from 2020 individual Direct Connect VGW associations to a single hub structure.
Direct Connect Gateway does not allow transitive routing between VPCs, so a Transit Gateway is required to facilitate inter-VPC communication.
2
Set up Transit Gateway route tables for production and development attachments.
Traffic from production VPCs can route to other production VPCs but is blocked from reaching development VPCs, and vice versa.
Multiple route tables allow network isolation without configuring complex security groups or firewalls for each VPC link.
3
Establish hybrid connectivity using a Transit Virtual Interface (VIF).
Connects the on-premises network to the Transit Gateway via the Direct Connect Gateway.
A Transit VIF is mandatory for attaching a Direct Connect Gateway to an AWS Transit Gateway.
4
Associate the centralized Route 53 Private Hosted Zone with all 2020 spoke VPCs.
All production and development VPCs can resolve domains hosted in the centralized PHZ.
Route 53 PHZs require explicit association with target VPCs to answer queries originating from those VPCs, regardless of Transit Gateway connectivity.

Anahtar Kavram

AWS Transit Gateway routing isolation combined with cross-account Route 53 Private Hosted Zone association.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru