Examkin

Soru

Zorluk: ZorNetworking and Connectivity Design

A financial service provider is designing a new cloud infrastructure on AWS for a transaction processing system. The architecture requires three spoke VPCs (`vpc-payment-prod`, `vpc-ledger-prod`, and `vpc-fraud-prod`) in the `eu-west-1` region to communicate with each other securely, resolve internal domain names, and route outbound internet traffic for third-party API validation. The design must be highly resilient against Availability Zone failures, minimize administrative overhead, and support a centralized DNS configuration. The development team has created a Route 53 Private Hosted Zone (PHZ) named `corp.internal` in a central network services account. Which of the following networking and connectivity designs meets these requirements?

  1. A
    Deploy an AWS Transit Gateway to interconnect the three spoke VPCs and a central egress VPC. In the central egress VPC, deploy a NAT Gateway in each utilized Availability Zone. Route outbound internet traffic from the spoke VPCs through the Transit Gateway to the egress VPC's NAT Gateways. Associate the `corp.internal` Private Hosted Zone only with the central network services VPC, relying on default VPC DNS resolution to automatically forward queries across the Transit Gateway attachments.
  2. B
    Create a Direct Connect Gateway and attach the virtual private gateways of the three spoke VPCs and the central egress VPC. Route all spoke-to-spoke traffic transitively through the Direct Connect Gateway. Deploy a NAT Gateway in each Availability Zone of the central egress VPC. Authorize and associate the `corp.internal` Route 53 Private Hosted Zone with the spoke VPCs.
  3. Deploy an AWS Transit Gateway to interconnect the three spoke VPCs and a central egress VPC. In the central egress VPC, deploy a NAT Gateway in each utilized Availability Zone. Route outbound internet traffic from the spoke VPCs through the Transit Gateway to the central egress VPC's NAT Gateways. Authorize and associate the `corp.internal` Route 53 Private Hosted Zone with the three spoke VPCs and the central egress VPC.Cevap
  4. D
    Deploy an AWS Transit Gateway to interconnect the three spoke VPCs and a central egress VPC. In the central egress VPC, deploy a single NAT Gateway in one Availability Zone to minimize hourly NAT Gateway charges. Route outbound internet traffic from all spoke VPCs through the Transit Gateway to this single NAT Gateway. Authorize and associate the `corp.internal` Route 53 Private Hosted Zone with all VPCs.

Cevap

Deploy an AWS Transit Gateway to interconnect the three spoke VPCs and a central egress VPC, deploy a NAT Gateway in each utilized Availability Zone in the egress VPC, and authorize/associate the Private Hosted Zone with all spoke VPCs and the egress VPC.
The correct design uses an AWS Transit Gateway to interconnect the spoke VPCs and the central egress VPC. For high availability, NAT Gateways must be deployed in each utilized Availability Zone within the egress VPC. To ensure name resolution for the custom domain, the Private Hosted Zone must be associated with every VPC where resolution is required.

Adım Adım Çözüm

1
Analyze inter-VPC connectivity and outbound routing requirements.
Identify that AWS Transit Gateway is the correct mechanism for interconnecting the payment, ledger, and fraud VPCs and routing outbound traffic through a central egress VPC.
Direct Connect Gateway does not support transitive VPC-to-VPC routing, and full-mesh VPC peering has higher routing table administrative overhead.
2
Address high availability requirements for the outbound egress traffic.
Configure a NAT Gateway in each utilized Availability Zone of the central egress VPC.
A single NAT Gateway creates a single point of failure, meaning an outage in its Availability Zone would drop all internet-bound traffic from all spoke VPCs.
3
Address DNS resolution requirements for the centralized Private Hosted Zone.
Authorize and associate the Private Hosted Zone 'corp.internal' with the payment, ledger, fraud, and egress VPCs.
Without explicit association, DNS queries for the custom domain name will fail within the spoke VPCs because Route 53 Private Hosted Zones do not resolve transitively across Transit Gateway attachments.

Anahtar Kavram

Multi-VPC hybrid routing with Transit Gateway, redundant AZ-level NAT Gateway configuration, and cross-account Route 53 Private Hosted Zone association.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru