Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

An enterprise is designing a new AWS environment in the eu-west-1 Region. The architecture consists of two spoke VPCs (vpc-workload-a and vpc-workload-b) and a centralized services VPC (vpc-shared-services). The workloads in both spoke VPCs must:

1. Resolve internal DNS queries for a Route 53 Private Hosted Zone (PHZ) named internal.enterprise that is created and managed in the shared services AWS account.
2. Have outbound-only internet access that is resilient to Availability Zone (AZ) outages.
3. Be prevented from communicating directly with each other.

Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone internal.enterprise with both vpc-workload-a and vpc-workload-b by submitting VPC association authorization requests and associating the VPCs.Cevap
  2. Deploy one NAT Gateway in each of two Availability Zones within the public subnets of vpc-shared-services, and route outbound internet traffic from the spoke VPCs through an AWS Transit Gateway to the shared services VPC.Cevap
  3. C
    Associate the Route 53 Private Hosted Zone with the Transit Gateway attachment in the shared services account, allowing all attached spoke VPCs to inherit the DNS resolution automatically.
  4. D
    Deploy a single NAT Gateway in a single public subnet of vpc-shared-services and configure the routing tables in both Availability Zones of the spoke VPCs to send internet-bound traffic to this NAT Gateway via the Transit Gateway.
  5. E
    Enable Transit Gateway route propagation between vpc-workload-a and vpc-workload-b to allow transitive routing to the NAT Gateway in the public subnets of the other spoke VPC.

Cevap

To meet the requirements, the solutions architect must associate the Route 53 Private Hosted Zone internal.enterprise with both workload VPCs, and deploy redundant NAT Gateways across two Availability Zones in the shared services VPC, routing egress traffic from the workloads through AWS Transit Gateway.
Associating the Private Hosted Zone directly with all target VPCs ensures proper cross-account DNS resolution. Deploying redundant NAT Gateways across multiple Availability Zones in the centralized services VPC provides a highly available, fault-tolerant path for outbound internet traffic using Transit Gateway routing, without enabling direct spoke-to-spoke communication.

Adım Adım Çözüm

1
Configure DNS cross-account association.
Associate the Route 53 Private Hosted Zone hosted in the shared services account with the workload VPCs in other accounts using the AWS CLI or SDK to authorize and associate.
Route 53 Private Hosted Zones require direct association with VPCs for DNS resolution, and cross-account associations require authorization.
2
Configure highly available centralized egress.
Deploy NAT Gateways in multiple public subnets across different Availability Zones within the central egress or shared services VPC.
This avoids a single point of failure for outbound traffic.
3
Set up Transit Gateway routing with isolation.
Create Transit Gateway route tables that direct outbound 0.0.0.0/0 traffic from the spoke VPCs to the shared services VPC attachment, while ensuring no routes exist between the spoke VPCs.
This satisfies the requirement to keep the spoke VPCs isolated from each other while permitting centralized internet access.

Anahtar Kavram

Centralized network architecture design with high availability, private DNS resolution, and VPC isolation using AWS Transit Gateway and Route 53 PHZ.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru