Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

A multinational logistics provider, CargoFlow, is modernizing its legacy package sorting and dispatch application. The current application runs on-premises on virtualized Linux servers and consists of an API ingestion service and a backend processing engine. The company plans to migrate this workload to AWS and deploy it as containers. The modernization must meet strict compliance and security guidelines: it must require zero management of underlying virtual machine infrastructure, ensure container tasks are strictly isolated at the hypervisor level, and enforce that all internal communication between the ingestion service (deployed in VPC A) and the processing engine (deployed in VPC B) remains entirely within the AWS private network. The two VPCs are located in different AWS accounts under the same AWS Organization. A Solutions Architect needs to design a solution that achieves these goals with the minimum operational overhead.

Which TWO actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Deploy the ingestion service and processing engine tasks on Amazon ECS using the AWS Fargate launch type.Answer
  2. Configure an Interface VPC Endpoint (AWS PrivateLink) in VPC A pointing to a Network Load Balancer in VPC B that routes traffic to the processing engine tasks, and associate the Route 53 Private Hosted Zone containing the service endpoint record with VPC A.Answer
  3. C
    Deploy the processing engine tasks on Amazon ECS using the AWS Fargate launch type with the task network mode set to bridge mode to enable port mapping.
  4. D
    Create a Route 53 Private Hosted Zone in VPC B for the processing engine, and configure the ingestion tasks in VPC A to use the default Route 53 Resolver endpoint IP of VPC B without associating VPC A with the private hosted zone.
  5. E
    Configure transit routing between VPC A and VPC B by establishing an AWS Direct Connect Gateway connection between the two VPCs to enable secure cross-account container communication.

Answer

Deploy the ingestion service and processing engine tasks on Amazon ECS using the AWS Fargate launch type, and configure an Interface VPC Endpoint in VPC A pointing to a Network Load Balancer in VPC B while associating the Private Hosted Zone with VPC A.
Deploying the ingestion service and processing engine tasks on Amazon ECS with AWS Fargate satisfies the requirement for zero virtual machine management while maintaining hypervisor-level isolation. To connect the frontend in VPC A securely to the backend in VPC B across accounts without internet traversal, AWS PrivateLink (an Interface VPC Endpoint) is the most operationally efficient method. To enable proper hostname resolution from VPC A, the Route 53 Private Hosted Zone containing the endpoint record must be explicitly associated with VPC A.

Step-by-Step Solution

1
Determine compute type based on VM management and isolation requirements.
Select Amazon ECS using AWS Fargate launch type.
AWS Fargate removes EC2 server management (minimum operational overhead) and executes each task in a dedicated kernel/hypervisor environment, satisfying the security isolation requirement.
2
Design private cross-account communication between VPC A and VPC B.
Implement an AWS PrivateLink endpoint service with a Network Load Balancer in VPC B and an Interface VPC Endpoint in VPC A.
AWS PrivateLink enables secure, unidirectional, private connections between VPCs in different accounts without exposing traffic to the internet or managing complex VPC peering relationships.
3
Establish DNS resolution across accounts for the private endpoint.
Associate the Route 53 Private Hosted Zone from the processing engine account with VPC A.
VPC A must be associated with the Private Hosted Zone to resolve the service hostname. This is a mandatory requirement for private cross-account endpoint resolution.

Key Concept

Modernizing legacy workloads to AWS serverless container platforms (ECS Fargate) with secure, private, cross-account networking via AWS PrivateLink and Route 53 Private Hosted Zone associations.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic