A multinational company is designing a hybrid network architecture to connect two on-premises data centers (located in New York and London) to its AWS multi-account environment. The AWS environment consists of VPCs distributed across the `us-east-1` and `eu-west-2` regions.
The connectivity requirements are:
- Primary connectivity must use AWS Direct Connect (DX) links with a minimum bandwidth of at each location.
- AWS Site-to-Site VPN connections over the internet must serve as the backup path.
- The New York data center must primarily access resources in `us-east-1`, and the London data center must primarily access resources in `eu-west-2`.
- Direct communication between the New York and London data centers through the AWS network must be prevented for regulatory compliance.
- Outbound internet access from the VPCs must be centralized through a shared services VPC in each region, ensuring high availability and resilience against Availability Zone (AZ) failures.
Which TWO steps should the Solutions Architect take to configure the routing and connectivity to meet these requirements?
- Deploy AWS Transit Gateway in both regions, peered together, and associate them with a Direct Connect Gateway. Use separate Transit Gateway route tables for VPC attachments and hybrid attachments to prevent routing traffic between the two on-premises data centers.Cevap
- Deploy redundant NAT Gateways across multiple Availability Zones in a central egress VPC in each region, and configure the route tables of the spoke VPCs to route outbound traffic through the Transit Gateway to the local NAT Gateways.Cevap
- CConnect the spoke VPCs in both regions directly to a single shared Direct Connect Gateway (DXGW) using private virtual interfaces (VIFs) to establish routing between the VPCs and the data centers.
- DCreate a Route 53 Private Hosted Zone (PHZ) for internal service resolution and associate the PHZ directly with the Transit Gateway attachments in both regions to enable cross-account DNS resolution.
- ECentralize internet egress by deploying a single NAT Gateway in the shared services VPC of the primary region, and route all outbound internet traffic from both regions to this NAT Gateway.