Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring a secure, private connection to Amazon SNS (com.amazonaws.us-east-1.sns) for Amazon EC2 instances residing in a private subnet within a VPC. The VPC has no Internet Gateway or NAT Gateway. The EC2 instances are associated with a security group named EC2-SG. The Interface VPC Endpoint is associated with a security group named Endpoint-SG. The SysOps Administrator notices that the EC2 instances are timing out when attempting to publish messages to the SNS topic at sns.us-east-1.amazonaws.com.

Which two actions should the SysOps Administrator take to resolve this issue? (Select TWO.)

  1. Enable Private DNS on the Amazon SNS Interface VPC Endpoint, and ensure that DNS resolution and DNS hostnames are enabled for the VPC.Answer
  2. Add an inbound rule to the Endpoint-SG security group that allows TCP port 443 traffic from the EC2-SG security group.Answer
  3. C
    Add a route to the private subnet's route table with a destination pointing to the Amazon SNS prefix list and the target pointing to the Interface VPC Endpoint.
  4. D
    Deploy a NAT Gateway in a public subnet, add a route for 0.0.0.0/0 to the NAT Gateway in the private route table, and delete the Interface VPC Endpoint.
  5. E
    Modify the private subnet's Network Access Control List (NACL) to allow inbound TCP port 443 traffic from the VPC endpoint's IP addresses, but do not add any rules to allow outbound ephemeral ports.

Answer

Enable Private DNS on the Amazon SNS Interface VPC Endpoint, and ensure that DNS resolution and DNS hostnames are enabled for the VPC. Additionally, add an inbound rule to the Endpoint-SG security group that allows TCP port 443 traffic from the EC2-SG security group.
The correct options are enabling Private DNS hostnames and configuring the Interface VPC Endpoint security group to allow inbound TCP port 443 traffic from the instances. Enabling Private DNS ensures that the standard service URL resolves to the private IP addresses of the endpoint's network interfaces. Allowing inbound HTTPS traffic on the endpoint's security group from the instances allows the connection to be established successfully.

Step-by-Step Solution

1
Configure DNS Settings
Ensure that the VPC has DNS resolution and DNS hostnames enabled. Then, enable Private DNS on the Interface VPC Endpoint.
This allows the public DNS hostname of the service (sns.us-east-1.amazonaws.com) to resolve directly to the private IP addresses of the endpoint network interfaces (ENIs) inside the VPC, avoiding public internet routing.
2
Configure Security Group Rules
Update the security group of the Interface VPC Endpoint (Endpoint-SG) to allow inbound TCP port 443 (HTTPS) traffic from the EC2 instances' security group (EC2-SG).
Interface VPC Endpoints receive inbound requests from client resources on port 443. Correctly permitting this traffic resolves the connection timeout issue.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require both DNS configuration (Private DNS) and proper Security Group rules to function, whereas Gateway VPC Endpoints require route table updates.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic