Examkin

Question

Difficulty: MediumVPC Network Security

An enterprise is migrating a legacy reporting system to AWS. The backend processing servers run on Amazon EC2 instances in a private subnet. These instances must securely fetch configuration files from a private Amazon S3 bucket and connect to a third-party payment gateway API on the public internet. The solutions architect needs to design the network security controls to satisfy these requirements with minimum exposure and without incurring NAT Gateway data transfer costs for Amazon S3 traffic. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route table of the private subnet.Answer
  2. Deploy a NAT Gateway in a public subnet, update the private subnet's route table to route 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway, and use a stateful security group on the EC2 instances to restrict outbound traffic to the payment gateway.Answer
  3. C
    Configure the private subnet's route table to route all outbound traffic through a NAT Gateway to access both Amazon S3 and the payment gateway.
  4. D
    Configure a stateless Network ACL on the private subnet that permits outbound HTTPS traffic to the payment gateway, without adding any inbound rules for ephemeral ports because Network ACLs automatically track connection states.
  5. E
    Deploy a regional AWS WAF Web ACL and associate it directly with the private subnet to inspect and filter all outbound database and HTTPS traffic.

Answer

The correct combination of actions is to create a Gateway VPC Endpoint for Amazon S3 and associate it with the private subnet's route table, and to deploy a NAT Gateway in a public subnet, update the private subnet's route table to route outbound traffic to the NAT Gateway, and restrict outbound traffic using a stateful security group on the EC2 instances.
The correct solution combines a Gateway VPC Endpoint for Amazon S3 and a NAT Gateway with a stateful security group. A Gateway VPC Endpoint routes S3 traffic privately within AWS without using a NAT Gateway, avoiding data processing costs. A NAT Gateway is deployed in a public subnet to allow private subnet EC2 instances to reach the external payment gateway, and a stateful security group on the instances restricts outbound traffic to the target API. Because security groups are stateful, return traffic is automatically permitted.

Step-by-Step Solution

1
Identify a cost-effective method to privately connect to Amazon S3.
Determine that a Gateway VPC Endpoint for Amazon S3 is the optimal path since it does not incur NAT Gateway data processing charges.
This establishes private routing within the AWS network to S3, bypassing the internet.
2
Establish secure outbound internet egress for private EC2 instances.
Deploy a NAT Gateway in a public subnet and add a default route pointing to it in the private subnet's route table.
The EC2 instances must connect to a public payment gateway API, which requires NAT translation.
3
Apply firewall controls to restrict egress traffic to authorized endpoints.
Utilize stateful EC2 security groups to permit HTTPS outbound requests specifically to the payment gateway.
Security groups are stateful and operate at the instance level, securing the traffic without blocking the return packets.

Key Concept

VPC Network Security controls, specifically combining stateful security groups, stateless network ACLs, NAT Gateways for internet egress, and Gateway VPC Endpoints for secure, cost-effective S3 access.
Rate this question

Topics

VPC Network Security

More questions from this topic