Examkin

Soru

Zorluk: ZorVPC Network Security

An enterprise is securing a payment processing application running on Amazon EC2 instances in a private subnet (CIDR 10.0.1.0/2410.0.1.0/24). The application must securely access Amazon S3 to read transaction logs and connect to an external credit bureau API via HTTPS over the internet. Currently, all outbound traffic from the private subnet is routed through a NAT Gateway located in a public subnet. To optimize cost and security, the solution architect deploys a Gateway VPC Endpoint for Amazon S3. The architect now wants to restrict network access at both the subnet and instance levels to allow only these two destinations, adhering to the principle of least privilege. Which of the following configurations must the architect implement to achieve this? (Select TWO.)

  1. Add a route to the private subnet's route table that targets the S3 Gateway VPC Endpoint for the destination Amazon S3 prefix list, while keeping the default route (0.0.0.0/00.0.0.0/0) targeting the NAT Gateway.Cevap
  2. Configure the security group associated with the EC2 instances to allow outbound traffic to the Amazon S3 prefix list on port 443443, and outbound traffic to the credit bureau's public IP range on port 443443.Cevap
  3. C
    Add an outbound rule to the private subnet's Network ACL that references the Amazon S3 prefix list (pl-xxxxxxxx) to restrict outbound subnet traffic to S3.
  4. D
    Add an inbound rule to the private subnet's Network ACL that references the S3 Gateway VPC Endpoint ID (vpce-xxxxxxxx) to allow stateless return traffic.
  5. E
    Replace the default route in the private subnet's route table with a route targeting the S3 Gateway VPC Endpoint for 0.0.0.0/00.0.0.0/0, using the endpoint policy to filter and redirect non-S3 traffic to the NAT Gateway.

Cevap

To secure the architecture, the private subnet's route table must route S3 prefix list traffic through the S3 Gateway VPC Endpoint while retaining the default route to the NAT Gateway, and the EC2 instances' security group must outbound-allow HTTPS traffic to both the S3 prefix list and the credit bureau's IP range.
The correct configuration combines route table updates and stateful security group rules. The route table must have a route pointing the S3 prefix list to the S3 Gateway VPC Endpoint, while the default route remains pointed at the NAT Gateway for the credit bureau API. The instances' security groups should restrict outbound HTTPS traffic to the S3 prefix list and the credit bureau's IP range. Because security groups are stateful, return traffic is permitted automatically.

Adım Adım Çözüm

1
Configure the route table for the private subnet.
Add a route with the S3 prefix list as the destination and the Gateway VPC Endpoint ID as the target. Maintain the default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway.
Gateway VPC Endpoints require route table entries mapped to the S3 prefix list. Other internet traffic (the credit bureau API) must continue using the NAT Gateway.
2
Configure security groups at the instance level.
Add two outbound rules: one allowing TCP port 443443 to the S3 prefix list, and another allowing TCP port 443443 to the credit bureau's CIDR.
Security groups are stateful, allowing return traffic automatically. They support referencing prefix lists and CIDR blocks to enforce least-privilege egress filtering.
3
Evaluate subnet-level Network ACL restrictions.
Keep the Network ACL rules configured with standard IP CIDRs and ephemeral ports if restricting at this layer, avoiding attempts to reference prefix lists or VPC endpoint IDs.
Network ACLs do not support AWS-specific resources like prefix lists or VPC endpoint IDs, so security group filtering is preferred for granular resource-level restriction.

Anahtar Kavram

Gateway VPC Endpoint routing and the operational limits of stateless Network ACLs vs stateful Security Groups.
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru