Examkin

Question

Difficulty: MediumVPC Security for Developers

An application is deployed on Amazon ECS using the AWS Fargate launch type within private subnets of a custom VPC. The application needs to securely establish a connection to an Amazon Aurora PostgreSQL database located in a database private subnet, using credentials that are automatically rotated. Additionally, the application must connect to an external third-party API on the public internet to process payments. Which configuration steps should the developer take to meet these requirements? (Select TWO.)

  1. Deploy a NAT gateway in a public subnet, and add a route in the application's private subnet route table pointing 0.0.0.0/0 to the NAT gateway.Answer
  2. Update the security group of the Amazon Aurora database to allow inbound traffic on port 5432 from the security group attached to the ECS tasks.Answer
  3. C
    Update the route table of the application's private subnets to route outbound traffic (0.0.0.0/0) directly to an Internet Gateway.
  4. D
    Modify the trust policy of the ECS task role to permit network traffic on port 5432 from the VPC CIDR block.
  5. E
    Save the database credentials in AWS Systems Manager Parameter Store and configure the built-in automatic rotation for the parameters.

Answer

The correct configurations are to deploy a NAT gateway in a public subnet and configure the application private subnet route table to point 0.0.0.0/0 traffic to it, and to update the database security group to permit inbound connections on port 5432 from the ECS task security group.
To allow private ECS Fargate tasks to reach the internet-facing payment API, a NAT Gateway is required in a public subnet with a corresponding route in the private subnet route table. To enable connectivity to the Aurora PostgreSQL database, the database's security group must permit inbound traffic on port 5432 from the security group assigned to the ECS tasks, ensuring only authorized tasks can connect.

Step-by-Step Solution

1
Determine the requirements for outbound internet access from private subnets.
Identify that AWS Fargate tasks running in private subnets cannot communicate directly with the internet. They require a NAT Gateway deployed in a public subnet with a corresponding route in the private subnet's route table pointing outbound traffic (0.0.0.0/0) to the NAT Gateway.
This configuration enables the tasks to connect to the external payment API while keeping them in private subnets.
2
Determine the requirements for secure database access within the VPC.
Configuring the security group of the target database to accept traffic on the database port from the source security group of the Fargate tasks.
Referencing security groups instead of IP ranges maintains dynamic, secure access and satisfies least-privilege security standards.
3
Evaluate the credentials rotation and identity configurations.
Identify that automatic secrets rotation is a feature of AWS Secrets Manager, not Systems Manager Parameter Store, and that IAM trust policies govern role assumption rather than network ports.
This rules out the invalid distractors targeting parameter storage and IAM configuration.

Key Concept

VPC security group referencing and private routing configurations for secure outbound and database traffic.
Rate this question

Topics

VPC Security for Developers

More questions from this topic