Examkin

Question

Difficulty: Very hardVPC Endpoints and PrivateLink Integration

A company hosts a secure microservice behind a Network Load Balancer (NLB) in a Service Provider VPC. A SysOps Administrator configures an AWS PrivateLink VPC Endpoint Service for this NLB. In a Service Consumer VPC, the administrator creates an Interface VPC Endpoint targeting the Endpoint Service and enables Private DNS. The Consumer VPC is connected to an on-premises network via an AWS Direct Connect connection terminated at a Transit Gateway. On-premises servers must be able to resolve the service's private DNS hostname and securely access the microservice. Which two configuration steps must the SysOps Administrator perform to satisfy these requirements? (Select TWO.)

  1. Configure a Route 53 Resolver Inbound Endpoint in the Consumer VPC, and configure the on-premises DNS resolver to forward queries for the service's private DNS hostname to the IP addresses of the Inbound Endpoint.Answer
  2. Modify the security group associated with the Interface VPC Endpoint's network interfaces to allow inbound traffic on the service's port from the CIDR range of the on-premises servers.Answer
  3. C
    Add a route to the route tables of the subnets in the Consumer VPC, specifying the on-premises CIDR range as the destination and the Interface VPC Endpoint ID (vpce-xxxxxxxx) as the target.
  4. D
    Configure a Route 53 Resolver Outbound Endpoint in the Consumer VPC, and create an outbound resolver rule that forwards queries for the service's private DNS hostname to the IP addresses of the on-premises DNS servers.
  5. E
    Enable Private DNS on the Route 53 Resolver Inbound Endpoint and associate the private hosted zone with the Transit Gateway route table to automatically propagate the endpoint's DNS records to the on-premises network.

Answer

Configure a Route 53 Resolver Inbound Endpoint in the Consumer VPC to receive forwarded DNS queries from the on-premises DNS resolver, and modify the Interface VPC Endpoint's security group to allow inbound traffic from the on-premises CIDR range.
For an on-premises network connected via Direct Connect to access an Interface VPC Endpoint with Private DNS, two key setups are required. First, a Route 53 Resolver Inbound Endpoint must be created in the Consumer VPC. This provides IP addresses that are reachable from the on-premises network. The on-premises DNS server is then configured to forward requests for the Private DNS domain to these IP addresses. Second, the security group assigned to the network interfaces of the Interface VPC Endpoint must allow inbound traffic from the client CIDR block on the port designated for the service.

Step-by-Step Solution

1
Analyze client DNS requirements
Identify that the on-premises DNS server must forward queries for the Private DNS hostname to an IP address reachable over Direct Connect.
On-premises clients cannot query the VPC's internal DNS resolver at the default link-local IP directly.
2
Deploy Route 53 Resolver Inbound Endpoint
Provision the Inbound Endpoint in the Consumer VPC, allocating private IP addresses in multiple subnets for high availability.
This endpoint exposes DNS listener interfaces that are reachable from the on-premises network over Direct Connect.
3
Configure on-premises DNS forwarding rules
Add a conditional forwarding rule on the on-premises DNS server targeting the domain name of the endpoint service and pointing to the Inbound Endpoint IPs.
Ensures requests for the endpoint service resolve to the endpoint's private IP addresses.
4
Configure Interface Endpoint Security Group rules
Verify and modify the security group rules on the Interface VPC Endpoint's Elastic Network Interfaces (ENIs).
Traffic from on-premises clients must be permitted inbound on the service's port (e.g., port 443443 for HTTPS) by the security group attached to the ENIs.

Key Concept

Integration of Interface VPC Endpoints with hybrid networks requiring private DNS resolution and security group configuration.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic