Examkin

Question

Difficulty: HardVPC Endpoints and PrivateLink Integration

A company has a VPC with private subnets containing Amazon EC2 instances that must securely write data to an Amazon Kinesis data stream. A SysOps Administrator deploys an Interface VPC Endpoint for Kinesis (com.amazonaws.us-east-1.kinesis-streams) within the private subnets. In addition, on-premises servers connected to the VPC via an AWS Direct Connect connection must also write data to the same Kinesis data stream privately. Which combination of actions must the SysOps Administrator take to ensure private connectivity for both the EC2 instances and the on-premises servers? (Select TWO.)

  1. Configure the security group associated with the Kinesis Interface VPC Endpoint to allow inbound HTTPS traffic (port 443) from both the VPC subnet CIDR block and the on-premises network CIDR block.Answer
  2. Set up a Route 53 Resolver inbound endpoint in the VPC, and configure the on-premises DNS servers to forward queries for the Kinesis service domain (kinesis.us-east-1.amazonaws.com) to the inbound endpoint's IP addresses.Answer
  3. C
    Add a route to the private subnet route tables and the virtual private gateway route table pointing to the Interface VPC Endpoint ID (vpce-xxxxxxxx) for the Kinesis prefix list.
  4. D
    Enable private DNS hostnames on the Kinesis Interface VPC Endpoint and configure the on-premises servers to use the AWS-provided DNS IP address (169.254.169.253) as their primary DNS server.

Answer

Configure the security group associated with the Kinesis Interface VPC Endpoint to allow inbound HTTPS traffic from both the VPC subnet CIDR block and the on-premises network CIDR block, and set up a Route 53 Resolver inbound endpoint in the VPC to forward queries for the Kinesis service domain from the on-premises DNS servers.
To set up private access to Kinesis Data Streams for both VPC-based and on-premises resources: First, the security group of the Interface VPC Endpoint must allow inbound port 443 traffic from both sources because traffic to PrivateLink endpoints is controlled via standard security groups attached to their ENIs. Second, because on-premises servers cannot directly query the link-local Route 53 Resolver IP address (169.254.169.253), a Route 53 Resolver inbound endpoint must be configured in the VPC to accept forwarded queries from the on-premises DNS servers and resolve the Kinesis private DNS names to the endpoint's private IP addresses.

Step-by-Step Solution

1
Ensure the Interface VPC Endpoint's security group allows traffic.
The security group associated with the Interface VPC Endpoint is updated to allow inbound HTTPS (port 443) traffic from the VPC CIDR block and the on-premises CIDR block.
Interface VPC Endpoints use Elastic Network Interfaces (ENIs) with security groups that control inbound traffic. Both VPC resources and on-premises resources need permission to connect.
2
Establish name resolution for the on-premises servers.
A Route 53 Resolver inbound endpoint is deployed in the VPC, and the on-premises DNS server is configured with conditional forwarding rules for Kinesis pointing to the inbound endpoint's IP addresses.
On-premises servers cannot resolve VPC private DNS names directly or query the link-local Route 53 Resolver IP address. The inbound endpoint acts as a DNS proxy over Direct Connect.

Key Concept

Configuring Interface VPC Endpoints (AWS PrivateLink) for hybrid on-premises access using security groups and Route 53 Resolver inbound endpoints.
Estimated Time:2m 0s
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic