Examkin

Question

Difficulty: EasyModernizing Workloads using Containers (ECS and EKS)

A financial services firm wants to migrate its containerized risk-simulation engine from an on-premises datacenter to AWS. The workload runs in a highly bursty manner and requires strict network isolation to comply with security regulations. The firm decides to deploy the workload using Amazon ECS on AWS Fargate. To ensure high availability, compliance, and proper functionality of the tasks in private subnets, which of the following networking and deployment configurations should the solutions architect implement? (Select TWO.)

  1. Configure the Amazon ECS task definitions to use the awsvpc network mode.Answer
  2. Create interface VPC endpoints (AWS PrivateLink) for Amazon ECS and Amazon ECR in the VPC to allow tasks to pull images and communicate with the control plane without traversing the public internet.Answer
  3. C
    Configure the Amazon ECS task definitions to use the host network mode to maximize network throughput and minimize latency.
  4. D
    Configure a single NAT Gateway in one public subnet to route all outbound internet traffic from the ECS tasks distributed across three Availability Zones.
  5. E
    Create a Route 53 Private Hosted Zone for service discovery in a centralized shared services account without associating it with the application VPC where the Fargate tasks run.

Answer

The correct configuration involves configuring the task definitions to use the awsvpc network mode and creating interface VPC endpoints (AWS PrivateLink) for Amazon ECS and Amazon ECR in the application VPC.
The correct design configurations are configuring the task definitions to use the awsvpc network mode and deploying interface VPC endpoints (AWS PrivateLink) for ECS and ECR in the VPC. Since AWS Fargate tasks require the awsvpc networking mode, configuring this mode is mandatory for container deployment on Fargate. Creating interface endpoints ensures that all container image retrieval and orchestration API traffic remain within the AWS network backbone, adhering to strict compliance and network isolation rules.

Step-by-Step Solution

1
Determine the required ECS networking mode for AWS Fargate tasks.
AWS Fargate only supports the awsvpc network mode, which provisions a dedicated network interface for each task.
This allows containers to communicate securely with standard AWS networking constructs.
2
Establish secure, private connectivity to AWS services from private subnets.
Interface VPC endpoints (AWS PrivateLink) are created for ECS and ECR within the application VPC.
This ensures container images can be pulled and control plane communications occur without routing traffic over the public internet, satisfying the strict isolation requirement.

Key Concept

AWS Fargate networking constraints and private endpoint architecture for secure container modernization
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic