Examkin

Question

Difficulty: MediumVPC Network Security

A media processing workload is hosted on Amazon EC2 instances in a private subnet. The application must regularly download large video files from an Amazon S3 bucket in the same Region, and it must also access a third-party software repository on the public internet to download package updates. The solutions architect must design a secure network routing architecture that minimizes data transfer costs and prevents direct internet exposure of the EC2 instances.

Which combination of configurations will meet these requirements? (Select TWO.)

  1. Create a Gateway VPC endpoint for Amazon S3, and associate it with the route table of the private subnet.Answer
  2. Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to route traffic destined for 0.0.0.0/00.0.0.0/0 to the NAT Gateway.Answer
  3. C
    Route all outbound traffic destined for Amazon S3 through the NAT Gateway to centralize external network pathways.
  4. D
    Configure a Network ACL on the private subnet to statefully permit outbound connections to the S3 service limits.
  5. E
    Deploy AWS WAF on the Network ACL of the private subnet to inspect and filter outbound Layer 7 requests.

Answer

Create a Gateway VPC endpoint for Amazon S3 associated with the private subnet's route table, and deploy a NAT Gateway in a public subnet with a route for 0.0.0.0/00.0.0.0/0 in the private subnet's route table.
To satisfy the requirements securely and cost-effectively, a Gateway VPC endpoint should be created for Amazon S3 and associated with the private subnet's route table. This configuration keeps S3 traffic on the private AWS network and eliminates NAT Gateway data processing costs. Additionally, to allow the private EC2 instances to download updates from the public internet without direct exposure, a NAT Gateway should be deployed in a public subnet, with the private subnet's route table configured to send 0.0.0.0/00.0.0.0/0 traffic to it.

Step-by-Step Solution

1
Analyze S3 traffic cost optimization and routing.
Determine that routing S3 traffic through a Gateway VPC Endpoint is free and routes traffic privately through the AWS internal network, avoiding NAT Gateway charges.
S3 Gateway Endpoints are the most cost-effective and secure method for private subnets to access S3.
2
Analyze external internet access for package updates.
Determine that outbound internet access requires a NAT Gateway placed in a public subnet with a route in the private subnet's route table targeting the NAT Gateway.
Private EC2 instances cannot access the internet directly; they require a NAT translation device in a public subnet.
3
Evaluate security and statefulness rules.
Confirm that Network ACLs are stateless and AWS WAF cannot be applied to subnets or NACLs.
This rules out distractors related to stateful Network ACLs and incorrect WAF deployments.

Key Concept

VPC Network Routing and Cost Optimization using VPC Endpoints and NAT Gateways
Rate this question

Topics

VPC Network Security

More questions from this topic