Examkin

Question

Difficulty: HardVPC Endpoints and PrivateLink Integration

An organization runs an application on Amazon EC2 instances in a private VPC subnet. The application frequently reads and writes data to an Amazon DynamoDB table. A SysOps Administrator notices a significant increase in NAT Gateway data processing charges. To eliminate these charges, the administrator deploys a Gateway VPC Endpoint for Amazon DynamoDB within the VPC. However, monitoring tools reveal that the EC2 instances are still routing all DynamoDB traffic through the NAT Gateway. Which of the following is the most likely cause of this behavior?

  1. A
    The security group associated with the DynamoDB gateway endpoint does not allow inbound HTTPS traffic on port 443443 from the EC2 instances.
  2. B
    The administrator did not manually add a route to the private subnet's route table pointing to the gateway endpoint's Elastic Network Interface ID as the target.
  3. C
    Private DNS hostnames were not enabled on the DynamoDB gateway endpoint, preventing the EC2 instances from resolving the DynamoDB endpoint to a private IP address.
  4. The route table associated with the private subnet was not selected during the gateway endpoint configuration, preventing the DynamoDB prefix list route from being automatically added.Answer

Answer

The route table associated with the private subnet was not selected during the gateway endpoint configuration, preventing the DynamoDB prefix list route from being automatically added.
The correct option is that the private subnet's route table was not selected during the gateway endpoint configuration. Gateway VPC Endpoints function by automatically adding a route to the associated route tables. This route maps the prefix list of the destination service (e.g., DynamoDB) to the VPC endpoint ID. If the private subnet's route table is not selected during creation or update, the route is not added, and traffic continues to route through the default path (the NAT Gateway).

Step-by-Step Solution

1
Identify the endpoint type required for Amazon DynamoDB.
DynamoDB uses a Gateway VPC Endpoint by default.
This determines how routing and network access controls are applied.
2
Analyze how Gateway VPC Endpoints modify routing.
They add a route mapping the DynamoDB prefix list (pl−xxxxxxpl-xxxxxx) to the gateway endpoint (vpce−xxxxxxvpce-xxxxxx) in associated route tables.
Traffic to DynamoDB is routed at the subnet level rather than resolving to private IP addresses on interface endpoints.
3
Diagnose why traffic is still routed to the NAT Gateway.
If the private subnet's route table was not selected during endpoint creation, the prefix list route is missing from that route table.
Without the prefix list route, traffic default-routes to the NAT Gateway.

Key Concept

Gateway VPC Endpoints route traffic using subnet route tables and prefix lists, without utilizing Elastic Network Interfaces, security groups, or private DNS settings.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic