Examkin

Question

Difficulty: MediumVPC Connectivity and Routing Troubleshooting

A company hosts an application on Amazon EC2 instances in a private subnet of a VPC. The instances are configured with IPv6 CIDR blocks and must be able to initiate outbound connections to the internet to download security updates. However, any inbound connections from the internet to these instances must be completely blocked. A SysOps administrator discovers that the instances currently cannot reach any external IPv6 addresses. Which combination of actions must the SysOps administrator take to resolve this connectivity issue? (Select TWO.)

  1. Create an egress-only internet gateway for the VPC.Answer
  2. Add a route in the private subnet's route table with a destination of `::/0` pointing to the egress-only internet gateway.Answer
  3. C
    Create a NAT gateway in a public subnet of the VPC, and add a route in the private subnet's route table with a destination of `::/0` pointing to the NAT gateway.
  4. D
    Add a route in the private subnet's route table with a destination of `::/0` pointing to the VPC's existing internet gateway.
  5. E
    Configure the security group of the EC2 instances to block all inbound traffic and add a route in the private subnet's route table with a destination of `0.0.0.0/0` pointing to the egress-only internet gateway.

Answer

Create an egress-only internet gateway for the VPC, and add a route in the private subnet's route table with a destination of `::/0` pointing to the egress-only internet gateway.
To support outbound-only IPv6 traffic, AWS provides the Egress-Only Internet Gateway. Creating this gateway and pointing the private subnet's `::/0` route to it fulfills the requirement of allowing internet access for downloads while completely preventing inbound connections at the routing layer.

Step-by-Step Solution

1
Determine the protocol requirement and restrictions.
The instances require outbound-only IPv6 connectivity to the internet while preventing inbound-initiated connections.
This protocol and behavioral constraint rule out NAT gateways (which support IPv4) and standard internet gateways (which permit bidirectional traffic).
2
Provision the appropriate gateway component.
Create an egress-only internet gateway and attach it to the VPC.
Egress-only internet gateways specifically allow IPv6 egress while blocking ingress traffic.
3
Configure routing table rules.
Add a route for `::/0` pointing to the egress-only internet gateway in the route table associated with the private subnet.
This updates the route table to direct all outbound IPv6 traffic to the newly created egress-only gateway.

Key Concept

Egress-Only Internet Gateway routing configuration for IPv6 private subnets
Rate this question

Topics

VPC Connectivity and Routing Troubleshooting

More questions from this topic