Examkin

Question

Difficulty: MediumAWS Network Services

A startup is deploying a web-based platform with two virtual networks: one for their frontend web servers and one for their backend database. They want to enable private, low-latency communication between these two virtual networks without routing traffic through the public internet. At the same time, they need to restrict database access so that only the frontend web servers can communicate with the database instances on port 3306, while automatically allowing returning traffic. Which two AWS network or security features should the company implement to meet these requirements? (Select two.)

  1. VPC PeeringAnswer
  2. Security GroupsAnswer
  3. C
    AWS Transit Gateway
  4. D
    Network Access Control Lists (Network ACLs)
  5. E
    IAM Roles

Answer

VPC Peering and Security Groups
VPC Peering is correct because it connects two VPCs directly, privately, and with minimal latency. Security Groups are correct because they control traffic statefully at the instance level and allow referencing the frontend instances' security group as the source.

Step-by-Step Solution

1
Analyze the connection requirement.
The company needs a simple, private, low-latency connection between exactly two virtual networks (VPCs) without internet traversal.
VPC Peering is the most direct and cost-effective method to connect two VPCs. AWS Transit Gateway is designed for larger, complex hub-and-spoke multi-VPC networks and is unnecessary here.
2
Analyze the traffic restriction and security requirements.
The company needs to restrict traffic specifically to database instances on port 3306 based on the frontend source, and ensure returning traffic is automatically allowed.
Security Groups operate statefully at the instance level, allowing returning traffic automatically and allowing the frontend security group to be referenced as the source. Network ACLs operate at the subnet level, are stateless, and cannot reference other security groups.

Key Concept

AWS hybrid and inter-VPC network connectivity combined with stateful instance-level security filtering.
Rate this question

Topics

AWS Network Services

More questions from this topic