Examkin

Question

Difficulty: MediumAWS Elastic Disaster Recovery

A company is using AWS Elastic Disaster Recovery (AWS DRS) to replicate on-premises servers to AWS. The replication traffic is routed over an AWS Direct Connect connection to a staging area VPC that lacks internet access. The replication agents installed on the on-premises servers cannot establish communication with the AWS DRS service. Which configuration step should a SysOps Administrator take to resolve this issue while adhering to the requirement of not using the public internet?

  1. A
    Attach an Internet Gateway to the staging area VPC, and add a default route pointing to the Internet Gateway in the staging subnet's route table.
  2. B
    Create a gateway VPC endpoint for the AWS DRS service in the staging area VPC, and associate it with the route tables of the staging subnets.
  3. Create interface VPC endpoints (AWS PrivateLink) for the AWS DRS service in the staging area VPC, and ensure private DNS is enabled.Answer
  4. D
    Create interface VPC endpoints for the AWS DRS service in the staging area VPC, and configure a custom network ACL on the staging subnets that allows outbound HTTPS traffic but denies all inbound ephemeral ports.

Answer

Create interface VPC endpoints (AWS PrivateLink) for the AWS DRS service in the staging area VPC, and ensure private DNS is enabled.
Creating interface VPC endpoints (AWS PrivateLink) for the AWS DRS service in the staging area VPC provides private connectivity that does not traverse the public internet. Enabling private DNS ensures that the replication agents installed on-premises automatically resolve the standard service endpoints to the private IP addresses of the endpoints in the VPC.

Step-by-Step Solution

1
Identify the required network connectivity type for private communication with AWS services without internet access.
Interface VPC endpoints (AWS PrivateLink) are identified as the appropriate solution for AWS DRS.
Interface VPC endpoints allow private, secure connections between the VPC and supported AWS services without requiring an Internet Gateway or NAT Gateway.
2
Ensure DNS resolution is configured correctly for the interface endpoints.
Enable private DNS for the interface VPC endpoints.
Private DNS allows the on-premises replication agents to seamlessly resolve the public AWS DRS service DNS names to the private IP addresses of the endpoint network interfaces.
3
Verify that network ACLs and security groups allow the return traffic.
Allow inbound traffic on ephemeral ports in the subnet network ACLs.
Since network ACLs are stateless, return traffic from the endpoints requires allowing inbound ephemeral ports (1024-65535) to prevent connection drop.

Key Concept

Establishing private, secure connectivity to AWS Elastic Disaster Recovery (AWS DRS) using AWS PrivateLink interface VPC endpoints over Direct Connect.
Rate this question

Topics

AWS Elastic Disaster Recovery

More questions from this topic