A healthcare enterprise is building a diagnostics imaging platform across multiple AWS accounts in the `us-east-1` region. The architecture contains `vpc-diagnostics-prod` (CIDR ) with EC2 instances processing images in private subnets across two Availability Zones (`us-east-1a` and `us-east-1b`), `vpc-shared-services` (CIDR ) hosting core infrastructure including a Route 53 Private Hosted Zone (PHZ) `imaging.internal`, and `vpc-security-egress` (CIDR ) dedicated to outbound inspection using AWS Network Firewall and NAT Gateways. The corporate on-premises datacenter is connected via AWS Direct Connect (DX) terminating on a Direct Connect Gateway (DXGW) associated with an AWS Transit Gateway (`tgw-us-east-1`). The enterprise requires: (1) Image processing instances in `vpc-diagnostics-prod` must resolve names in `imaging.internal` and the on-premises domain `corp.local`. (2) On-premises servers must be able to resolve names in `imaging.internal`. (3) All outbound internet traffic from `vpc-diagnostics-prod` must be inspected by AWS Network Firewall in `vpc-security-egress` in a manner that tolerates a single Availability Zone outage without losing internet connectivity or violating security requirements. Which TWO network configurations should the solutions architect implement to meet these requirements?
- In `vpc-security-egress`, deploy AWS Network Firewall endpoints and NAT Gateways across both Availability Zones. Configure the Transit Gateway route table for `vpc-diagnostics-prod` with a default route () pointing to the Transit Gateway attachment for `vpc-security-egress`. In `vpc-security-egress`, route traffic from the Transit Gateway attachment subnets to the local Network Firewall endpoint, then to the local NAT Gateway, and configure NAT Gateway subnet route tables to route outbound traffic through the Internet Gateway.Cevap
- Associate the `imaging.internal` Private Hosted Zone with both `vpc-shared-services` and `vpc-diagnostics-prod`. In `vpc-shared-services`, create a Route 53 Resolver Inbound Endpoint and configure on-premises DNS servers to forward queries for `imaging.internal` to its IP addresses. Create a Route 53 Resolver Outbound Endpoint in `vpc-diagnostics-prod` and a Resolver rule that forwards queries for `corp.local` to the on-premises DNS servers over the Direct Connect connection.Cevap
- CIn `vpc-security-egress`, deploy AWS Network Firewall endpoints in both Availability Zones and a single NAT Gateway in the `us-east-1a` public subnet. Configure the Transit Gateway route table for `vpc-diagnostics-prod` to route all internet-bound traffic through the `vpc-security-egress` attachment, routing all firewall-inspected traffic to the single NAT Gateway to minimize NAT Gateway hourly charges.
- DAssociate the `imaging.internal` Private Hosted Zone only with `vpc-shared-services`. Create a Route 53 Resolver Outbound Endpoint in `vpc-diagnostics-prod` and configure a forwarding rule for `imaging.internal` that forwards DNS requests directly to the Route 53 Resolver IP address () in `vpc-shared-services` via the Transit Gateway connection.
- EAssociate the Direct Connect Gateway directly with the Virtual Private Gateways (VGWs) attached to `vpc-diagnostics-prod` and `vpc-shared-services`. Use the Direct Connect Gateway to enable transitive routing and pass DNS queries directly between the on-premises network and the VPCs, bypassing the Transit Gateway for DNS traffic to reduce latency.