SAP-C02 · Question #726
A company has many services running in its on-premises data center. The data center is connected to AWS using AWS Direct Connect (DX) and an IPSec VPN. The service data is sensitive and connectivity…
The correct answer is A. Create a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer. To securely offer services hosted in a VPC to other AWS companies without traversing the internet, the most suitable solution is to implement an AWS PrivateLink service. This involves creating a VPC Endpoint Service, fronted by a Network Load Balancer, which enables consumers…
Question
A company has many services running in its on-premises data center. The data center is connected to AWS using AWS Direct Connect (DX) and an IPSec VPN. The service data is sensitive and connectivity cannot traverse the internet. The company wants to expand into a new market segment and begin offering its services to other companies that are using AWS. Which solution will meet these requirements?
Options
- ACreate a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer,
- BCreate a VPC Endpoint Service that accepts HTTP or HTTPS traffic, host it behind an Application
- CAttach an internet gateway to the VPC, and ensure that network access control and security
- DAttach a NAT gateway to the VPC, and ensure that network access control and security group
How the community answered
(41 responses)- A78% (32)
- B12% (5)
- C7% (3)
- D2% (1)
Why each option
To securely offer services hosted in a VPC to other AWS companies without traversing the internet, the most suitable solution is to implement an AWS PrivateLink service. This involves creating a VPC Endpoint Service, fronted by a Network Load Balancer, which enables consumers in other AWS VPCs to establish private, secure connections to the service over the AWS network.
AWS PrivateLink, instantiated through a VPC Endpoint Service fronted by a Network Load Balancer, is designed to enable secure and private connectivity between different AWS VPCs, even across accounts, without requiring traffic to traverse the public internet. This perfectly meets the requirement for sensitive service data that cannot traverse the internet and needs to be offered to other companies using AWS.
While an Application Load Balancer (ALB) can handle HTTP/HTTPS traffic, the standard architecture for a VPC Endpoint Service (PrivateLink) requires a Network Load Balancer (NLB) as its front-end to accept TCP traffic.
Attaching an Internet Gateway enables public internet access for the VPC, directly violating the requirement that sensitive service data connectivity cannot traverse the internet.
A NAT Gateway allows instances in private subnets to initiate outbound connections to the internet but does not provide a mechanism for other AWS accounts to securely and privately access services hosted in the VPC without internet traversal.
Concept tested: AWS PrivateLink, VPC Endpoint Services, Network Load Balancer, secure cross-account connectivity.
Source: https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html
Community Discussion
No community discussion yet for this question.