Examkin

Soru

Zorluk: KolayModernizing Workloads using Containers (ECS and EKS)

A digital payment startup, PayFast, is modernizing its on-premises transactional auditing workload by migrating it to AWS. The workload runs on Docker containers and processes high-security compliance data. To minimize operational overhead, the company decides to host the containers using Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The security compliance policy requires that each deployed task must have its own dedicated elastic network interface (ENI) and a specific security group to restrict inbound and outbound traffic. Which network configuration should the solutions architect specify in the task definition to meet these requirements?

  1. Set the network mode to awsvpc in the task definition to allocate a dedicated network interface and security group to each task.Cevap
  2. B
    Set the network mode to bridge in the task definition to utilize docker0 default virtual network interfaces.
  3. C
    Set the network mode to host in the task definition to share the underlying container instance port space directly.
  4. D
    Set the network mode to none in the task definition to disable external container networking entirely.

Cevap

Set the network mode to awsvpc in the task definition to allocate a dedicated network interface and security group to each task.
AWS Fargate only supports the awsvpc network mode. In this mode, Amazon ECS assigns a dedicated Elastic Network Interface (ENI) and a private IPv4 address to each task, allowing the application to use task-level security groups to control network traffic.

Adım Adım Çözüm

1
Analyze the launch type and compliance requirements.
The workload must run on AWS Fargate, and each task requires its own dedicated security group.
AWS Fargate does not support traditional host-level network configurations and enforces specific container networking modes.
2
Evaluate the supported network modes for AWS Fargate.
AWS Fargate only supports the awsvpc network mode.
Other modes like host, bridge, or none are only supported on ECS EC2 launch types.
3
Verify if the selected network mode meets the security requirements.
The awsvpc network mode assigns a dedicated ENI and security group to each task, satisfying the security compliance policy.
This allows fine-grained security control at the individual task level instead of the host level.

Anahtar Kavram

Amazon ECS task network modes for AWS Fargate
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru