Examkin

Question

Difficulty: MediumVPC Connectivity and Routing Troubleshooting

A SysOps Administrator is troubleshooting connectivity issues for an Amazon EC2 instance deployed in Subnet-A of a VPC. The instance is assigned a public IPv4 address but is unable to access the internet to download package updates. Additionally, a Gateway VPC endpoint for Amazon S3 has been provisioned in the VPC, but the instance is unable to access Amazon S3 buckets privately. Which combination of actions will resolve these issues? (Select TWO.)

  1. Add a route in the route table associated with Subnet-A that maps 0.0.0.0/00.0.0.0/0 to the Internet Gateway (IGW) attached to the VPC.Answer
  2. Update the route table associated with Subnet-A to include a route targeting the S3 Gateway VPC endpoint for the S3 prefix list.Answer
  3. C
    Configure a NAT Gateway in Subnet-A and route all S3-bound traffic through the NAT Gateway to access the S3 API endpoint.
  4. D
    Modify the subnet's Network ACL to allow outbound traffic to S3 on port 443, while blocking inbound traffic from ephemeral ports 10241024 to 6553565535.
  5. E
    Add a route targeting the virtual private gateway (VGW) for the S3 prefix list in the route table associated with Subnet-A.

Answer

Add a route in the route table associated with Subnet-A that maps 0.0.0.0/00.0.0.0/0 to the Internet Gateway (IGW) attached to the VPC, and update the route table associated with Subnet-A to include a route targeting the S3 Gateway VPC endpoint for the S3 prefix list.
To restore internet access for the EC2 instance, the subnet's route table must include a route directing 0.0.0.0/00.0.0.0/0 to the Internet Gateway (IGW). To allow private access to S3, the route table must also include a route for the S3 prefix list pointing to the S3 Gateway VPC endpoint. These two steps configure the correct routing pathways for both destinations.

Step-by-Step Solution

1
Analyze the internet connectivity failure.
Since the EC2 instance has a public IP but cannot reach the internet, the subnet's route table is missing a route to the Internet Gateway.
An instance with a public IP requires a route to an Internet Gateway to send and receive traffic from the internet.
2
Analyze the S3 connectivity failure.
The Gateway VPC Endpoint was provisioned, but the instance cannot access S3 buckets privately, indicating the route table for Subnet-A has not been updated with the endpoint route.
Gateway VPC endpoints require a prefix list route in the associated subnet route tables to direct traffic directly to the endpoint.
3
Select the two correct configuration steps.
Adding the 0.0.0.0/00.0.0.0/0 route to the Internet Gateway and adding the S3 prefix list route pointing to the Gateway VPC endpoint resolves both issues.
These steps address the routing gaps for both public internet and private S3 access.

Key Concept

Troubleshooting routing in AWS VPCs for both internet access (using an Internet Gateway) and AWS service access (using a Gateway VPC Endpoint).
Rate this question

Topics

VPC Connectivity and Routing Troubleshooting

More questions from this topic