nerdexam
Amazon

ANS-C01 · Question #41

A real estate company is building an internal application so that real estate agents can upload photos and videos of various properties. The application will store these photos and videos in an…

The correct answer is C. Place the EC2 instances in a private subnet. Create an interface VPC endpoint for Amazon SQS. To allow EC2 instances in a private subnet to access Amazon SQS without public IP addresses, an interface VPC endpoint for SQS must be created in the VPC.

Submitted by krish.m· Mar 6, 2026Implementing AI Solutions

Question

A real estate company is building an internal application so that real estate agents can upload photos and videos of various properties. The application will store these photos and videos in an Amazon S3 bucket as objects and will use Amazon DynamoDB to store corresponding metadata. The S3 bucket will be configured to publish all PUT events for new object uploads to an Amazon Simple Queue Service (Amazon SQS) queue. A compute cluster of Amazon EC2 instances will poll the SQS queue to find out about newly uploaded objects. The cluster will retrieve new objects, perform proprietary image and video recognition and classification update metadata in DynamoDB and replace the objects with new watermarked objects. The company does not want public IP addresses on the EC2 instances. Which networking design solution will meet these requirements MOST cost-effectively as application usage increases?

Options

  • APlace the EC2 instances in a public subnet. Disable the Auto-assign Public IP option while
  • BPlace the EC2 instances in a private subnet. Create a NAT gateway in a public subnet in the
  • CPlace the EC2 instances in a private subnet. Create an interface VPC endpoint for Amazon SQS.
  • DPlace the EC2 instances in a private subnet. Create a gateway VPC endpoint for Amazon SQS.

How the community answered

(62 responses)
  • A
    24% (15)
  • B
    10% (6)
  • C
    61% (38)
  • D
    5% (3)

Why each option

To allow EC2 instances in a private subnet to access Amazon SQS without public IP addresses, an interface VPC endpoint for SQS must be created in the VPC.

APlace the EC2 instances in a public subnet. Disable the Auto-assign Public IP option while

Placing EC2 instances in a public subnet, even without a public IP, is not a private subnet configuration and exposes them to the public subnet's routing, failing to meet the security requirement.

BPlace the EC2 instances in a private subnet. Create a NAT gateway in a public subnet in the

A NAT gateway allows instances in a private subnet to initiate outbound connections to the internet, but it still relies on public IP addressing for the NAT gateway itself and is not the most private or direct way to access AWS services within the AWS network.

CPlace the EC2 instances in a private subnet. Create an interface VPC endpoint for Amazon SQS.Correct

Placing EC2 instances in a private subnet with an interface VPC endpoint for Amazon SQS allows them to communicate with SQS directly and securely using private IP addresses within the AWS network, without requiring public IPs or NAT gateways. Interface VPC endpoints provide private connectivity to services like SQS via AWS PrivateLink.

DPlace the EC2 instances in a private subnet. Create a gateway VPC endpoint for Amazon SQS.

Amazon SQS supports interface VPC endpoints (powered by AWS PrivateLink), not gateway VPC endpoints, which are only supported for Amazon S3 and DynamoDB.

Concept tested: VPC Interface Endpoints for SQS

Source: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-endpoints-private-link.html

Topics

#VPC endpoints#private subnet#SQS#EC2 networking

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full ANS-C01 Practice