Examkin

Soru

Zorluk: KolayVPC Endpoints and PrivateLink Integration

A SysOps Administrator has deployed an Interface VPC Endpoint for AWS Key Management Service (AWS KMS) to allow Amazon EC2 instances in a private VPC subnet to securely access KMS. The applications on the EC2 instances are configured to use the default service endpoint kms.us-east-1.amazonaws.com. However, they are unable to resolve the hostname to the private IP addresses of the endpoint. Which action will resolve this DNS resolution issue?

  1. Enable private DNS hostnames for the Interface VPC Endpoint.Cevap
  2. B
    Add a route to the subnet's route table pointing to the Interface VPC Endpoint.
  3. C
    Add a route to the subnet's route table pointing to the Internet Gateway.
  4. D
    Route the AWS KMS traffic through a NAT Gateway in a public subnet.

Cevap

Enable private DNS hostnames for the Interface VPC Endpoint.
Enabling private DNS hostnames creates a Route 53 private hosted zone associated with the VPC. This resolves the public service endpoint hostname to the private IP addresses of the Interface VPC Endpoint's network interfaces, allowing applications to function without changing their destination endpoint URLs.

Adım Adım Çözüm

1
Identify the type of VPC endpoint being configured.
The scenario specifies an Interface VPC Endpoint (AWS PrivateLink), which provisions Elastic Network Interfaces (ENIs) within the subnets.
This establishes that communication relies on direct network interface targeting and DNS name resolution, rather than route table rules.
2
Evaluate the application configuration requirements.
Applications are configured to send requests to the default public endpoint URL (kms.us-east-1.amazonaws.com) rather than a custom endpoint DNS name.
This indicates that public DNS resolution must be overridden locally within the VPC to point to the private IP addresses of the interface endpoint.
3
Enable the private DNS hostnames feature on the Interface VPC Endpoint.
AWS associates a private Route 53 hosted zone with the VPC, mapping the public hostname kms.us-east-1.amazonaws.com to the private IPs of the endpoint's ENIs.
This allows applications to use the standard default endpoint name and have their traffic routed privately to AWS KMS without code or configuration changes.

Anahtar Kavram

Interface VPC Endpoints require Private DNS to be enabled so that standard public endpoint hostnames resolve directly to the private IP addresses of the endpoint's network interfaces.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

VPC Endpoints and PrivateLink Integration

Bu konudan daha fazla soru