Examkin

Question

Difficulty: MediumVPC Network Security

A company is designing a secure network architecture for a high-throughput processing application hosted on Amazon EC2 instances in a private subnet. The application must securely transfer large volumes of data to Amazon S3 and access secrets stored in AWS Secrets Manager. The network architecture must prevent any data from traversing the public internet, minimize data transfer charges, and enforce strict network boundaries. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnet.Answer
  2. Create an interface VPC endpoint for AWS Secrets Manager in the private subnet, and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the application security group.Answer
  3. C
    Deploy a NAT gateway in a public subnet, configure the private subnet's route table to point all outbound traffic to the NAT gateway, and access both services via their public endpoints.
  4. D
    Configure a stateless Network ACL on the private subnet to permit outbound HTTPS traffic to Secrets Manager public IP addresses, as security groups cannot filter traffic directed to interface endpoints.
  5. E
    Deploy AWS Shield Advanced at the subnet boundary to inspect traffic and protect the Secrets Manager endpoint from Layer 7 application exploits.

Answer

Create a gateway VPC endpoint for Amazon S3 associated with the private subnet's route tables, and create an interface VPC endpoint for AWS Secrets Manager with a security group allowing inbound HTTPS traffic from the application security group.
The correct architecture uses a Gateway VPC Endpoint for Amazon S3 and an Interface VPC Endpoint for AWS Secrets Manager. S3 Gateway Endpoints are free and route traffic via VPC route tables. Interface Endpoints use Elastic Network Interfaces (ENIs) inside the VPC and are secured using stateful security groups that limit inbound HTTPS traffic to the application's security group.

Step-by-Step Solution

1
Analyze connectivity and cost requirements for Amazon S3 traffic.
Determine that a Gateway VPC Endpoint is the most secure and cost-effective method to connect to Amazon S3, as it does not incur data processing fees and routes traffic privately using route table entries.
Routing high-volume data to S3 via a NAT gateway results in high data transfer costs.
2
Analyze connectivity and security requirements for AWS Secrets Manager.
Identify that AWS Secrets Manager requires an Interface VPC Endpoint (AWS PrivateLink) for private VPC access because Secrets Manager does not support Gateway VPC Endpoints.
Interface endpoints use Elastic Network Interfaces (ENIs) inside the subnet and allocate private IP addresses from the subnet range.
3
Configure security group rules for the interface endpoint to restrict access.
Create a security group for the Secrets Manager interface endpoint that allows inbound HTTPS (port 443) traffic only from the security group associated with the application EC2 instances.
Security groups are stateful, apply at the interface level, and enforce the principle of least privilege.

Key Concept

VPC endpoints (Gateway vs Interface) allow private connectivity to AWS services without internet traversal, utilizing route tables and security groups to manage security and optimize costs.
Rate this question

Topics

VPC Network Security

More questions from this topic