Examkin

Question

Difficulty: MediumVPC Network Security

A company is deploying a microservices application on Amazon EC2 instances inside a private subnet of a VPC. The application must read and write data to an Amazon DynamoDB table and retrieve credentials from AWS Secrets Manager. Company security policy dictates that no traffic from the private subnet is allowed to traverse the public internet, and NAT gateways cannot be used.

Which combination of steps should a solutions architect take to configure network routing and access control to meet these requirements securely? (Select TWO.)

  1. Create a gateway VPC endpoint for Amazon DynamoDB, and associate the endpoint with the route table of the private subnet.Answer
  2. Create an interface VPC endpoint for AWS Secrets Manager, and associate a security group with the endpoint that allows inbound HTTPS traffic on port 443443 from the microservices' security group.Answer
  3. C
    Create an interface VPC endpoint for Amazon DynamoDB, and configure the private subnet's Network ACL to allow outbound traffic to the endpoint without configuring any inbound rules, relying on the Network ACL's stateful nature to permit the return traffic.
  4. D
    Create a gateway VPC endpoint for AWS Secrets Manager, and add a route pointing to the Secrets Manager endpoint in the private subnet's route table.
  5. E
    Deploy AWS Shield Standard on the AWS Secrets Manager endpoint to inspect and block Layer 77 SQL injection attempts from the microservices.

Answer

Create a gateway VPC endpoint for Amazon DynamoDB, and associate the endpoint with the route table of the private subnet; and create an interface VPC endpoint for AWS Secrets Manager, and associate a security group with the endpoint that allows inbound HTTPS traffic on port 443443 from the microservices' security group.
To connect to Amazon DynamoDB and AWS Secrets Manager privately, the solutions architect must use VPC endpoints. For DynamoDB, a gateway VPC endpoint is created and associated with the subnet's route table. For AWS Secrets Manager, an interface VPC endpoint is created, which provisions an ENI with a private IP. This interface endpoint is secured with a security group that permits inbound HTTPS traffic on port 443443 from the microservices.

Step-by-Step Solution

1
Identify the endpoint types supported by the destination services.
Amazon DynamoDB supports gateway VPC endpoints. AWS Secrets Manager supports interface VPC endpoints.
Gateway endpoints are route-based and free, whereas interface endpoints use elastic network interfaces (ENIs) and require security groups.
2
Configure routing for the gateway endpoint.
Associate the DynamoDB gateway endpoint with the private subnet's route table.
This automatically adds a route pointing DynamoDB-bound traffic to the endpoint without crossing the public internet.
3
Configure security for the interface endpoint.
Create an interface endpoint for Secrets Manager and attach a security group allowing inbound HTTPS (port 443443) traffic from the microservices' security group.
Since interface endpoints use ENIs with private IP addresses, they act like resources inside the VPC and must be secured using stateful security groups.

Key Concept

VPC endpoints allow private connection between a VPC and supported AWS services without requiring an internet gateway, NAT gateway, VPN, or Direct Connect connection. Gateway endpoints are used for S3 and DynamoDB by modifying route tables. Interface endpoints use AWS PrivateLink, requiring security groups to control inbound HTTPS traffic.
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic