ANS-C01 · Question #229
A company has developed a web service for language translation. The web service's application runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an…
The correct answer is B. Create an AWS PrivateLink endpoint service. Configure the endpoint service to require D. Configure a Network Load Balancer (NLB) and a listener with the ALB as a target. Associate the. Explanation AWS PrivateLink is the ideal solution for exposing a service to specific external AWS accounts without making it publicly accessible. Creating an endpoint service (Option B) with acceptance required ensures only approved customers can connect, while using a Network…
Question
A company has developed a web service for language translation. The web service's application runs on a fleet of Amazon EC2 instances that are in an Auto Scaling group. The instances run behind an Application Load Balancer (ALB) and are deployed in a private subnet. The web service can process requests that contain hundreds of megabytes of data. The company needs to give some customers the ability to access the web service. Each customer has its own AWS account. The company must make the web service accessible to approved customers without making the web service accessible to all customers. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)
Options
- ACreate VPC peering connections with the approved customers only.
- BCreate an AWS PrivateLink endpoint service. Configure the endpoint service to require
- CConfigure an authentication action for the endpoint service's load balancer to allow customers to
- DConfigure a Network Load Balancer (NLB) and a listener with the ALB as a target. Associate the
- EAssociate the ALB with the endpoint service.
How the community answered
(41 responses)- A22% (9)
- B61% (25)
- C10% (4)
- E7% (3)
Explanation
Explanation
AWS PrivateLink is the ideal solution for exposing a service to specific external AWS accounts without making it publicly accessible. Creating an endpoint service (Option B) with acceptance required ensures only approved customers can connect, while using a Network Load Balancer (Option D) is mandatory because PrivateLink requires an NLB as the front-end - the existing ALB can be registered as a target of the NLB, preserving the existing architecture while enabling PrivateLink connectivity.
Why the distractors are wrong:
- Option A (VPC Peering): Requires managing individual peering connections for each customer, introduces routing complexity, and creates significantly more operational overhead at scale.
- Option C (Authentication action on load balancer): This doesn't control network access to the service - it only handles application-layer authentication after a connection is already established, which doesn't meet the requirement.
- Option E (Associate ALB directly): PrivateLink endpoint services cannot be directly associated with an ALB; they require an NLB, making this option technically invalid without Option D first.
Memory Tip: Think "PrivateLink = NLB required" - whenever you see cross-account private service sharing without public exposure, the pattern is always: NLB → PrivateLink endpoint service → customer accepts invitation. The ALB handles HTTP logic behind the NLB.
Topics
Community Discussion
No community discussion yet for this question.