Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

Zephyr Payments is modernizing its on-premises payment processing application by migrating it to AWS. The architecture consists of a frontend web portal and a backend payment API. The Solutions Architect has decided to deploy the backend payment API as containerized tasks using Amazon ECS on AWS Fargate across multiple Availability Zones in a private VPC. The backend API needs to communicate securely and privately with a legacy reporting service deployed in a separate VPC within the same AWS Region. The network architecture must ensure that no traffic between these VPCs passes over the public internet, and the configuration must minimize operational overhead while adhering to Fargate's architectural boundaries. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure the ECS task definition for the backend payment API using the awsvpc network mode.Answer
  2. Create an AWS Transit Gateway and attach both the ECS VPC and the legacy reporting VPC to route traffic privately between them.Answer
  3. C
    Configure the ECS task definition for the backend payment API using the bridge network mode to leverage Docker's built-in virtual network mapping.
  4. D
    Create an AWS Direct Connect Gateway and associate it directly with both VPCs to route the VPC-to-VPC traffic transitively.
  5. E
    Create a Route 53 Private Hosted Zone (PHZ) for the legacy reporting service, but associate it only with the legacy reporting VPC to keep the namespace private.

Answer

The Solutions Architect should configure the ECS task definition for the backend payment API using the awsvpc network mode, and create an AWS Transit Gateway attaching both the ECS VPC and the legacy reporting VPC to route traffic privately between them.
The correct options are configuring the ECS task definition using the awsvpc network mode and routing the traffic using an AWS Transit Gateway. AWS Fargate tasks exclusively support the awsvpc network mode, which registers an Elastic Network Interface (ENI) directly for each task. Private VPC-to-VPC connectivity is securely and scalably managed by attaching both VPCs to an AWS Transit Gateway, which supports transitive routing without sending traffic over the public internet.

Step-by-Step Solution

1
Select the correct network mode for AWS Fargate tasks.
The ECS task definition is configured with the awsvpc network mode.
AWS Fargate does not support bridge, host, or none network modes. Tasks must use the awsvpc mode to get their own elastic network interface (ENI).
2
Establish private inter-VPC network connectivity.
An AWS Transit Gateway is deployed, and both VPCs are attached to it with appropriate route table entries.
Transit Gateway allows private, scalable, and low-latency routing between multiple VPCs without routing traffic over the public internet.

Key Concept

AWS Fargate task networking configurations and private multi-VPC routing options.
Estimated Time:2m 30s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic