Examkin

Question

Difficulty: MediumVPC Network Security

An application deployed on Amazon EC2 instances in a private VPC subnet must upload large datasets to Amazon S3. The application must also connect to an external payment gateway API over the internet to process transactions. A solutions architect needs to design a secure and cost-effective network architecture that satisfies these requirements.

Which TWO configurations should the solutions architect implement? (Select TWO.)

  1. Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.Answer
  2. Deploy a NAT gateway in a public subnet, and configure the private subnet's route table to route outbound traffic destined for the internet (0.0.0.0/00.0.0.0/0) to the NAT gateway.Answer
  3. C
    Route all outbound traffic from the private subnet, including both Amazon S3 data transfers and the external API calls, through a public NAT gateway.
  4. D
    Configure the Network ACL of the private subnet to allow outbound TCP port 443443 traffic, and rely on the stateful tracking of Network ACLs to permit the inbound response traffic.
  5. E
    Associate an AWS WAF web ACL directly with the private subnet to inspect and filter all outbound HTTP and HTTPS requests.

Answer

Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet, and deploy a NAT gateway in a public subnet, configuring the private subnet's route table to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the NAT gateway.
Establishing a gateway VPC endpoint for Amazon S3 provides direct, private connectivity to S3 without traversing the public internet or incurring NAT Gateway data processing charges, making it highly secure and cost-effective. For the external payment gateway API, deploying a NAT gateway in a public subnet allows the private instances to safely route outbound internet traffic without exposing them to inbound connections.

Step-by-Step Solution

1
Analyze the destinations required by the application.
The application needs access to Amazon S3 (an AWS service) and an external payment gateway (a public internet API).
Different network path options exist for AWS services versus public internet destinations.
2
Evaluate the most cost-effective and secure way to access Amazon S3.
Create a Gateway VPC Endpoint for Amazon S3, which routes traffic directly and privately to S3 without data processing costs.
A Gateway endpoint is free of charge and keeps traffic within the AWS network.
3
Evaluate the secure way to access the external payment gateway API.
Deploy a NAT Gateway in a public subnet and route outbound internet traffic (0.0.0.0/00.0.0.0/0) from the private subnet to it.
NAT Gateways allow private instances to initiate outbound connections to the internet while blocking inbound traffic from the internet.

Key Concept

Combining S3 Gateway Endpoints for internal AWS traffic and NAT Gateways for external internet egress to optimize VPC security and data transfer costs.
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic