SAP-C02 · Question #155
A company is running a workload that consists of thousands of Amazon EC2 instances. The workload is running in a VPC that contains several public subnets and private subnets. The public subnets have…
The correct answer is C. Update the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and. To migrate EC2 instances to IPv6 while keeping private subnets inaccessible from the internet, the solutions architect should associate an Amazon-provided IPv6 CIDR block with the VPC and subnets, and configure private subnets with an Egress-Only Internet Gateway.
Question
A company is running a workload that consists of thousands of Amazon EC2 instances. The workload is running in a VPC that contains several public subnets and private subnets. The public subnets have a route fo 0.0.0.0/0 to an existing internet gateway. The private subnets have a route for 0.0.0.0/0 to an existing NAT gateway. A solutions architect needs to migrate the entire fleet of EC2 instances to use IPv6. The EC2 instances that are in private subnets must not be accessible from the public internet. What should the solutions architect do to meet these requirements?
Options
- AUpdate the existing VPC, and associate a custom IPv6 CIDR block with the VPC and all subnets
- BUpdate the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and
- CUpdate the existing VPC, and associate an Amazon-provided IPv6 CIDR block with the VPC and
- DUpdate the existing VPC, and associate a custom IPv6 CIDR block with the VPC and all subnets
How the community answered
(26 responses)- A15% (4)
- B8% (2)
- C73% (19)
- D4% (1)
Why each option
To migrate EC2 instances to IPv6 while keeping private subnets inaccessible from the internet, the solutions architect should associate an Amazon-provided IPv6 CIDR block with the VPC and subnets, and configure private subnets with an Egress-Only Internet Gateway.
AWS does not support associating custom IPv6 CIDR blocks with VPCs; only Amazon-provided IPv6 CIDR blocks can be used.
While associating an Amazon-provided IPv6 CIDR block is correct, simply associating an Internet Gateway with private subnets would make them publicly accessible via IPv6, which contradicts the requirement that private subnets must not be accessible from the public internet.
Associating an Amazon-provided IPv6 CIDR block with the VPC and its subnets is the correct way to enable IPv6. For private subnets, an Egress-Only Internet Gateway allows outbound IPv6 traffic while preventing inbound connections from the public internet, satisfying the security requirement.
AWS does not support associating custom IPv6 CIDR blocks with VPCs; only Amazon-provided IPv6 CIDR blocks can be used.
Concept tested: AWS VPC IPv6 configuration and Egress-Only Internet Gateway
Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html#add-ipv6-cidr
Community Discussion
No community discussion yet for this question.