Examkin

Question

Difficulty: EasyVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring an Interface VPC Endpoint for Amazon Systems Manager (SSM) to allow Amazon EC2 instances in a private subnet to securely communicate with the SSM API. The network traffic must remain entirely within the AWS network and not traverse the public internet. Which TWO configurations are required to establish this connectivity? (Select TWO.)

  1. Enable Private DNS for the Interface VPC Endpoint.Answer
  2. Associate a security group with the Interface VPC Endpoint that allows inbound HTTPS (port 443) traffic from the EC2 instances' private subnet.Answer
  3. C
    Add a route to the private subnet's Route Table pointing to the VPC endpoint ID (vpce-xxxx) as the target.
  4. D
    Add a default route pointing to an Internet Gateway (0.0.0.0/0) in the private subnet's Route Table.

Answer

To configure an Interface VPC Endpoint, the SysOps Administrator must enable Private DNS on the endpoint and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the private subnet's EC2 instances.
For Interface VPC Endpoints, private connectivity is established via Elastic Network Interfaces (ENIs) and DNS. The correct actions are to enable Private DNS (which maps standard AWS service DNS hostnames to the private IP addresses of the endpoint) and to associate a security group with the endpoint that permits inbound HTTPS traffic from the resources in the private subnet.

Step-by-Step Solution

1
Configure DNS resolution for the endpoint.
Private DNS is enabled on the Interface VPC Endpoint.
This allows applications and instances to use the standard AWS service endpoint URLs to resolve to the private IP addresses of the endpoint's network interfaces.
2
Configure the security group for the endpoint.
A security group is associated with the endpoint that permits inbound HTTPS (port 443) traffic from the source EC2 instances.
Interface VPC Endpoints use Elastic Network Interfaces (ENIs) inside the VPC, which are secured by security groups. These security groups must permit inbound traffic from the clients.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require enabling Private DNS for seamless endpoint resolution and using security groups to control inbound network traffic to the endpoint network interfaces.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic