Examkin

Soru

Zorluk: ZorNetworking and Connectivity Design

An enterprise is designing a new cloud infrastructure in the us-west-2 Region using AWS Organizations. The architecture requires connecting two spoke VPCs, vpc-hr-app and vpc-finance-app, to a centralized shared services VPC, vpc-shared-services. Workloads in both spoke VPCs require outbound internet access to download software patches, but must not accept any inbound traffic from the internet. Additionally, these workloads must securely access a shared database hosted in vpc-shared-services and resolve private domain names in a Route 53 Private Hosted Zone (PHZ) named services.local hosted in the shared services AWS account. Outbound internet access must be highly available and resilient to Availability Zone (AZ) failures. Which two steps should the solutions architect take to design this connectivity? (Select two.)

  1. A
    Deploy a single NAT Gateway in a public subnet within the shared services VPC, and update the route tables of both spoke VPCs to direct all internet-bound traffic (0.0.0.0/00.0.0.0/0) to this central NAT Gateway.
  2. In each spoke VPC, deploy a NAT Gateway in public subnets across two Availability Zones, and configure the private subnet route tables to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the local NAT Gateway in their respective Availability Zone.Cevap
  3. C
    Create an AWS Transit Gateway, attach all three VPCs, and configure a single Transit Gateway route table to route all outbound internet traffic from the spoke VPCs directly through the Internet Gateway attached to the shared services VPC.
  4. Authorize the association of the Route 53 Private Hosted Zone services.local in the shared services account with the spoke VPCs using the AWS CLI or SDK, and then associate the zone from the spoke VPC accounts.Cevap
  5. E
    Create Route 53 Resolver outbound endpoints in each spoke VPC and set up conditional forwarding rules for services.local pointing to the Route 53 inbound resolver IP addresses in the shared services VPC.

Cevap

To achieve highly available outbound connectivity and private DNS resolution, the architect should deploy redundant NAT Gateways across Availability Zones in each spoke VPC and associate the centralized Private Hosted Zone directly with all spoke VPCs using cross-account authorization.
Deploying NAT Gateways in multiple Availability Zones within each spoke VPC ensures that outbound internet traffic has local redundancy and does not experience a single point of failure or cross-AZ data transfer fees for egress. For DNS resolution, Route 53 Private Hosted Zones can be shared across multiple AWS accounts by authorizing the association from the hosting account and then completing the association from the owner accounts of the client VPCs. This provides a direct, highly available, and cost-effective resolution mechanism without the deployment overhead of Route 53 Resolver endpoints.

Adım Adım Çözüm

1
Design highly available outbound internet access.
Deploy NAT Gateways in public subnets in each Availability Zone of the spoke VPCs.
This prevents a single AZ outage from disabling internet access for all workloads and avoids cross-AZ data transfer charges.
2
Establish cross-account private DNS resolution.
Use AWS CLI/SDK to authorize the association of services.local with the spoke VPCs from the shared services account, then accept and associate it from the spoke accounts.
This eliminates the need for expensive and complex Route 53 Resolver endpoint infrastructure.

Anahtar Kavram

Cross-account Route 53 Private Hosted Zone association and AZ-redundant NAT Gateway routing design.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru