Examkin

Soru

Zorluk: OrtaVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring private connectivity between application servers in a consumer VPC and a third-party database service hosted in a provider VPC. The administrator creates an Interface VPC Endpoint (AWS PrivateLink) in the consumer VPC for the database service and enables the Private DNS option. However, the application servers in the private subnet are experiencing connection timeouts when attempting to reach the database service. Which combination of actions should the SysOps Administrator take to resolve this connectivity issue? (Select TWO.)

  1. Configure the security group attached to the Interface VPC Endpoint to allow inbound traffic on the database port from the security group of the application servers.Cevap
  2. Verify that both DNS resolution and DNS hostnames are enabled as attributes for the consumer VPC.Cevap
  3. C
    Add a route to the private subnet's route table that targets the Interface VPC Endpoint ID (vpce-xxxxxx) for the destination CIDR of the database service.
  4. D
    Associate the Interface VPC Endpoint with the route table of the private subnet containing the application servers.
  5. E
    Configure the application servers to route database traffic through a NAT Gateway to access the PrivateLink service.

Cevap

Configure the security group attached to the Interface VPC Endpoint to allow inbound traffic on the database port from the security group of the application servers, and verify that both DNS resolution and DNS hostnames are enabled as attributes for the consumer VPC.
The correct options target the two mandatory components of configuring an Interface VPC Endpoint: opening the security group of the endpoint's network interface to permit inbound connections from the client instances, and enabling DNS hostnames and DNS support in the consumer VPC attributes so that Private DNS can resolve to the endpoint's private IP addresses.

Adım Adım Çözüm

1
Ensure the endpoint's firewall rules permit the client traffic.
The security group attached to the Interface VPC Endpoint's network interfaces is updated to allow inbound TCP traffic on the database port from the application servers' security group.
Interface VPC Endpoints are represented as network interfaces in the VPC and require explicit inbound security group rules to accept incoming connection requests.
2
Verify VPC DNS settings to allow local name resolution.
The 'enableDnsSupport' and 'enableDnsHostnames' settings on the consumer VPC are set to true.
Private DNS resolution for interface endpoints depends on the VPC's capability to resolve Amazon-provided DNS hostnames privately.

Anahtar Kavram

Interface VPC Endpoints utilize Elastic Network Interfaces (ENIs) inside the customer's subnets and rely on VPC DNS resolution settings and security group rules rather than route table modifications to steer and authorize traffic.
Bu soruyu puanla

Konular

VPC Endpoints and PrivateLink Integration

Bu konudan daha fazla soru