Examkin

Question

Difficulty: Very hardVPC Network Security

A financial auditing firm is deploying a reporting engine on Amazon EC2 instances in a private subnet (172.16.8.0/22172.16.8.0/22) within a VPC. The reporting engine must access compliance data stored in Amazon S3 and write audit results to Amazon DynamoDB. Additionally, the reporting engine must perform outbound HTTPS requests (port 443443) to an external regulatory API at `api.compliance-registry.org` to validate audit certificates. Company security policy mandates that all AWS service traffic must not traverse the public internet or NAT gateways, and data transfer costs must be minimized. Outbound internet egress must be strictly restricted to the regulatory API domain, and all other outbound traffic must be denied.

Which combination of actions should a solutions architect recommend to meet these requirements? (Select TWO.)

  1. Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and associate them with the route table of the private subnet.Answer
  2. Route outbound internet traffic from the private subnet through an AWS Network Firewall deployed in a public subnet, and configure a stateful rule group with a domain list containing `api.compliance-registry.org`.Answer
  3. C
    Configure the outbound security group of the EC2 instances to allow HTTPS traffic (port 443443) targeting the destination `api.compliance-registry.org`.
  4. D
    Create Interface VPC endpoints for Amazon S3 and Amazon DynamoDB in the private subnet, and update the private subnet's route table to route traffic through these endpoints.
  5. E
    Configure the private subnet's outbound Network ACL to allow port 443443 traffic to the domain `api.compliance-registry.org` and deny all other outbound traffic.

Answer

Create Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and route outbound internet traffic through an AWS Network Firewall with a stateful rule group allowing the regulatory API domain.
Gateway VPC endpoints are the most cost-effective and direct routing mechanism for S3 and DynamoDB because they do not incur hourly charges or data processing costs, unlike Interface endpoints. To restrict internet egress traffic to a specific domain name (FQDN), an AWS Network Firewall deployed in a public subnet with a stateful rule group using domain list filtering is required, as standard Security Groups and Network ACLs do not support filtering by hostnames.

Step-by-Step Solution

1
Select the most cost-effective connection type to access AWS services privately.
Identify Gateway VPC endpoints as the optimal solution for Amazon S3 and Amazon DynamoDB traffic.
Gateway endpoints keep traffic within the AWS private network and are free, unlike Interface endpoints which charge hourly and data processing fees.
2
Evaluate subnet-level and instance-level security options for domain-specific filtering.
Recognize that Security Groups and Network ACLs cannot filter outbound traffic based on Fully Qualified Domain Names (FQDN).
Security groups and Network ACLs only support IP addresses and CIDR blocks, meaning they cannot resolve or restrict egress based on hostnames like `api.compliance-registry.org`.
3
Identify the service capable of domain list filtering.
Select AWS Network Firewall to filter outbound HTTP/HTTPS requests.
AWS Network Firewall provides stateful rule groups that allow domain name filtering to restrict outbound internet egress to specific allowed destinations.
4
Configure the private subnet routing table to direct traffic to the correct targets.
Associate S3 and DynamoDB routes with Gateway endpoints, and route default outbound traffic (0.0.0.0/00.0.0.0/0) to the AWS Network Firewall endpoint.
This setup separates internal AWS traffic from external compliance API traffic and enforces least-privilege egress controls.

Key Concept

VPC routing and endpoint configuration for private AWS service communication, combined with stateful domain-level egress filtering using AWS Network Firewall.
Rate this question

Topics

VPC Network Security

More questions from this topic