Examkin

Soru

Zorluk: OrtaVPC Network Security

A company runs a data processing application on Amazon EC2 instances located in the private subnets of a VPC. The application must regularly download software updates from an external repository on the public internet and upload large processed datasets to an Amazon S3 bucket. The company wants to minimize data transfer costs and ensure that the network configuration follows security best practices. Which TWO configurations should a solutions architect implement to meet these requirements? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.Cevap
  2. Deploy a NAT Gateway in a public subnet, and configure the route tables of the private subnets to route outbound traffic destined for 0.0.0.0/00.0.0.0/0 to the NAT Gateway.Cevap
  3. C
    Route all Amazon S3 traffic through the NAT Gateway to the public S3 endpoints to simplify routing and avoid creating additional VPC endpoints.
  4. D
    Add an inbound rule to the security group of the Amazon EC2 instances to allow return traffic on ephemeral ports (1024−655351024 - 65535) from the NAT Gateway.
  5. E
    Configure the private subnet Network ACL with an outbound rule allowing traffic to the external repository, and rely on the Network ACL's stateful packet inspection to automatically permit response traffic.

Cevap

The correct configurations are to create a Gateway VPC Endpoint for Amazon S3 associated with the private subnet route tables, and to deploy a NAT Gateway in a public subnet with a route for outbound internet traffic in the private subnet route tables.
Creating a Gateway VPC Endpoint for Amazon S3 allows instances in the private subnets to securely transfer data to S3 without using a NAT Gateway, avoiding data processing charges. Deploying a NAT Gateway in a public subnet and routing 0.0.0.0/00.0.0.0/0 traffic from the private subnets through it allows the private instances to download updates from the public internet safely.

Adım Adım Çözüm

1
Analyze the requirements for internet egress and AWS service access.
The application needs access to the public internet for software updates and access to Amazon S3 for data uploads.
This establishes the routing paths needed: one for public internet traffic and one for Amazon S3 traffic.
2
Identify the most secure and cost-effective method to access Amazon S3 from private subnets.
A Gateway VPC Endpoint for Amazon S3 is selected.
Gateway VPC Endpoints are free and allow private subnets to communicate with Amazon S3 without traversing the internet or incurring NAT Gateway data transfer charges.
3
Identify the mechanism for private instances to safely download updates from the internet.
A NAT Gateway is deployed in a public subnet, and the private subnet route table is updated to route outbound internet traffic (0.0.0.0/00.0.0.0/0) through it.
This allows instances in the private subnets to initiate outbound connections to the internet for updates while blocking unsolicited inbound connections from the internet.

Anahtar Kavram

VPC Network Security and VPC Endpoint Routing
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru