Examkin

Question

Difficulty: MediumVPC Security for Developers

A developer is deploying a backend application on Amazon ECS (Fargate) within a custom VPC. The application tasks are placed in private subnets and must connect to an Amazon ElastiCache for Redis cluster located in dedicated isolated subnets within the same VPC. Additionally, the application must fetch runtime API keys from AWS Secrets Manager and send transaction data to a third-party payment processing API on the public internet. Which combination of configurations will securely enable these connections while adhering to the principle of least privilege? (Select TWO.)

  1. Configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group, and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group.Answer
  2. Deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.Answer
  3. C
    Configure an Interface VPC Endpoint in the private subnets to route traffic directly to the third-party payment processing API, and add an inbound security group rule on the ECS tasks to allow return traffic on port 443.
  4. D
    Configure the ECS tasks' security group with an inbound rule allowing TCP traffic on port 6379 from the ElastiCache security group to allow return cache traffic, and configure the private subnets' Network ACL to be stateful to track outbound connection responses.
  5. E
    Store the third-party API keys in AWS Systems Manager Parameter Store with automatic rotation configured, and route both Secrets Manager and payment API requests through a NAT Gateway deployed in the isolated subnet.

Answer

The correct configurations are to configure the ECS tasks' security group to allow outbound TCP traffic on port 6379 to the ElastiCache security group and configure the ElastiCache security group to allow inbound TCP traffic on port 6379 from the ECS tasks' security group, and deploy a NAT Gateway in a public subnet, add a route pointing 0.0.0.0/0 to the NAT Gateway in the private subnets' route table, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets.
The correct configurations involve using stateful security group rules to authorize outbound traffic from the ECS tasks' security group to the ElastiCache security group on port 6379, while allowing inbound traffic on the ElastiCache security group from the ECS tasks. To access the public internet, a NAT Gateway must be deployed in a public subnet with a corresponding route in the private subnets' route table. To securely access AWS Secrets Manager without using the public internet, an Interface VPC Endpoint should be created inside the private subnets.

Step-by-Step Solution

1
Configure internal database connectivity using security groups.
ECS tasks are permitted to initiate TCP connections to the ElastiCache cluster on port 6379, and the ElastiCache cluster permits inbound connections only from the ECS tasks' security group. Because security groups are stateful, return traffic is automatically handled without extra inbound rules.
Ensures secure, restricted database access within the VPC without exposing databases to broader subnet traffic.
2
Configure public internet routing for the external API.
A NAT Gateway is deployed in a public subnet, and the private subnet routing table is updated with a route pointing 0.0.0.0/0 to the NAT Gateway. This allows tasks in the private subnet to securely initiate outbound HTTPS connections to the payment gateway.
Private subnets do not have direct internet access; routing traffic through a NAT Gateway in a public subnet is required.
3
Establish secure private access to AWS Secrets Manager.
An Interface VPC Endpoint (AWS PrivateLink) is provisioned inside the private subnets for Secrets Manager. The application resolves the Secrets Manager DNS to private IP addresses.
Allows the application to fetch sensitive secrets without sending API requests over the public internet, reducing exposure.

Key Concept

VPC security controls require coordinating stateful security groups for internal resources, stateless routing via NAT Gateways for internet access, and VPC Endpoints for private AWS service communication.
Estimated Time:2m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic