Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring private connectivity between a consumer VPC and a proprietary billing application hosted in a provider VPC using AWS PrivateLink. The provider VPC has configured a VPC Endpoint Service backed by an internal Network Load Balancer. The administrator has created an Interface VPC Endpoint in a private subnet of the consumer VPC, but EC2 instances in that subnet cannot reach the billing application.

Which of the following actions should the administrator take to successfully establish connectivity? (Select TWO).

  1. Accept the endpoint connection request in the Endpoint Service console of the provider account.Answer
  2. Configure the security group associated with the Interface VPC Endpoint to allow inbound traffic on the billing application's port from the EC2 instances.Answer
  3. C
    Add a route in the consumer subnet's route table that targets the Interface VPC Endpoint ID for the destination IP range of the provider VPC.
  4. D
    Deploy a NAT Gateway in the consumer VPC and add a route in the private subnet's route table to direct the application traffic to the NAT Gateway.
  5. E
    Attach an Internet Gateway to the consumer VPC and add a route pointing to the Internet Gateway in the private subnet route table.

Answer

To establish connectivity, the administrator must accept the connection request in the provider's VPC Endpoint Service configuration and configure the security group associated with the Interface VPC Endpoint in the consumer VPC to allow inbound traffic on the billing application's port from the EC2 instances.
AWS PrivateLink Interface Endpoints create Elastic Network Interfaces (ENIs) with private IP addresses in the consumer subnets. Traffic sent to the service is resolved via DNS to these ENIs. Therefore, the security group attached to the Interface Endpoint must permit inbound traffic from the client instances on the destination port. Additionally, PrivateLink connection requests must be accepted by the provider account to authorize the endpoint connection.

Step-by-Step Solution

1
Accept the consumer's connection request in the provider VPC Endpoint Service settings.
The endpoint connection transitions from a pending state to an active state, allowing traffic flow between VPCs.
By default, AWS PrivateLink requires explicit approval from the service provider to authorize consumer access.
2
Verify and update the security group attached to the Interface VPC Endpoint in the consumer VPC.
The endpoint's Elastic Network Interfaces (ENIs) permit incoming traffic from the EC2 instances.
Interface VPC Endpoints behave like resources within the subnet; traffic must be allowed inbound on the endpoint's security group from the clients' IPs/security groups.

Key Concept

Establishing private connectivity using AWS PrivateLink and troubleshooting Interface VPC Endpoints, including connection acceptance and security group configuration.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic