Examkin

Soru

Zorluk: ZorNetworking and Connectivity Design

A financial enterprise is designing a new multi-account AWS architecture in the us-west-2 Region. The design includes two spoke VPCs, App-VPC-01 (CIDR 10.1.0.0/16) and App-VPC-02 (CIDR 10.2.0.0/16), which host application workloads in private subnets across two Availability Zones. A third VPC, Shared-Services-VPC (CIDR 10.100.0.0/16), hosts a shared database cluster. The enterprise has the following requirements:

* Workloads in both spoke VPCs must access the shared database cluster in the Shared-Services-VPC.
* Workloads in App-VPC-01 and App-VPC-02 must be strictly isolated from each other at the network routing layer.
* Workloads in the spoke VPCs must privately resolve the database domain db.corp.internal, which is hosted in a Route 53 Private Hosted Zone (PHZ) in the shared services account.
* Outbound internet egress for all VPCs must be routed through a centralized egress VPC (Egress-VPC) for inspection via AWS Network Firewall. The outbound egress architecture must be resilient to Availability Zone outages.

Which of the following designs meets these requirements with the least operational complexity?

  1. Deploy an AWS Transit Gateway. Create a Spoke Transit Gateway Route Table associated with the App-VPC-01 and App-VPC-02 attachments, with routes to the Shared-Services-VPC attachment and a default route (0.0.0.0/0) pointing to the Egress-VPC attachment. Create a Shared Services Transit Gateway Route Table associated with the Shared-Services-VPC attachment, with routes to both spoke VPC attachments and a default route to the Egress-VPC attachment. Deploy NAT Gateways in multiple Availability Zones within the Egress-VPC. Associate the db.corp.internal Private Hosted Zone with App-VPC-01, App-VPC-02, and Shared-Services-VPC using cross-account authorization.Cevap
  2. B
    Deploy an AWS Transit Gateway. Create a Spoke Transit Gateway Route Table associated with the App-VPC-01 and App-VPC-02 attachments, with routes to the Shared-Services-VPC attachment and a default route (0.0.0.0/0) pointing to the Egress-VPC attachment. Create a Shared Services Transit Gateway Route Table associated with the Shared-Services-VPC attachment, with routes to both spoke VPC attachments and a default route to the Egress-VPC attachment. Deploy NAT Gateways in multiple Availability Zones within the Egress-VPC. Configure the DHCP options sets in App-VPC-01 and App-VPC-02 to use the IP address of the Route 53 Resolver in the Shared-Services-VPC (10.100.0.2) as the primary DNS server to resolve db.corp.internal.
  3. C
    Deploy an AWS Transit Gateway. Create a Spoke Transit Gateway Route Table associated with the App-VPC-01 and App-VPC-02 attachments, with routes to the Shared-Services-VPC attachment and a default route (0.0.0.0/0) pointing to the Egress-VPC attachment. Create a Shared Services Transit Gateway Route Table associated with the Shared-Services-VPC attachment, with routes to both spoke VPC attachments and a default route to the Egress-VPC attachment. Deploy a single NAT Gateway in one Availability Zone within the Egress-VPC to route all internet-bound traffic. Associate the db.corp.internal Private Hosted Zone with App-VPC-01, App-VPC-02, and Shared-Services-VPC using cross-account authorization.
  4. D
    Deploy an AWS Transit Gateway and enable default route propagation across all VPC attachments to a single default Transit Gateway route table. Deploy NAT Gateways in multiple Availability Zones within the Egress-VPC. Associate the db.corp.internal Private Hosted Zone with App-VPC-01, App-VPC-02, and Shared-Services-VPC using cross-account authorization. Configure Security Groups on the workloads in App-VPC-01 and App-VPC-02 to explicitly deny inbound traffic from the CIDR block of the other spoke VPC.

Cevap

Deploy an AWS Transit Gateway with separate Spoke and Shared Services Route Tables to enforce routing isolation. Deploy NAT Gateways in multiple Availability Zones in the Egress-VPC for resiliency. Associate the Private Hosted Zone with all VPCs using cross-account authorization.
The correct solution uses Transit Gateway custom route tables to prevent spoke-to-spoke communication at the routing layer. It routes spoke traffic only to the shared services and egress VPCs, fulfilling the isolation requirement. Outbound resilience is achieved by deploying NAT Gateways across multiple Availability Zones in the egress VPC. DNS resolution is correctly and efficiently achieved by directly associating the Private Hosted Zone with the spoke VPCs via cross-account authorization.

Adım Adım Çözüm

1
Configure Transit Gateway custom routing tables.
Create separate Spoke and Shared Services Transit Gateway route tables. Associate the spoke VPC attachments with the Spoke Route Table and configure routes to the Shared-Services-VPC and the default route to the Egress-VPC. Associate the Shared-Services-VPC attachment with the Shared Services Route Table and configure routes to both spoke VPCs. This isolates the spoke VPCs at the network routing layer.
Prevents spoke-to-spoke communication while allowing spoke-to-shared and spoke-to-egress traffic.
2
Ensure outbound resiliency in the central egress VPC.
Deploy NAT Gateways in multiple Availability Zones in the Egress-VPC. Outbound traffic from Transit Gateway is distributed across these NAT Gateways based on availability.
Prevents a single Availability Zone outage from disrupting outbound internet access for all VPCs.
3
Set up private DNS resolution cross-account.
Associate the db.corp.internal Private Hosted Zone in the Shared Services account with App-VPC-01 and App-VPC-02 using Route 53 cross-account PHZ association commands.
Allows workloads in the spoke VPCs to resolve the database domain name using their local Route 53 resolvers without needing costly inbound/outbound resolver endpoints or trying to route DNS traffic over the Transit Gateway to a non-routable resolver IP address.

Anahtar Kavram

Multi-VPC isolation, private DNS resolution, and resilient egress routing using AWS Transit Gateway, Route 53 Private Hosted Zones, and multi-AZ NAT Gateways.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru