DOP-C02 · Question #373
You are building a deployment system on AWS. You will deploy new code by bootstrapping instances in a private subnet in a VPC at runtime using UserData scripts pointing to an S3 zip file object…
The correct answer is B. If the NAT routing for the private subnet fails, deployments fail. Since you are not using VPC endpoints, outbound requests for the code sitting in S3 are routed though the NAT for the VPC's private subnets. If this networking fails, runtime bootstrapping through code download will fail due to network unavailability and lack of access to the…
Question
You are building a deployment system on AWS. You will deploy new code by bootstrapping instances in a private subnet in a VPC at runtime using UserData scripts pointing to an S3 zip file object, where your code is stored. An ELB in a public subnet has network interfaces and connectivity to the instances. Requests from users of the system are routed to the ELB via a Route53 A Record Alias. You do not use any VPC endpoints. Which is a risk of using this approach?
Options
- ARoute53 Alias records do not always update dynamically with ELB network changes after
- BIf the NAT routing for the private subnet fails, deployments fail.
- CKernel changes to the base AMI may render the code inoperable.
- DThe instances cannot be in a private subnet if the ELB is in a public one.
How the community answered
(47 responses)- A4% (2)
- B62% (29)
- C21% (10)
- D13% (6)
Explanation
Since you are not using VPC endpoints, outbound requests for the code sitting in S3 are routed though the NAT for the VPC's private subnets. If this networking fails, runtime bootstrapping through code download will fail due to network unavailability and lack of access to the Internet, and thus Amazon S3.
Topics
Community Discussion
No community discussion yet for this question.