An organization has deployed a set of backend application servers inside a private subnet … — AWS Certified SysOps Administrator - Associate

An organization has deployed a set of backend application servers inside a private subnet ( $10.0.2.0/24$ ) of a VPC. The application servers must access the internet to download critical package updates and must also query files from an Amazon S3 bucket. A NAT Gateway is deployed in the public subnet ( $10.0.1.0/24$ ) to facilitate egress internet access, and a Gateway VPC endpoint is configured for Amazon S3. However, the application servers are currently unable to download packages from the internet or read objects from Amazon S3.

Which configuration checks should a SysOps administrator perform to resolve these connectivity issues? (Select TWO.)

Verify that the route table associated with the private subnet contains a route for the Amazon S3 service prefix list ( $pl-xxxxxx$ ) targeting the Gateway VPC endpoint ( $vpce-xxxxxx$ ).Answer
Verify that the route table associated with the public subnet contains a default route ( $0.0.0.0/0$ ) targeting the Internet Gateway ( $igw-xxxxxx$ ).Answer
C
Verify that the private subnet's Network Access Control List (NACL) outbound rules allow ports 80 and 443, while explicitly blocking outbound ephemeral ports ( $1024$ - $65535$ ).
D
Verify that the private subnet's route table contains a default route ( $0.0.0.0/0$ ) targeting the S3 Gateway VPC endpoint ( $vpce-xxxxxx$ ) for all internet-bound traffic.
E
Verify that the public subnet's route table contains a default route ( $0.0.0.0/0$ ) targeting the NAT Gateway ( $nat-xxxxxx$ ) instead of the Internet Gateway.

Answer

The correct configurations are to verify that the route table associated with the private subnet contains a route for the Amazon S3 service prefix list targeting the Gateway VPC endpoint, and verify that the route table associated with the public subnet contains a default route targeting the Internet Gateway.

Verifying that the private subnet's route table contains a route for the Amazon S3 service prefix list targeting the Gateway VPC endpoint ensures S3 traffic is routed correctly. Verifying that the public subnet's route table has a default route targeting the Internet Gateway ensures the NAT Gateway can forward traffic to the internet.

Step-by-Step Solution

Inspect the route table associated with the private subnet for S3 endpoint configuration.

Ensure there is a route with the destination of the S3 prefix list (

pl-xxxxxx

) and the target of the S3 Gateway VPC endpoint (

vpce-xxxxxx

Gateway VPC endpoints require route table entries matching the service prefix list to route traffic privately to S3.

Inspect the route table associated with the public subnet where the NAT Gateway resides.

Verify that a default route (

0.0.0.0/0

) targets the Internet Gateway (

igw-xxxxxx

The NAT Gateway cannot route traffic to the internet if the public subnet's route table lacks a path to the Internet Gateway.

Verify stateless security rules such as Network ACLs.

Confirm that outbound ephemeral ports (

1024

65535

) are allowed to enable connection completion.

Stateless rules require explicit allowance of outbound ephemeral ports for connection requests and return traffic.

Key Concept

VPC Connectivity and Routing Troubleshooting

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic