Examkin

Soru

Zorluk: KolayHybrid and Multi-Account Network Connectivity Design

A company needs to interconnect 20 VPCs across multiple AWS accounts in a single AWS Region. The network design must support routing between all VPCs and an on-premises data center. Additionally, instances in all VPCs must be able to resolve domain names hosted in a single Route 53 Private Hosted Zone (PHZ) in a central shared services account. The solution must minimize administrative overhead and maintain high availability for outbound internet traffic. Which solution meets these requirements?

  1. A
    Associate a Direct Connect Gateway directly with the Virtual Private Gateways (VGWs) of all 20 VPCs, and rely on the Direct Connect Gateway to route transitive traffic between the VPCs and to the on-premises data center.
  2. Deploy an AWS Transit Gateway to interconnect the VPCs and connect the on-premises network. Associate the centralized Route 53 Private Hosted Zone with all VPCs across the accounts, and deploy redundant NAT Gateways across multiple Availability Zones in an egress VPC.Cevap
  3. C
    Deploy an AWS Transit Gateway to interconnect the VPCs and connect the on-premises network. Configure a Route 53 Private Hosted Zone in the central account but do not associate it with the other VPCs, assuming DNS queries will route over the Transit Gateway.
  4. D
    Deploy an AWS Transit Gateway to interconnect the VPCs. Route all outbound internet traffic from all Availability Zones in the attached VPCs through a single NAT Gateway located in a single public subnet of a centralized egress VPC.

Cevap

Deploy an AWS Transit Gateway to interconnect the VPCs and connect the on-premises network. Associate the centralized Route 53 Private Hosted Zone with all VPCs across the accounts, and deploy redundant NAT Gateways across multiple Availability Zones in an egress VPC.
The correct architecture uses AWS Transit Gateway to act as a centralized hub for routing traffic transitively between all 20 VPCs and the on-premises data center. To allow DNS resolution for shared internal domains, the Route 53 Private Hosted Zone (PHZ) must be associated with all consumer VPCs across the accounts. Finally, high availability for egress traffic is maintained by using redundant NAT Gateways across multiple Availability Zones in the centralized egress VPC.

Adım Adım Çözüm

1
Evaluate the routing requirements for transitive VPC-to-VPC and hybrid traffic.
Determine that AWS Transit Gateway is the appropriate service to support transitive routing and simplify connectivity for 20 VPCs.
Direct Connect Gateway cannot perform transitive routing between VPCs directly, making Transit Gateway necessary.
2
Evaluate the DNS configuration needed for cross-account private DNS resolution.
Determine that the central Private Hosted Zone (PHZ) must be associated with every VPC that requires resolution.
VPCs cannot resolve records in a PHZ unless the PHZ is explicitly associated with them.
3
Assess the high availability configuration for outbound internet traffic.
Determine that redundant NAT Gateways must be deployed across multiple Availability Zones in the central egress VPC.
A single NAT Gateway creates a single point of failure for outbound traffic across all Availability Zones.

Anahtar Kavram

AWS Transit Gateway for transitive hybrid routing, centralized Route 53 Private Hosted Zone association, and multi-AZ redundant egress architecture.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru