Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet to securely communicate with Amazon SNS without traversing the public internet. The administrator creates an Interface VPC Endpoint for Amazon SNS (com.amazonaws.us-east-1.sns) in the VPC. The VPC has both DNS resolution and DNS hostnames enabled. However, the EC2 instances still fail to connect to Amazon SNS, resulting in connection timeouts. Which configuration change will resolve this issue?

  1. Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on port 443 from the security group of the EC2 instances.Answer
  2. B
    Add a route to the private subnet's route table that targets the Interface VPC Endpoint using the Amazon SNS service prefix list.
  3. C
    Add a route to the private subnet's route table directing Amazon SNS traffic to a NAT Gateway in a public subnet.
  4. D
    Attach an Internet Gateway to the VPC and add a route in the private subnet's route table pointing 0.0.0.0/0 to the Internet Gateway.

Answer

Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on port 443 from the security group of the EC2 instances.
The correct option is to modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on port 443 from the security group of the EC2 instances. Interface VPC Endpoints place Elastic Network Interfaces (ENIs) inside the VPC subnets. These ENIs are associated with security groups. Because the EC2 instances communicate with the SNS endpoint over HTTPS (port 443), the security group on the endpoint ENIs must explicitly allow inbound traffic from the EC2 instances.

Step-by-Step Solution

1
Identify the type of VPC Endpoint being used.
The configuration uses an Interface VPC Endpoint (AWS PrivateLink) for Amazon SNS.
Interface endpoints create Elastic Network Interfaces (ENIs) in the subnet, which are secured using security groups, whereas Gateway endpoints use route tables.
2
Analyze why connection timeouts occur to Interface Endpoints.
Connection timeouts typically point to network-level blocking, which is controlled by Security Groups or Network ACLs (NACLs) rather than route tables.
Since DNS resolution and DNS hostnames are enabled, the application correctly resolves the SNS service DNS to the endpoint's private IP addresses, but the network request is blocked by the security group.
3
Apply the correct Security Group rule.
Allow inbound HTTPS (port 443) traffic on the endpoint's security group from the EC2 instances.
This allows the HTTPS API calls from the EC2 instances to reach the Interface VPC Endpoint successfully.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require appropriate security group configurations to allow inbound traffic on port 443 from consumer resources, and they do not rely on route table updates.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic