Examkin

Soru

Zorluk: ZorNetworking and Connectivity Design

A global gaming enterprise is launching a new multiplayer gaming platform in AWS. The architecture is deployed across multiple AWS accounts in the us-east-1 region and utilizes an AWS Transit Gateway (tgw-central) to interconnect VPCs. The setup includes a Shared Services VPC (vpc-shared-prod), a centralized Egress VPC (vpc-egress-prod), and three spoke application VPCs (vpc-game-auth, vpc-game-match, and vpc-game-profile). The spoke VPCs require resolution of private DNS records in a Route 53 Private Hosted Zone (game.internal) created in the Shared Services VPC. Furthermore, an on-premises data center connected to AWS via a Direct Connect Gateway linked to the Transit Gateway needs to resolve records in game.internal. To satisfy security compliance, all outbound internet traffic from the spoke VPCs must be routed through AWS Network Firewall and NAT Gateways in vpc-egress-prod, and the architecture must remain fully resilient against Availability Zone outages. Which combination of actions should the solutions architect take to satisfy these networking and DNS requirements? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone game.internal with each of the spoke VPCs (vpc-game-auth, vpc-game-match, and vpc-game-profile). Deploy Route 53 Resolver Inbound Endpoints in vpc-shared-prod across at least two Availability Zones, and configure the on-premises DNS servers to conditionally forward DNS queries for game.internal to these inbound endpoint IP addresses.Cevap
  2. Deploy AWS Network Firewall endpoints and NAT Gateways in vpc-egress-prod across multiple Availability Zones. Configure the route tables in the private subnets of vpc-egress-prod to route traffic to the Network Firewall endpoints, and configure the public subnet route tables to route traffic to their local, zone-specific NAT Gateways.Cevap
  3. C
    Associate the Route 53 Private Hosted Zone game.internal exclusively with vpc-shared-prod. Configure the Transit Gateway route tables to transitively propagate DNS query traffic from the spoke VPCs to vpc-shared-prod for name resolution.
  4. D
    Deploy a single NAT Gateway in vpc-egress-prod within a single Availability Zone to minimize data transfer costs. Configure a shared route table in vpc-egress-prod to route all outbound internet traffic from all subnets through this single NAT Gateway.
  5. E
    Establish a separate Transit Gateway Route Table that maps the spoke VPC attachments directly to the Direct Connect Gateway. Use the Direct Connect Gateway's built-in transitive VPC routing capability to bypass the centralized Transit Gateway routing for DNS query path optimization.

Cevap

To meet the requirements, the solutions architect must associate the Private Hosted Zone with all spoke VPCs and deploy Route 53 Resolver Inbound Endpoints across multiple Availability Zones in the Shared Services VPC, forwarding on-premises DNS queries to them. Additionally, the architect must deploy AWS Network Firewall endpoints and NAT Gateways across multiple Availability Zones in the Egress VPC, configuring route tables to route outbound traffic through zone-specific NAT Gateways.
To satisfy the DNS requirements, the Private Hosted Zone must be associated with the spoke VPCs so they can query it locally. Deploying Route 53 Resolver Inbound Endpoints in the Shared Services VPC across multiple Availability Zones ensures highly available resolution of private domains from the on-premises data center. To satisfy the egress requirements with high availability, NAT Gateways and AWS Network Firewall endpoints must be deployed in multiple Availability Zones within the egress VPC, and subnets must route traffic through their local, zone-specific endpoints to eliminate single points of failure.

Adım Adım Çözüm

1
Associate the Route 53 Private Hosted Zone game.internal with each of the spoke VPCs (vpc-game-auth, vpc-game-match, and vpc-game-profile).
DNS queries for game.internal originating from within the spoke VPCs can be resolved by the local Route 53 Resolver.
Route 53 Private Hosted Zones are only queryable from VPCs that have been explicitly associated with them.
2
Deploy Route 53 Resolver Inbound Endpoints in vpc-shared-prod across at least two Availability Zones and configure on-premises DNS conditional forwarding.
On-premises DNS servers can resolve game.internal queries by forwarding them to the inbound endpoint IP addresses.
This establishes hybrid DNS resolution, allowing on-premises clients to query the AWS-hosted Private Hosted Zone.
3
Deploy AWS Network Firewall endpoints and NAT Gateways across multiple Availability Zones in vpc-egress-prod.
Outbound egress traffic is filtered and routed via zone-redundant NAT Gateways.
Ensures high availability and prevents an Availability Zone failure from causing an outage for outbound traffic across all spoke VPCs.

Anahtar Kavram

Designing a resilient, secure hybrid network architecture with centralized egress routing and multi-VPC Route 53 Private Hosted Zone DNS resolution.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru