Examkin

Soru

Zorluk: OrtaVPC Network Security

A company runs a critical application on Amazon EC2 instances in a private subnet within a VPC. The subnet has no route to the internet. The application must access AWS Key Management Service (AWS KMS) to decrypt sensitive configuration files. To comply with security policies, the traffic must not traverse the public internet, and access must be restricted using the principle of least privilege. The solutions architect deploys an interface VPC endpoint for AWS KMS. Which combination of security group configurations will meet these requirements?

  1. A
    Configure a Gateway VPC Endpoint for AWS KMS. Update the route table of the private subnet to route all KMS traffic through the gateway endpoint, and configure the security group of the EC2 instances to allow inbound traffic from the gateway endpoint.
  2. Configure the security group attached to the EC2 instances to allow outbound HTTPS (port 443) traffic to the security group of the interface VPC endpoint. Configure the security group attached to the interface VPC endpoint to allow inbound HTTPS traffic from the security group of the EC2 instances.Cevap
  3. C
    Configure the security group attached to the EC2 instances to allow outbound HTTPS (port 443) traffic to the VPC endpoint. Configure the Network ACL of the private subnet to allow inbound traffic on TCP port 443 and outbound traffic on ephemeral ports (1024-65535).
  4. D
    Configure the security group attached to the interface VPC endpoint to allow outbound HTTPS (port 443) traffic to the EC2 instances' subnet. Configure the security group of the EC2 instances to allow inbound HTTPS traffic from the public IP address range of AWS KMS.

Cevap

Configure the security group attached to the EC2 instances to allow outbound HTTPS (port 443) traffic to the security group of the interface VPC endpoint, and configure the security group attached to the interface VPC endpoint to allow inbound HTTPS traffic from the security group of the EC2 instances.
The correct answer configuration relies on stateful security groups to establish a private connection. An Interface VPC Endpoint uses an Elastic Network Interface (ENI) within the VPC. To permit the EC2 instances to communicate with the endpoint, the instances' security group must allow outbound HTTPS (port 443) traffic targeting the endpoint's security group. Conversely, the endpoint's security group must allow inbound HTTPS traffic from the EC2 instances' security group.

Adım Adım Çözüm

1
Identify the type of VPC endpoint required for the target AWS service.
AWS KMS only supports Interface VPC Endpoints, which deploy Elastic Network Interfaces (ENIs) with private IP addresses from the subnet.
Determines whether to configure route tables (for Gateway endpoints) or security groups (for Interface endpoints).
2
Determine the direction of traffic between the application instances and the endpoint.
The application on the EC2 instances must initiate outbound HTTPS (port 443) requests to the KMS Interface VPC Endpoint ENI.
Defines the required rules for the security groups attached to both resources.
3
Configure security group rules following the principle of least privilege.
The EC2 instances' security group is configured with an outbound rule allowing port 443 to the endpoint's security group. The endpoint's security group is configured with an inbound rule allowing port 443 from the instances' security group.
Ensures that only authorized traffic from the application instances can access the private KMS endpoint, while blocking unauthorized access.

Anahtar Kavram

Interface VPC Endpoints (AWS PrivateLink) require security groups on the endpoint's network interfaces to control inbound traffic. Security groups are stateful, so configuring outbound rules on the client and inbound rules on the server/endpoint is sufficient.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru