Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring a VPC with a private subnet that contains Amazon EC2 instances. The instances must access Amazon DynamoDB and AWS Key Management Service (AWS KMS) securely. The VPC does not have an Internet Gateway or a NAT Gateway. The administrator creates a Gateway VPC Endpoint for DynamoDB and an Interface VPC Endpoint for KMS. Which of the following configurations are required to establish connectivity from the EC2 instances to both services? (Select TWO.)

  1. Associate the DynamoDB Gateway VPC Endpoint with the route table of the private subnet.Answer
  2. Configure the security group attached to the KMS Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443443 from the EC2 instances.Answer
  3. C
    Add a route to the private subnet's route table that targets the KMS Interface VPC Endpoint for KMS traffic.
  4. D
    Enable Private DNS on the DynamoDB Gateway VPC Endpoint to resolve DynamoDB hostnames to private IP addresses.
  5. E
    Attach a security group to the DynamoDB Gateway VPC Endpoint that allows outbound HTTPS traffic from the EC2 instances.

Answer

To enable private access to Amazon DynamoDB and AWS KMS from EC2 instances in a private subnet, the SysOps Administrator must associate the DynamoDB Gateway VPC Endpoint with the subnet's route table and configure the security group of the KMS Interface VPC Endpoint to allow inbound traffic on TCP port 443443 from the EC2 instances.
Associating the DynamoDB Gateway VPC Endpoint with the subnet's route table ensures that traffic destined for DynamoDB is routed internally through the endpoint. Configuring the KMS Interface VPC Endpoint's security group to allow inbound port 443443 traffic from the EC2 instances ensures that the instances can establish a secure connection to the endpoint's elastic network interfaces (ENIs).

Step-by-Step Solution

1
Associate the DynamoDB Gateway VPC Endpoint with the route table of the private subnet containing the EC2 instances.
A route is automatically added to the subnet's route table targeting the DynamoDB service prefix list via the gateway endpoint.
Gateway VPC Endpoints require route table routing to direct traffic from the subnet to the AWS service privately.
2
Configure the security group attached to the KMS Interface VPC Endpoint to allow inbound HTTPS (TCP port 443443) traffic.
The security group allows network packets from the EC2 instances to reach the endpoint's elastic network interfaces (ENIs).
Interface VPC Endpoints use ENIs which rely on security groups to control inbound traffic from client instances.

Key Concept

VPC Gateway Endpoints require routing table associations to steer traffic, while VPC Interface Endpoints utilize Elastic Network Interfaces (ENIs) and require security group rules to permit traffic.
Estimated Time:2m 0s
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic