A SysOps Administrator is configuring an Interface VPC Endpoint for Amazon Systems Manager (SSM) to allow Amazon EC2 instances in a private subnet to securely communicate with the SSM API. The network traffic must remain entirely within the AWS network and not traverse the public internet. Which TWO configurations are required to establish this connectivity? (Select TWO.)
- Enable Private DNS for the Interface VPC Endpoint.Cevap
- Associate a security group with the Interface VPC Endpoint that allows inbound HTTPS (port 443) traffic from the EC2 instances' private subnet.Cevap
- CAdd a route to the private subnet's Route Table pointing to the VPC endpoint ID (vpce-xxxx) as the target.
- DAdd a default route pointing to an Internet Gateway (0.0.0.0/0) in the private subnet's Route Table.
Cevap
To configure an Interface VPC Endpoint, the SysOps Administrator must enable Private DNS on the endpoint and associate a security group with the endpoint that allows inbound HTTPS (port 443) traffic from the private subnet's EC2 instances.
For Interface VPC Endpoints, private connectivity is established via Elastic Network Interfaces (ENIs) and DNS. The correct actions are to enable Private DNS (which maps standard AWS service DNS hostnames to the private IP addresses of the endpoint) and to associate a security group with the endpoint that permits inbound HTTPS traffic from the resources in the private subnet.
Adım Adım Çözüm
Anahtar Kavram
Interface VPC Endpoints (AWS PrivateLink) require enabling Private DNS for seamless endpoint resolution and using security groups to control inbound network traffic to the endpoint network interfaces.