Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet with no internet access to invoke AWS Lambda functions. The VPC has no Internet Gateway or NAT Gateway attached. The administrator creates an Interface VPC Endpoint for AWS Lambda (com.amazonaws.us-east-1.lambda) in the VPC and associates it with the private subnet. However, application scripts on the EC2 instances continue to receive connection timeouts when trying to invoke Lambda functions using the default AWS SDK endpoint (lambda.us-east-1.amazonaws.com).

Which of the following configuration changes should the SysOps Administrator make to resolve this connectivity issue? (Select TWO.)

  1. Enable private DNS hostnames for the Interface VPC Endpoint.Answer
  2. Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.Answer
  3. C
    Add a route to the private subnet's Route Table that targets the Interface VPC Endpoint for the AWS Lambda prefix list.
  4. D
    Add a route to the private subnet's Route Table targeting the Internet Gateway for all traffic destined for the AWS Lambda service endpoints.
  5. E
    Configure the network ACL associated with the private subnet to deny outbound traffic on ephemeral ports (1024-65535).

Answer

Enabling private DNS hostnames for the Interface VPC Endpoint and allowing inbound HTTPS traffic on port 443 from the EC2 instances' security group in the endpoint's security group will resolve the connection timeouts.
To resolve the timeout issue, private DNS hostnames must be enabled on the Interface VPC Endpoint so that the AWS SDK's default domain name resolves to the endpoint's private IP addresses. Additionally, the security group of the Interface VPC Endpoint must allow inbound HTTPS traffic on port 443 from the EC2 instances' security group.

Step-by-Step Solution

1
Enable private DNS hostnames on the Interface VPC Endpoint configuration.
DNS queries from the EC2 instances for lambda.us-east-1.amazonaws.com resolve to the private IP addresses of the endpoint network interfaces.
This ensures the standard SDK client requests are automatically routed internally to the private endpoint instead of resolving to public IP addresses.
2
Update the security group of the Interface VPC Endpoint to permit inbound HTTPS (port 443) traffic from the security group associated with the EC2 instances.
The network interfaces of the VPC endpoint accept incoming TCP connection requests on port 443 from the EC2 instances.
Security groups on Interface VPC Endpoints are stateful and must explicitly allow inbound traffic from clients accessing the service.

Key Concept

Interface VPC Endpoints require both Private DNS to resolve standard service endpoints internally and appropriate inbound security group rules to allow client traffic.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic