Examkin

Question

Difficulty: HardVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring private connectivity from Amazon EC2 instances in a private subnet to a partner's service hosted in a different AWS account. The partner has shared their service using an AWS PrivateLink endpoint service, and the administrator has created a corresponding Interface VPC Endpoint in the consumer VPC. Although the EC2 instances can resolve the service's Private DNS name to the private IP addresses of the endpoint, all application connection requests to the service end in a connection timeout.

Which of the following actions should the administrator take to resolve this connectivity issue?

  1. Update the security group associated with the Interface VPC Endpoint to allow inbound traffic on the service port from the security group of the EC2 instances.Answer
  2. B
    Add a route to the private subnet's Route Table that designates the Interface VPC Endpoint as the target for the partner service's traffic.
  3. C
    Update the private subnet's Route Table to direct all traffic destined for the service's DNS name through a NAT Gateway.
  4. D
    Modify the outbound Network Access Control List (NACL) of the private subnet to block all ephemeral ports to prevent traffic from bypassing the endpoint.

Answer

Update the security group associated with the Interface VPC Endpoint to allow inbound traffic on the service port from the security group of the EC2 instances.
The correct action is to update the security group associated with the Interface VPC Endpoint. Interface VPC Endpoints place Elastic Network Interfaces (ENIs) inside the customer's VPC subnets. Access to these ENIs is controlled by their associated security groups. A connection timeout indicates that the request packets are being dropped, which is solved by permitting inbound traffic from the EC2 instances' security group on the required port.

Step-by-Step Solution

1
Analyze the connection timeout symptom.
Connection timeouts indicate that network packets are being silently dropped, rather than actively refused or failing DNS resolution.
This narrows down the cause to firewall or access control mechanisms (security groups or NACLs) rather than routing or DNS naming issues.
2
Evaluate the architecture of Interface VPC Endpoints.
Interface VPC Endpoints deploy Elastic Network Interfaces (ENIs) within the specified subnets, which receive security groups to control network traffic.
Understanding that Interface Endpoints rely on security groups on their ENIs is critical for troubleshooting traffic flow.
3
Identify the missing security rule configuration.
The endpoint's security group must permit inbound traffic from the EC2 instances. Allowing inbound traffic from the EC2 security group on the target service port establishes connectivity.
This permits the traffic to flow through the endpoint ENI and reach the partner's service provider endpoint.

Key Concept

Interface VPC Endpoints rely on security groups to control inbound access, and do not use route table entries unlike Gateway VPC Endpoints.
Estimated Time:2m 30s
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic