Examkin

Soru

Zorluk: OrtaVPC Network Security

A healthcare analytics company is deploying a compliant application on Amazon EC2 instances in private subnets. The application must retrieve database credentials from AWS Secrets Manager and write processed records to Amazon DynamoDB. The company's security policy dictates that no traffic from the private subnets is allowed to traverse the public internet. Which two actions should a solutions architect take to meet these security requirements in a cost-effective manner? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables.Cevap
  2. Create an Interface VPC Endpoint for AWS Secrets Manager, and configure its security group to allow inbound HTTPS traffic on port 443 from the EC2 security group.Cevap
  3. C
    Create a Gateway VPC Endpoint for AWS Secrets Manager and update the route tables of the private subnets.
  4. D
    Route Amazon DynamoDB traffic through a NAT Gateway located in a public subnet to ensure secure transit over the AWS backbone.
  5. E
    Configure a Network ACL on the private subnet to allow inbound traffic from the public IP address ranges of AWS Secrets Manager.

Cevap

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the private subnet route tables; and create an Interface VPC Endpoint for AWS Secrets Manager, and configure its security group to allow inbound HTTPS traffic on port 443 from the EC2 security group.
To securely access AWS services without traversing the public internet, VPC Endpoints are utilized. For Amazon DynamoDB, a Gateway VPC Endpoint is the most cost-effective and secure option, as it is free and functions by adding a route to the subnet route tables. For AWS Secrets Manager, an Interface VPC Endpoint is required. Because Interface Endpoints use Elastic Network Interfaces (ENIs) within the VPC, access must be secured by attaching a security group to the endpoint that permits inbound HTTPS traffic from the backend application instances.

Adım Adım Çözüm

1
Identify the type of VPC endpoint required for Amazon DynamoDB.
Amazon DynamoDB supports Gateway VPC Endpoints, which are free and update subnet route tables directly.
This allows EC2 instances in private subnets to communicate with DynamoDB without leaving the AWS network or incurring NAT Gateway costs.
2
Identify the type of VPC endpoint required for AWS Secrets Manager.
AWS Secrets Manager supports Interface VPC Endpoints (AWS PrivateLink), which deploy elastic network interfaces (ENIs) inside the subnets.
This enables private access to AWS Secrets Manager using private IP addresses from the VPC.
3
Configure the security access rules for the Interface VPC Endpoint.
Attach a security group to the Secrets Manager interface endpoint that allows inbound HTTPS (port 443) traffic from the security group of the EC2 instances.
Security groups on Interface VPC Endpoints act as stateful firewalls controlling which resources can access the endpoint.

Anahtar Kavram

Selecting the correct VPC endpoint type (Gateway vs. Interface) and configuring its associated security controls (route tables or security groups) to establish secure, private, and cost-effective communication with AWS services.
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru