Examkin

Question

Difficulty: HardVPC Security for Developers

An engineering team is troubleshooting a newly deployed backend application hosted in a private subnet of a custom VPC. The application needs to retrieve objects from an Amazon S3 bucket and send messages to an Amazon SQS queue. The VPC has no Internet Gateway or NAT Gateway. The developer creates an Amazon S3 Gateway Endpoint and an Amazon SQS Interface Endpoint. However, the application is still experiencing connection timeouts when trying to access these services. Which of the following configuration changes must the developer make to resolve this issue? (Select TWO.)

  1. Verify that the route table associated with the private subnet contains an entry that directs traffic for S3 to the Gateway Endpoint.Answer
  2. Ensure the security group associated with the SQS Interface Endpoint allows inbound HTTPS (TCP port 443443) traffic from the application's security group.Answer
  3. C
    Associate the route table of the public subnet with the S3 Gateway Endpoint, and add a route pointing to the SQS Interface Endpoint in the private subnet's route table.
  4. D
    Store the VPC endpoint DNS names in AWS Secrets Manager and configure a scheduled rotation to refresh the endpoint connections hourly.
  5. E
    Modify the trust policy of the application's IAM execution role to trust the VPC Endpoint service principal vpce.amazonaws.com.

Answer

Verify that the route table associated with the private subnet contains an entry directing S3 traffic to the Gateway Endpoint, and ensure that the security group of the SQS Interface Endpoint allows inbound HTTPS traffic from the application's security group.
For the Gateway Endpoint to route traffic to Amazon S3 from the private subnet, the subnet's route table must contain an entry directing S3 traffic to the S3 Gateway Endpoint. For the Interface Endpoint (PrivateLink) to route SQS traffic, the application connects to the endpoint's Elastic Network Interface (ENI) private IPs, which requires the security group attached to the SQS Interface Endpoint to allow inbound HTTPS (TCP port 443443) traffic from the application's security group.

Step-by-Step Solution

1
Evaluate Gateway Endpoint configuration requirements.
Confirm that Gateway Endpoints (like Amazon S3) require route table entries in the private subnet's route table pointing to the gateway endpoint (`vpce-xxx`) to correctly route traffic.
Without route table updates, traffic destined for S3 will attempt to use the default route, which fails since there is no internet gateway or NAT gateway.
2
Evaluate Interface Endpoint configuration requirements.
Confirm that Interface Endpoints (like Amazon SQS) provision ENIs in the private subnet and rely on security groups to allow inbound HTTPS (TCP port 443443) traffic from the client.
Because Interface Endpoints use private IP addresses within the VPC, the security group of the endpoint must allow inbound traffic from the application's security group.
3
Rule out non-network configurations.
Identify that IAM execution roles, trust policies, and AWS Secrets Manager configurations do not resolve TCP connection timeouts.
Connection timeouts represent network layer blocks or routing failures, not IAM permission denials or credential management issues.

Key Concept

Configuring VPC endpoints (Gateway and Interface) and their respective route tables and security groups to allow secure, private access to AWS services.
Estimated Time:2m 30s
Rate this question

Topics

VPC Security for Developers

More questions from this topic