Examkin

Soru

Zorluk: OrtaNetworking and Connectivity Design

A media company is establishing a new environment in the ap-northeast-1 Region, consisting of two spoke VPCs (vpc-media-ingest and vpc-media-process) across two Availability Zones, and a shared services VPC (vpc-shared-core). The spoke VPCs require outbound-only internet connectivity for updates. They also need to resolve internal DNS names in a Route 53 Private Hosted Zone (media.internal) created in the shared services VPC. An AWS Transit Gateway is deployed to interconnect all three VPCs. Which configuration should the solutions architect implement to satisfy these requirements while ensuring high availability for outbound traffic?

  1. A
    Deploy a single NAT Gateway in one Availability Zone of the shared services VPC. In the spoke VPC route tables, point the default route to the Transit Gateway. In the Route 53 console, associate the Private Hosted Zone with the shared services VPC and both spoke VPCs.
  2. B
    Deploy one NAT Gateway in each Availability Zone of the shared services VPC. In the spoke VPC route tables, point the default route to the Transit Gateway. Associate the Private Hosted Zone only with the shared services VPC, relying on Transit Gateway routing to automatically resolve DNS queries from the spoke VPCs.
  3. Deploy one NAT Gateway in each Availability Zone of the shared services VPC. In the spoke VPC route tables, point the default route to the Transit Gateway. In the Route 53 console, associate the Private Hosted Zone with the shared services VPC and both spoke VPCs.Cevap
  4. D
    Attach the spoke VPCs directly to a Direct Connect Gateway to enable transitive spoke-to-spoke network routing and shared internet egress via the shared services VPC, and associate the Private Hosted Zone with all VPCs.

Cevap

Deploy one NAT Gateway in each Availability Zone of the shared services VPC, point the spoke VPC route tables default route to the Transit Gateway, and associate the Route 53 Private Hosted Zone with the shared services VPC and both spoke VPCs.
Deploying one NAT Gateway per Availability Zone in the shared services VPC ensures Availability Zone redundancy for outbound internet traffic. Associating the Route 53 Private Hosted Zone with all VPCs enables name resolution across the entire environment because Private Hosted Zones are not transitively resolvable across VPC associations via Transit Gateway alone. This design fully achieves high availability and correct DNS resolution.

Adım Adım Çözüm

1
Deploy redundant NAT Gateways across Availability Zones in the shared services VPC.
High availability for outbound internet traffic is established, eliminating single points of failure.
Ensures that outbound connectivity remains operational even during an Availability Zone outage.
2
Associate the Route 53 Private Hosted Zone with the shared services VPC and both spoke VPCs.
Private DNS resolution for domain names under the zone is enabled for all VPCs.
Route 53 Private Hosted Zones require explicit association with each VPC that needs to resolve its resource records.
3
Configure the spoke VPC route tables to point outbound traffic to the Transit Gateway, and configure Transit Gateway route tables to forward that traffic to the shared services VPC.
Egress traffic from the spoke VPCs is routed to the internet through the redundant NAT Gateways.
Transit Gateway acts as the central hub to aggregate and route traffic between spoke VPCs and the shared services egress path.

Anahtar Kavram

Designing highly available centralized egress architectures and configuring cross-VPC DNS resolution using Route 53 Private Hosted Zones.
Bu soruyu puanla

Konular

Networking and Connectivity Design

Bu konudan daha fazla soru