Examkin

Soru

Zorluk: ZorNetworking and Connectivity Design

An enterprise is designing a new multi-VPC application environment in the `ap-southeast-2` region. The environment consists of three VPCs: `vpc-shared-services`, `vpc-payments-prod`, and `vpc-orders-prod`. The payments and orders workloads must communicate with a shared PostgreSQL database cluster in `vpc-shared-services` and resolve its database endpoint using a Route 53 Private Hosted Zone (PHZ) named `db.prod.internal`. All three VPCs require outbound internet access to download software patches, but the enterprise wants to minimize ongoing NAT Gateway hourly charges and Transit Gateway data transfer fees while ensuring high availability. Which network architecture design meets these requirements?

  1. Deploy an AWS Transit Gateway named `tgw-regional` and attach all three VPCs. Associate the Route 53 PHZ `db.prod.internal` directly with `vpc-shared-services`, `vpc-payments-prod`, and `vpc-orders-prod` to enable local DNS resolution within each VPC. Centralize outbound internet traffic by deploying redundant NAT Gateways (one per Availability Zone) in the public subnets of `vpc-shared-services`, and route all outbound internet traffic from the private subnets of `vpc-payments-prod` and `vpc-orders-prod` through `tgw-regional` to the centralized NAT Gateways.Cevap
  2. B
    Deploy an AWS Transit Gateway named `tgw-regional` and attach all three VPCs. Associate the Route 53 PHZ `db.prod.internal` directly with all three VPCs. Centralize outbound internet traffic by deploying a single NAT Gateway in one Availability Zone in the public subnets of `vpc-shared-services`, and configure route tables in `vpc-payments-prod` and `vpc-orders-prod` to route all internet-bound traffic through `tgw-regional` to this single NAT Gateway.
  3. C
    Deploy an AWS Transit Gateway named `tgw-regional` and attach all three VPCs. Associate the Route 53 PHZ `db.prod.internal` only with `vpc-shared-services`. Deploy Route 53 Inbound Resolver Endpoints in `vpc-shared-services` and Route 53 Outbound Resolver Endpoints in both `vpc-payments-prod` and `vpc-orders-prod` to forward DNS queries for `db.prod.internal` to `vpc-shared-services` via `tgw-regional`. Centralize outbound internet traffic by deploying redundant NAT Gateways (one per Availability Zone) in `vpc-shared-services`.
  4. D
    Deploy an AWS Direct Connect Gateway and associate it directly with the virtual private gateways of `vpc-shared-services`, `vpc-payments-prod`, and `vpc-orders-prod`. Route all inter-VPC traffic and DNS resolution queries transitively through the Direct Connect Gateway to enable communication and DNS resolution. Deploy redundant NAT Gateways in each of the three VPCs to handle outbound internet traffic locally.

Cevap

Deploy an AWS Transit Gateway to interconnect the VPCs, associate the Route 53 Private Hosted Zone directly with all three VPCs to enable free, local DNS resolution, and centralize outbound internet egress via redundant NAT Gateways in the shared services VPC.
The correct design uses AWS Transit Gateway to enable VPC communication and associates the Route 53 Private Hosted Zone with all three VPCs. Direct association allows local Route 53 resolvers to resolve DNS queries at no additional cost and with minimal latency. Centralizing internet egress through redundant NAT Gateways in the shared services VPC balances cost and reliability, avoiding the charges of six NAT Gateways while preventing a single-AZ failure from disrupting internet access.

Adım Adım Çözüm

1
Analyze DNS resolution requirements for the multi-VPC architecture.
Determine that associating the Route 53 Private Hosted Zone directly with all target VPCs (shared services, payments, and orders) allows Route 53 Resolvers to answer queries locally within each VPC.
This avoids the latency, Transit Gateway data transfer costs, and additional endpoint charges associated with setting up Inbound/Outbound Route 53 Resolver Endpoints.
2
Evaluate the routing design for VPC-to-VPC communication.
Identify that AWS Transit Gateway is the correct resource to connect the three VPCs and enable secure routing between payments/orders and the shared database.
Direct Connect Gateway does not support transitive routing between VPCs, rendering options relying on it for inter-VPC traffic invalid.
3
Compare outbound internet connectivity strategies under cost and high availability constraints.
Centralizing egress through redundant NAT Gateways (one per Availability Zone) in the shared services VPC achieves high availability and avoids single-AZ failure while keeping hourly NAT Gateway costs lower than deploying them in all VPCs.
A single NAT Gateway fails the high availability constraint, while NAT Gateways in all VPCs fail the cost minimization constraint.

Anahtar Kavram

Multi-VPC DNS resolution via Private Hosted Zone association and centralized internet egress routing with high availability.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru