Examkin

Question

Difficulty: MediumVPC Security for Developers

A company is deploying an application on Amazon EC2 instances located in a private subnet of a custom VPC. The application must securely retrieve database credentials from AWS Secrets Manager and also connect to a public API endpoint of an external partner over the internet.

Which of the following network configurations must the developer implement to meet these requirements while minimizing data transfer over the public internet? (Select TWO.)

  1. Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet.Answer
  2. Deploy a NAT gateway in a public subnet and add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway.Answer
  3. C
    Create a gateway VPC endpoint for AWS Secrets Manager and associate it with the private subnet's route table.
  4. D
    Store the database credentials in Systems Manager Parameter Store and configure a gateway VPC endpoint to retrieve them, as Parameter Store supports automatic credential rotation.
  5. E
    Update the trust policy of the EC2 instance's IAM role to allow assume-role actions from the Secrets Manager service endpoint.

Answer

The correct configurations are to create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet, and deploy a NAT gateway in a public subnet with a route in the private subnet's route table pointing outbound internet-bound traffic (0.0.0.0/0) to the NAT gateway.
To satisfy both requirements under the constraint of minimizing public internet usage, the developer must: 1. Deploy an Interface VPC Endpoint (PrivateLink) for Secrets Manager so that credential requests remain entirely within the AWS network. 2. Use a NAT Gateway in a public subnet coupled with a route in the private route table to enable outbound internet access to the external payment API.

Step-by-Step Solution

1
Determine the required connectivity for AWS Secrets Manager.
Since the goal is to retrieve credentials securely while minimizing internet traffic, the application should connect to Secrets Manager privately. Secrets Manager supports Interface VPC Endpoints (AWS PrivateLink) for private network connectivity.
Using an interface endpoint prevents database credential retrieval traffic from traversing the public internet.
2
Determine the required connectivity for the external API.
The external API is a public internet endpoint. Instances in private subnets cannot access the public internet directly. A NAT gateway must be deployed in a public subnet, and a route to it (for 0.0.0.0/0) must be added to the private subnet's route table.
A NAT gateway allows private subnet resources to initiate outbound requests to public endpoints.

Key Concept

Configuring private subnets to securely access AWS services via VPC endpoints and external services via NAT Gateways.
Rate this question

Topics

VPC Security for Developers

More questions from this topic