Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

A retail company is designing a new cloud infrastructure on AWS. The design requires two VPCs in the us-west-2 region: vpc-app-prod, which hosts application servers across two Availability Zones (us-west-2a and us-west-2b), and vpc-egress-shared, which is dedicated to centralized outbound internet traffic. An AWS Transit Gateway (tgw-main) is deployed to interconnect the VPCs. Additionally, a Route 53 Private Hosted Zone (PHZ) named prod.corp.internal is hosted in the AWS account managing vpc-egress-shared. The company requires a highly available network design that prevents single points of failure for outbound traffic, supports private DNS resolution of prod.corp.internal from the application servers, and minimizes operational complexity. Which of the following designs best meets these requirements?

  1. Deploy a NAT Gateway in both us-west-2a and us-west-2b within vpc-egress-shared. Configure the private subnet route tables of vpc-app-prod to route 0.0.0.0/0 to tgw-main. Configure Transit Gateway route tables to route internet-bound traffic to vpc-egress-shared and return traffic back to vpc-app-prod. Associate the prod.corp.internal Private Hosted Zone directly with vpc-app-prod using the Route 53 console or AWS CLI.Cevap
  2. B
    Deploy a single NAT Gateway in us-west-2a within vpc-egress-shared to minimize cost. Configure the private subnet route tables of vpc-app-prod to route 0.0.0.0/0 to tgw-main, directing all egress traffic to the single NAT Gateway. Associate the prod.corp.internal Private Hosted Zone directly with vpc-app-prod using the Route 53 console or AWS CLI.
  3. C
    Deploy a NAT Gateway in both us-west-2a and us-west-2b within vpc-egress-shared. Configure the private subnet route tables of vpc-app-prod to route 0.0.0.0/0 to tgw-main. Configure Transit Gateway route tables to route internet-bound traffic to vpc-egress-shared. Rely on Transit Gateway’s built-in DNS support to automatically propagate and resolve records from prod.corp.internal across all attached VPCs.
  4. D
    Deploy a NAT Gateway in both us-west-2a and us-west-2b within vpc-egress-shared. Establish a VPC Peering connection between vpc-app-prod and vpc-egress-shared. Configure the private subnet route tables of vpc-app-prod to route 0.0.0.0/0 through the VPC Peering connection to the NAT Gateways in vpc-egress-shared. Associate the prod.corp.internal Private Hosted Zone directly with vpc-app-prod using the Route 53 console or AWS CLI.

Cevap

Deploy a NAT Gateway in both us-west-2a and us-west-2b within vpc-egress-shared, configure vpc-app-prod to route 0.0.0.0/0 to tgw-main, and associate the prod.corp.internal Private Hosted Zone directly with vpc-app-prod.
The correct design ensures high availability for egress traffic by deploying redundant NAT Gateways across two Availability Zones in the shared egress VPC. Traffic from the application VPC is routed to the Transit Gateway, which forwards it to the egress VPC. Additionally, the Route 53 Private Hosted Zone is associated directly with the application VPC to allow native DNS resolution.

Adım Adım Çözüm

1
Design highly available egress architecture.
NAT Gateways are deployed in both us-west-2a and us-west-2b in vpc-egress-shared to eliminate any single point of failure.
Ensures that an Availability Zone outage in us-west-2a does not disrupt egress traffic originating from us-west-2b.
2
Configure routing for centralized egress.
The default route (0.0.0.0/0) in vpc-app-prod route tables points to the Transit Gateway, which routes the traffic to vpc-egress-shared, and then out through the local NAT Gateways.
Allows vpc-app-prod to route outbound internet traffic through the centralized egress VPC without relying on unsupported peering configurations.
3
Configure DNS resolution for the Private Hosted Zone.
The Route 53 Private Hosted Zone (PHZ) prod.corp.internal is associated directly with vpc-app-prod.
Enables instances in the application VPC to query the Amazon-provided DNS server (Route 53 Resolver) and resolve private resource records in the hosted zone without requiring custom DNS infrastructure.

Anahtar Kavram

Multi-VPC architecture using Transit Gateway for centralized egress with redundant NAT Gateways and explicit Route 53 Private Hosted Zone associations.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru