Examkin

Question

Difficulty: MediumVPC Network Security

A company hosts a reporting application on Amazon EC2 instances within private subnets. The application is required to query Amazon DynamoDB to fetch user profiles and must also securely call an external SaaS provider's HTTPS endpoint to retrieve currency exchange rates. Company security policies dictate that all traffic to DynamoDB must remain within the AWS network and must not traverse the public internet, while keeping data transfer costs minimized. Additionally, the EC2 instances must be able to securely connect to the external SaaS provider's endpoint.

Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon DynamoDB, and add a route directing DynamoDB traffic to the endpoint in the private subnet route tables.Answer
  2. Deploy a NAT Gateway in a public subnet, and configure a route in the private subnet route tables directing internet-bound traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway.Answer
  3. C
    Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon DynamoDB, and configure the security groups to route all database traffic through it.
  4. D
    Configure a route in the private subnet route tables directing outbound traffic (0.0.0.0/00.0.0.0/0) directly to the Internet Gateway.
  5. E
    Modify the security groups associated with the EC2 instances to allow outbound HTTPS traffic to the SaaS endpoint, and add inbound rules to allow return traffic on ephemeral ports.

Answer

To secure and cost-effectively route the traffic, create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables. In addition, deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables directing all internet-bound traffic to the NAT Gateway.
Creating a Gateway VPC Endpoint for Amazon DynamoDB ensures that database traffic remains within the AWS network without traversing the public internet. Because Gateway VPC Endpoints are free of charge, they satisfy the requirement to minimize data transfer costs. Additionally, deploying a NAT Gateway in a public subnet allows EC2 instances in private subnets to securely initiate outbound HTTPS requests to the external SaaS provider's endpoint.

Step-by-Step Solution

1
Address private DynamoDB access and cost goals.
Identify Gateway VPC Endpoints as the optimal solution for DynamoDB because they route traffic entirely within the AWS network and do not incur data processing or hourly fees.
This satisfies the requirement to prevent traffic from traversing the public internet while keeping data transfer costs minimized.
2
Address external SaaS provider connectivity.
Determine that private EC2 instances require a NAT translation device in a public subnet to reach the public internet.
Private subnets cannot route directly to an Internet Gateway, so a NAT Gateway must be provisioned in a public subnet to handle outbound egress traffic.
3
Evaluate security group and routing rules.
Confirm that security groups are stateful and require no inbound configurations for return traffic, and ensure that route tables are updated with appropriate routes for the NAT Gateway and the DynamoDB endpoint.
To ensure correct traffic routing and maintain a secure infrastructure configuration.

Key Concept

VPC Network Security and Egress Routing
Rate this question

Topics

VPC Network Security

More questions from this topic