Examkin

Question

Difficulty: MediumVPC Security for Developers

A backend system executes inside private subnets of a VPC to process financial transactions. This workload requires outbound connections to both an internal database within the VPC and a public third-party banking API. The database traffic is successful, but all connection attempts to the public API timeout. Which network configuration will enable the workload to connect to the external API?

  1. Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.Answer
  2. B
    Establish an AWS PrivateLink VPC endpoint for the third-party banking API, and configure the private subnet's route table to route external traffic to the endpoint.
  3. C
    Modify the IAM execution role's trust policy to trust the public banking API's domain, allowing secure cross-account API calls to bypass the VPC boundary.
  4. D
    Store the public banking API's domain IP addresses in Systems Manager Parameter Store, and enable automatic key rotation to dynamically update the subnet's network access control lists (NACLs).

Answer

Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.
Providing a NAT Gateway in a public subnet and configuring the private subnet's route table to target it for all external traffic (0.0.0.0/0) allows resources within the private subnet to securely initiate outbound connections to the internet, resolving the timeout issue to the public banking API.

Step-by-Step Solution

1
Identify the destination type for the failing connections.
The failing traffic is destined for a public third-party banking API, which resides on the public internet.
Traffic to public internet endpoints from a private subnet requires a NAT mechanism since the private subnet lacks public IP addresses and direct internet routes.
2
Determine the appropriate NAT deployment architecture.
A NAT Gateway must be placed in a public subnet (a subnet with a route to an Internet Gateway).
NAT Gateways translate private source IPs to a public IP and route the traffic to the Internet Gateway.
3
Configure the private subnet routing.
Add a route to the private subnet's route table with destination 0.0.0.0/0 pointing to the NAT Gateway.
This directs all non-VPC bound traffic (internet traffic) through the NAT Gateway for translation and outbound delivery.

Key Concept

Outbound internet connectivity from private VPC subnets using a NAT Gateway
Rate this question

Topics

VPC Security for Developers

More questions from this topic