Examkin

Soru

Zorluk: OrtaHybrid and Multi-Account Network Connectivity Design

An enterprise is establishing a hybrid network to connect its on-premises data center with 10 spoke VPCs and a Shared Services VPC in the `us-east-1` Region. The on-premises environment connects via an AWS Direct Connect connection. The architecture must support transitive VPC-to-VPC routing, access to the on-premises data center, and resolution of resources in a centralized Route 53 Private Hosted Zone. Which architecture meets these requirements with the lowest administrative overhead?

  1. Deploy an AWS Transit Gateway, and attach the spoke VPCs and the Shared Services VPC to it. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. Associate the Route 53 Private Hosted Zone in the Shared Services VPC with all the spoke VPCs and the Shared Services VPC.Cevap
  2. B
    Attach a Virtual Private Gateway to each spoke VPC and the Shared Services VPC. Connect all the Virtual Private Gateways to the Direct Connect Gateway using private virtual interfaces, and configure the Direct Connect Gateway to route transitive traffic between the spoke VPCs.
  3. C
    Deploy an AWS Transit Gateway, and attach the spoke VPCs and the Shared Services VPC to it. Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface. Associate the Route 53 Private Hosted Zone only with the Shared Services VPC, and configure the spoke VPCs to route DNS queries to the Shared Services VPC resolver over the Transit Gateway.
  4. D
    Deploy an AWS Transit Gateway, and attach the spoke VPCs to it. Route all egress internet traffic from the spoke VPCs through a centralized egress VPC containing a single NAT Gateway deployed in a single Availability Zone, and use a full mesh of VPC peering connections for transitive routing between the spokes.

Cevap

Deploying an AWS Transit Gateway to attach all VPCs, associating the Direct Connect Gateway using a transit virtual interface, and associating the Route 53 Private Hosted Zone with all VPCs.
The correct architecture leverages AWS Transit Gateway to act as a cloud router, enabling transitive routing between all attached spoke VPCs and the Shared Services VPC. Using an AWS Direct Connect Gateway associated with the Transit Gateway via a transit virtual interface (Transit VIF) allows all VPCs to access the on-premises network. Finally, Route 53 Private Hosted Zones (PHZs) must be explicitly associated with each VPC that requires DNS resolution for the zone; DNS queries are link-local (sent to the VPC resolver at the .2 address) and cannot traverse Transit Gateway attachments to reach a hosted zone associated only with a remote VPC.

Adım Adım Çözüm

1
Evaluate routing requirements.
Identify that VPC-to-VPC transitive routing and hybrid connectivity can be achieved centrally using AWS Transit Gateway.
VPC peering does not support transitive routing, and Direct Connect Gateway alone does not route traffic between connected VPCs.
2
Configure hybrid connectivity via Direct Connect.
Associate the Direct Connect Gateway with the Transit Gateway using a transit virtual interface (Transit VIF).
A transit VIF is the only virtual interface type that supports AWS Transit Gateway association with a Direct Connect Gateway.
3
Address DNS resolution requirements.
Associate the Route 53 Private Hosted Zone (PHZ) created in the Shared Services VPC with all 10 spoke VPCs.
Since VPC DNS resolvers (.2 address) only resolve query requests locally and do not forward queries over Transit Gateway, the PHZ must be explicitly associated with each VPC.

Anahtar Kavram

Transitive routing and centralized DNS resolution in multi-account hybrid AWS networks.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru