Examkin

Soru

Zorluk: ZorVPC Network Security

An enterprise is designing a secure network architecture for a sensitive payment processing workload running on Amazon EC2 instances inside a dedicated private subnet. The workload needs to securely access Amazon DynamoDB for database operations and a third-party compliance API hosted on the public internet. The architecture must satisfy the following requirements:
1. The EC2 instances must not have a direct route to an Internet Gateway or have public IP addresses.
2. Access to DynamoDB must remain entirely within the AWS network and must not incur data processing or hourly usage fees.
3. Network access control must be enforced statelessly at the subnet boundary and statefully at the instance level.

Which combination of steps should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet's route table.Cevap
  2. Configure the private subnet's Network ACL with an outbound rule allowing TCP port 443443 to the NAT Gateway's subnet, and an inbound rule allowing TCP ports 10241024-6553565535 from the NAT Gateway's subnet.Cevap
  3. C
    Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon DynamoDB and configure the private subnet's route table to route DynamoDB traffic through the endpoint.
  4. D
    Configure the EC2 instances' Security Group with an inbound rule allowing TCP ports 10241024-6553565535 from the NAT Gateway subnet to permit return traffic from the third-party API.
  5. E
    Deploy an AWS WAF web ACL and associate it directly with the private subnet's Network ACL to inspect Layer 7 payloads sent to the third-party compliance API.

Cevap

Create a Gateway VPC Endpoint for Amazon DynamoDB associated with the private subnet's route table, and configure the private subnet's Network ACL to allow outbound TCP port 443443 to the NAT Gateway's subnet and inbound TCP ports 10241024-6553565535 from the NAT Gateway's subnet.
To satisfy the requirements, the Solutions Architect must configure a Gateway VPC Endpoint for Amazon DynamoDB to enable secure, direct, and cost-free communication. Additionally, because Network ACLs are stateless, the private subnet's Network ACL must explicitly allow both the outbound traffic on HTTPS port 443443 to the NAT Gateway subnet and the inbound return traffic on ephemeral ports 10241024-6553565535 from the NAT Gateway subnet. Security groups, being stateful, do not require corresponding inbound ephemeral rule configurations.

Adım Adım Çözüm

1
Address the DynamoDB connectivity and cost requirements by selecting a Gateway VPC Endpoint.
DynamoDB traffic is routed privately through the AWS network without traversing the NAT Gateway, preventing data processing fees since Gateway endpoints are free of charge.
Interface VPC endpoints (PrivateLink) incur usage and data processing charges, making them incorrect for a requirement to avoid fees.
2
Address the stateless network access control requirements at the subnet boundary for the third-party compliance API.
The Network ACL must be updated with an outbound rule for port 443443 and an inbound rule for ephemeral ports (10241024-6553565535) to allow return traffic.
Network ACLs are stateless, meaning return traffic must be explicitly permitted, unlike stateful security groups which track connection states automatically.
3
Confirm stateful behavior at the instance level.
Ensure security groups only require outbound rules for HTTPS (443443) to the NAT Gateway, with no inbound ephemeral port rules required.
Security groups track connections statefully, rendering inbound ephemeral rules unnecessary and insecure.

Anahtar Kavram

VPC Network Security requires combining stateful Security Groups (acting at the instance ENI level) with stateless Network ACLs (acting at the subnet boundary), along with proper VPC endpoint routing (Gateway vs. Interface) to balance security, performance, and cost.
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru