Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

A medical device company is designing a new AWS environment in the `eu-central-1` region. The architecture consists of a Production VPC (`vpc-prod-clinical`) and a Development VPC (`vpc-dev-clinical`), each deployed across two Availability Zones (AZ-A and AZ-B). The application workloads in the private subnets of both VPCs require highly available outbound internet access to download software patches. Additionally, the company needs to resolve internal API endpoints hosted in a Route 53 Private Hosted Zone (PHZ) named `clinical.internal` across both VPCs. Which two network design actions should the Solutions Architect recommend to satisfy these requirements while preventing single points of failure?

  1. Deploy a NAT Gateway in a public subnet in AZ-A and another NAT Gateway in a public subnet in AZ-B within the Production VPC, then configure the private subnet route tables to direct outbound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway in their respective Availability Zones.Cevap
  2. B
    Deploy a single NAT Gateway in a public subnet in AZ-A of the Production VPC, and configure the route tables of private subnets in both AZ-A and AZ-B to route outbound traffic (0.0.0.0/00.0.0.0/0) to this NAT Gateway.
  3. Associate the Route 53 Private Hosted Zone `clinical.internal` directly with both the Production VPC and the Development VPC from the AWS account owning the hosted zone.Cevap
  4. D
    Associate the Route 53 Private Hosted Zone only with the Production VPC, and deploy Route 53 Resolver inbound and outbound endpoints in each VPC to forward DNS queries from the Development VPC to the Production VPC.
  5. E
    Create an AWS Transit Gateway to connect the VPCs, and route all outbound internet traffic (0.0.0.0/00.0.0.0/0) from both VPC private subnets directly to the Transit Gateway without deploying NAT Gateways, relying on the Transit Gateway to route the traffic directly to the internet.

Cevap

Deploy a NAT Gateway in a public subnet in AZ-A and another in AZ-B within the Production VPC, configure private subnet route tables to direct outbound traffic to the NAT Gateway in their respective Availability Zones, and associate the Route 53 Private Hosted Zone directly with both VPCs.
The correct architecture uses one NAT Gateway in each Availability Zone within the VPC, with local routing configured to ensure high availability and prevent cross-AZ data charges. Additionally, Route 53 Private Hosted Zones support direct association with multiple VPCs, ensuring native cross-VPC DNS resolution without the overhead of Route 53 Resolver endpoints.

Adım Adım Çözüm

1
Analyze outbound internet egress requirements for high availability.
Identify that a single NAT Gateway creates a single point of failure across Availability Zones. Multi-AZ deployment requires deploying a NAT Gateway in each AZ and modifying route tables so each private subnet utilizes the NAT Gateway in its local zone.
This guarantees that an AZ-level failure does not disrupt the internet connection of the other operational AZ.
2
Analyze Route 53 Private Hosted Zone resolution across multiple VPCs.
Recall that Route 53 Private Hosted Zones can be directly associated with multiple VPCs, even across different AWS accounts in the same organization.
Direct association allows DNS resolution to function natively within the VPCs without needing DNS forwarding rules or Route 53 Resolver endpoints.

Anahtar Kavram

High availability network design using multi-AZ NAT Gateways and native Route 53 Private Hosted Zone multi-VPC associations.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru