A company deploys its SAP ERP system on AWS in a highly available configuration across two Availability Zones. The cluster is configured with an overlay IP address and a Network Load Balancer (NLB) to

Question

Options

• AConfigure VPC peering between the SAP VPC and the analytics VPC. Use network ACL rules in
• BCreate a transit gateway in the SAP account. Share the transit gateway with the analytics account.
• CConfigure VPC peering between the SAP VPC and the analytics VPUpdate the NLB security group
• DCreate a VPC endpoint service configuration on the SAP VPC. Specify the NLB in the endpoint

• A
  24% (13)
• B
  5% (3)
• C
  11% (6)
• D
  60% (33)

Explanation

Creating a VPC Endpoint Service (AWS PrivateLink) in the SAP VPC and specifying the NLB (D) provides the strongest protection. PrivateLink exposes only the specific NLB endpoint to the analytics VPC - the analytics account never gains access to any other resources in the SAP VPC. You can enforce allowlisting so only specific accounts or principals can create connections, and traffic never traverses the public internet. This limits the attack surface to exactly the intended service. VPC peering (A, C) establishes broad network-level connectivity between both VPCs, potentially exposing all resources in the SAP VPC to the analytics account, which violates least-privilege principles and widens the attack surface. Transit Gateway (B) also provides broad network connectivity across accounts and does not isolate exposure to the specific ODP service - it routes traffic at the network level and cannot restrict access to specific services within a VPC.

No community discussion yet for this question.