Examkin

Soru

Zorluk: OrtaVPC Network Security

A financial services firm hosts a transaction processing application on Amazon EC2 instances in private subnets of a VPC. The instances must retrieve database credentials from AWS Secrets Manager and write transaction logs to an Amazon DynamoDB table. The architecture must prevent all traffic to these services from traversing the public internet, and data transfer costs must be minimized. Which TWO actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Create an interface VPC endpoint for AWS Secrets Manager in the private subnets and enable private DNS.Cevap
  2. Create a gateway VPC endpoint for Amazon DynamoDB and associate it with the private subnet route tables.Cevap
  3. C
    Deploy a NAT Gateway in a public subnet, and route all DynamoDB traffic through the NAT Gateway.
  4. D
    Configure a security group for the Amazon DynamoDB table that allows inbound HTTPS traffic from the EC2 instances' security group.
  5. E
    Associate a security group with the gateway VPC endpoint for DynamoDB to restrict traffic to the EC2 instances.

Cevap

The correct configurations are to create an interface VPC endpoint for AWS Secrets Manager with private DNS enabled, and to create a gateway VPC endpoint for Amazon DynamoDB associated with the private subnet route tables.
Creating an interface VPC endpoint for AWS Secrets Manager provides secure, private connectivity via PrivateLink and private DNS. Creating a gateway VPC endpoint for DynamoDB provides a secure, cost-free route to DynamoDB that is managed directly via the private subnet route tables, fulfilling both the isolation and cost-minimization requirements.

Adım Adım Çözüm

1
Analyze the access requirements for AWS Secrets Manager.
Secrets Manager requires an interface VPC endpoint (AWS PrivateLink) to allow private access without internet traversal.
Secrets Manager is a VPC-external service that does not support gateway endpoints, and interface endpoints with private DNS enable seamless private access.
2
Analyze the access and cost requirements for Amazon DynamoDB.
DynamoDB supports both gateway and interface VPC endpoints, but a gateway endpoint is free of hourly and data processing charges.
Using a gateway endpoint meets the cost minimization requirement while keeping all traffic internal within the AWS network.

Anahtar Kavram

Private VPC access to AWS services using VPC endpoints (Gateway and Interface types) to secure traffic and optimize costs.
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru