Examkin

Question

Difficulty: MediumVPC Network Security

A logistics company is deploying a fleet of Amazon EC2 instances in private subnets within a VPC. These instances must upload high volumes of archived tracking logs directly to Amazon S3, and communicate with an external shipping carrier's API over HTTPS to update package statuses. The solution must ensure secure connectivity, prevent direct inbound connections from the internet to the EC2 instances, and minimize data transfer costs. Which combination of configurations should a solutions architect implement to meet these requirements? (Select TWO.)

  1. Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets.Answer
  2. Deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.Answer
  3. C
    Configure a network ACL on the private subnets with a stateful rule that permits inbound traffic on ephemeral ports and outbound HTTPS traffic to the carrier's API.
  4. D
    Route all S3-bound traffic from the private subnets through a NAT gateway deployed in a public subnet to avoid establishing VPC endpoints.
  5. E
    Modify the security group of the EC2 instances in the private subnets to allow inbound traffic on HTTPS port 443 from the external shipping carrier's API endpoints.

Answer

Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets, and deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for the internet to the NAT gateway.
The solution requires secure, cost-effective egress. Deploying a Gateway VPC endpoint for Amazon S3 establishes a secure, private connection to S3 that avoids the internet and NAT Gateway charges. A NAT gateway in a public subnet enables private EC2 instances to securely establish outbound-only communication with the external shipping carrier's API over the internet.

Step-by-Step Solution

1
Analyze the requirements for accessing Amazon S3 and the external shipping API from the private EC2 instances.
The S3 connection involves high-volume archived tracking logs. The external carrier API connection involves outbound-initiated HTTPS requests to the internet.
This helps identify the most cost-effective and secure routing mechanism for each target.
2
Select the optimal connectivity method for S3 to avoid high data transfer charges.
A Gateway VPC endpoint is chosen because it routes S3 traffic privately within AWS and is free of charge.
Routing S3 traffic through a NAT gateway incurs per-GB data processing charges, which is not cost-effective.
3
Select the optimal connectivity method for the external carrier's API on the internet.
A NAT gateway deployed in a public subnet is chosen, with private route tables updated to route 0.0.0.0/0 traffic to the NAT gateway.
NAT gateways allow instances in private subnets to initiate outbound-only communication to the internet while keeping them protected from inbound internet traffic.

Key Concept

VPC Network Security and Cost Optimization
Rate this question

Topics

VPC Network Security

More questions from this topic