Examkin

Soru

Zorluk: ZorVPC Endpoints and PrivateLink Integration

An organization runs an application on Amazon EC2 instances in a private subnet within a VPC. The subnet does not have a route to an Internet Gateway or a NAT Gateway. The application must write messages to an Amazon SQS queue in the same AWS Region. A SysOps Administrator deploys an Interface VPC Endpoint for SQS (com.amazonaws.us-east-1.sqs) associated with the private subnet. However, the application logs show that connection attempts to sqs.us-east-1.amazonaws.com continue to time out. Which combination of actions should the SysOps Administrator take to resolve this issue? (Select TWO.)

  1. Enable Private DNS hostnames for the Interface VPC Endpoint.Cevap
  2. Configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS (TCP port 443) traffic from the security group of the EC2 instances.Cevap
  3. C
    Add a route to the private subnet's route table that targets the Interface VPC Endpoint ID for SQS traffic.
  4. D
    Modify the private subnet's Network Access Control List (NACL) to allow inbound traffic on TCP port 443 from the SQS service CIDR block.
  5. E
    Modify the private subnet's route table to route traffic destined for SQS to a NAT Gateway located in the private subnet.

Cevap

Enable Private DNS hostnames for the Interface VPC Endpoint, and configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS (TCP port 443) traffic from the security group of the EC2 instances.
To resolve the timeout issue, Private DNS hostnames must be enabled on the Interface VPC Endpoint so that the application's calls to the public SQS URL resolve to the endpoint's private IP addresses. Additionally, the security group attached to the Interface VPC Endpoint's network interfaces must permit inbound HTTPS (TCP port 443) traffic from the EC2 instances' security group.

Adım Adım Çözüm

1
Analyze the connection timeout log to identify the network path and DNS resolution behavior.
The application attempts to connect to the public endpoint (sqs.us-east-1.amazonaws.com) but times out because the subnet has no route to the internet, and DNS is either not resolving to the endpoint's private IPs or the network path to the endpoint's network interfaces is blocked.
Understanding why the connection times out helps isolate whether the issue is DNS resolution or security group blocking.
2
Configure DNS resolution for the Interface VPC Endpoint.
Enabling Private DNS hostnames ensures that requests to the public SQS endpoint are transparently routed to the Interface VPC Endpoint's private IP addresses.
This allows the application to utilize the private network path without modifying the endpoint URI in code.
3
Configure security group rules to allow network traffic to pass through the endpoint's interface.
The security group associated with the Interface VPC Endpoint's network interfaces is updated to allow inbound TCP port 443 traffic from the security group of the EC2 instances.
Interface VPC Endpoints use Elastic Network Interfaces (ENIs) which require explicit inbound security group rules to permit traffic from clients.

Anahtar Kavram

Interface VPC Endpoints rely on Private DNS hostnames for transparent routing and Security Groups on their Elastic Network Interfaces for traffic control. Unlike Gateway Endpoints, they do not use subnet route tables.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

VPC Endpoints and PrivateLink Integration

Bu konudan daha fazla soru