Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

Quantex Analytics is modernizing its on-premises portfolio risk simulation engine by migrating to AWS. The current application runs on VMware virtual machines and suffers from scaling limitations during peak market hours. The modernized workload will be deployed as containerized tasks using Amazon ECS on Amazon EC2 instances across multiple Availability Zones to ensure high availability. The application consists of microservices that require low-latency communication and must be tuned with specific kernel parameters (such as net.core.somaxconn) at the container level. The container images must be securely pulled from a centralized Amazon ECR repository in a shared services AWS account. Security policies dictate that all image traffic must remain entirely within the private network without traversing the public internet, and the overall system design must maintain a Recovery Time Objective (RTO) of under 10 minutes and eliminate single points of network failure. Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure the Amazon ECS task definition to use the awsvpc network mode, and specify the required sysctls parameters in the container definitions.Answer
  2. In the production VPC, create Interface VPC endpoints for Amazon ECR (com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr) and a Gateway VPC endpoint for Amazon S3. Configure the repository policy of the Amazon ECR registry in the shared services account to allow pull permissions for the ECS task execution role in the production account.Answer
  3. C
    Configure the Amazon ECS task definition to use the host network mode, and specify the required sysctls parameters in the container definitions.
  4. D
    Configure the Amazon ECR repository in the shared services account to use the AWS-managed KMS key for ECR (aws/ecr) for encryption, and add the production account's ECS task execution role to the key policy of the AWS-managed key.
  5. E
    In the production VPC, deploy a single NAT Gateway in a public subnet, and configure the private subnet route tables to direct all outbound ECR traffic through the NAT Gateway using public Amazon ECR endpoints.

Answer

Configure the task definition to use the awsvpc network mode with the specified sysctls parameters, and create ECR interface VPC endpoints along with an S3 gateway endpoint in the production VPC while updating the shared ECR repository policy.
Configuring the ECS task definition to use the awsvpc network mode allows specifying sysctls settings at the container definition level, which satisfies the kernel tuning requirement. Additionally, creating the ECR api, ECR dkr, and S3 gateway endpoints in the production VPC establishes a secure, private network path that keeps image traffic off the public internet, while updating the shared ECR repository policy grants the necessary cross-account pull permissions.

Step-by-Step Solution

1
Select the correct ECS network mode to support custom kernel tuning (sysctls).
The awsvpc network mode is chosen because it supports task-level network isolation and container-level sysctls configuration, whereas the host network mode does not support sysctls.
ECS tasks running on EC2 require bridge or awsvpc network modes to customize kernel parameters through sysctls without modifying the underlying host directly.
2
Establish secure, private connectivity from the production VPC to Amazon ECR in the shared services account.
Interface VPC endpoints for ECR (api and dkr) and a Gateway VPC endpoint for S3 are created inside the production VPC.
This configuration allows ECR traffic to route over the private AWS backbone without traversing the public internet, satisfying the network privacy requirement.
3
Configure cross-account permissions for container image retrieval.
The ECR repository policy in the shared services account is updated to grant pull permissions to the IAM task execution role in the production account.
The task execution role requires permissions to perform batch get and get download URL operations against the shared repository to instantiate the container.

Key Concept

Configuring Amazon ECS task networking and private cross-account image pulling using VPC endpoints and repository policies.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic