SAA-C03 · Question #214
A company is creating a low-latency payment processing application that supports TLS connections from IPv4 clients. The application requires outbound access to the public internet. Users must access t
The correct answer is A. Create a VPC that has an internet gateway, public subnets, and private subnets. Deploy a. Deploy a low-latency, secure payment processing application using ECS tasks (AWSVPC network mode) with TLS, IPv4 client support, public internet outbound access, and a single entry point.
Question
A company is creating a low-latency payment processing application that supports TLS connections from IPv4 clients. The application requires outbound access to the public internet. Users must access the application from a single entry point. The bank wants to use Amazon Elastic Container Service (Amazon ECS) tasks to deploy the application. The company wants to enable AWSVPC network mode. Which solution will meet these requirements MOST securely?
Options
- ACreate a VPC that has an internet gateway, public subnets, and private subnets. Deploy a
- BCreate a VPC that has an outbound-only internet gateway, public subnets, and private subnets.
- CCreate a VPC that has an internet gateway, public subnets, and private subnets. Deploy an
- DCreate a VPC that has an outbound-only internet gateway, public subnets, and private subnets.
How the community answered
(42 responses)- A79% (33)
- B5% (2)
- C12% (5)
- D5% (2)
Why each option
Deploy a low-latency, secure payment processing application using ECS tasks (AWSVPC network mode) with TLS, IPv4 client support, public internet outbound access, and a single entry point.
Deploying an Application Load Balancer (ALB) in public subnets provides a single, TLS-terminating entry point for IPv4 clients, while ECS tasks in private subnets with `awsvpc` network mode register with the ALB and access the internet via a NAT Gateway in a public subnet for secure outbound connectivity.
An outbound-only internet gateway is exclusively for IPv6 traffic, which contradicts the requirement for supporting IPv4 clients.
A Network Load Balancer (NLB) operates at Layer 4 and cannot terminate TLS connections for HTTP/S traffic, failing to meet the requirement for TLS connections from clients.
An outbound-only internet gateway is exclusively for IPv6 traffic, which contradicts the requirement for supporting IPv4 clients.
Concept tested: Secure ECS VPC architecture, ALB, NAT Gateway
Source: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html
Community Discussion
No community discussion yet for this question.