Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

A media company is designing a new multi-VPC environment in the `us-west-2` Region using AWS Organizations. The architecture consists of a Shared Services VPC and two application spoke VPCs, spanning two Availability Zones. The company needs to provide highly resilient outbound internet traffic (0.0.0.0/00.0.0.0/0) access for the application servers in the spoke VPCs' private subnets. Additionally, the application servers must resolve domain names within a private hosted zone named `media.internal` which is defined in the Shared Services VPC. An AWS Transit Gateway is used to interconnect all VPCs. Which TWO actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Deploy a NAT Gateway in a public subnet in each Availability Zone of the Shared Services VPC. Configure the spoke VPC route tables to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the Transit Gateway, which then forwards the traffic to the Shared Services VPC.Cevap
  2. Associate the Route 53 Private Hosted Zone `media.internal` with both application spoke VPCs using cross-account or cross-VPC association APIs.Cevap
  3. C
    Deploy a single NAT Gateway in one Availability Zone of the Shared Services VPC. Route all outbound internet traffic (0.0.0.0/00.0.0.0/0) from both spoke VPCs to this single NAT Gateway via the Transit Gateway.
  4. D
    Enable DNS support on the Transit Gateway, and rely on Transit Gateway routing to automatically forward DNS resolution queries for `media.internal` from the spoke VPCs to the Shared Services VPC.
  5. E
    Establish a Direct Connect Gateway connected directly to the virtual private gateways of all VPCs, and configure the Direct Connect Gateway to enable transitive VPC-to-VPC routing.

Cevap

Deploy a NAT Gateway in a public subnet in each Availability Zone of the Shared Services VPC, routing spoke VPC internet egress traffic through the Transit Gateway to the Shared Services VPC, and associate the Route 53 Private Hosted Zone with the spoke VPCs.
Deploying redundant NAT Gateways across two Availability Zones ensures high availability for outbound traffic, while associating the Private Hosted Zone with the spoke VPCs enables native DNS resolution for `media.internal` across all accounts and VPCs in the environment.

Adım Adım Çözüm

1
Configure highly available NAT Gateways in the Shared Services VPC.
Two NAT Gateways are deployed, one in each Availability Zone, providing redundant paths for egress traffic.
This setup prevents a single Availability Zone failure from disrupting outbound internet access for the entire network.
2
Configure Transit Gateway routing to direct egress traffic from the spoke VPCs to the Shared Services VPC.
The route tables of the spoke VPCs point outbound traffic (0.0.0.0/00.0.0.0/0) to the Transit Gateway, which routes it to the Shared Services VPC.
This centralizes egress traffic and utilizes the redundant NAT Gateways in the Shared Services VPC.
3
Associate the Route 53 Private Hosted Zone with the spoke VPCs.
The private hosted zone `media.internal` is associated with each spoke VPC.
This allows resources in the spoke VPCs to resolve DNS queries for `media.internal` using the default Route 53 Resolver IP address.

Anahtar Kavram

Designing resilient egress routing and cross-VPC DNS resolution in a multi-VPC architecture using AWS Transit Gateway and Route 53 Private Hosted Zones.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru