Examkin

Question

Difficulty: MediumVPC Network Security

An e-commerce company runs an order processing application on Amazon EC2 instances in private subnets. The instances must download software updates from an external repository on the internet and securely access an Amazon DynamoDB table in the same AWS Region. The company's security policy requires that DynamoDB traffic must not traverse the public internet, and the EC2 instances must not be directly reachable from the public internet. Which TWO configurations should a solutions architect implement to meet these requirements securely and cost-effectively? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route table of the private subnets.Answer
  2. Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnets to route internet-bound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway.Answer
  3. C
    Create an Interface VPC Endpoint for Amazon DynamoDB and configure it to handle all DynamoDB traffic from the private subnets.
  4. D
    Configure the Network ACL for the private subnets to allow inbound traffic only on TCP ports 8080 and 443443 to receive response packets from the update repository.
  5. E
    Deploy a NAT Instance inside the private subnets to route outbound software update traffic directly to the internet.

Answer

To secure DynamoDB traffic cost-effectively without public internet routing, associate a Gateway VPC Endpoint for DynamoDB with the private subnets' route table. To enable secure outbound internet access for updates, deploy a NAT Gateway in a public subnet and update the private subnets' route table to direct all 0.0.0.0/00.0.0.0/0 traffic through the NAT Gateway.
The correct answer combines a Gateway VPC Endpoint for Amazon DynamoDB and a NAT Gateway in a public subnet. The Gateway VPC Endpoint routes DynamoDB traffic privately over the AWS backbone network without traversing the public internet, doing so without any hourly or data processing charges. The NAT Gateway provides secure, one-way outbound connectivity to the internet for downloading updates, ensuring the instances remain unreachable from inbound internet traffic.

Step-by-Step Solution

1
Analyze the access requirement for DynamoDB and evaluate cost-optimal network isolation paths.
Identify that Gateway VPC Endpoints are free and direct DynamoDB traffic privately, fulfilling the security and cost-efficiency criteria.
VPC endpoints keep traffic within the AWS network, and Gateway endpoints for DynamoDB do not incur charges.
2
Analyze the outbound internet requirements for software updates on private EC2 instances.
Determine that a NAT Gateway deployed in a public subnet allows outbound-initiated traffic and blocks unsolicited inbound traffic, which satisfies the security policy.
EC2 instances in private subnets cannot have public IP addresses or route directly to an Internet Gateway.
3
Evaluate the incorrect options regarding stateless Network ACL behavior, incorrect NAT placement, and non-optimal endpoint selection.
Eliminate the Interface VPC Endpoint option due to higher cost, the stateless Network ACL rule option because it blocks ephemeral return traffic, and the private NAT Instance option because NAT devices must reside in public subnets.
This ensures the final architecture is correct, highly available, secure, and cost-effective.

Key Concept

VPC Network Security and Egress Routing Control
Rate this question

Topics

VPC Network Security

More questions from this topic