nerdexam
Amazon

SAP-C02 · Question #783

A company is changing the way that it handles patching of Amazon EC2 instances in its application account. The company currently patches instances over the internet by using a NAT gateway in a VPC…

The correct answer is C. Create VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from the. The company needs to prevent Amazon EC2 instances in an application account from accessing the internet while ensuring they can privately connect to Amazon S3 for application data, AWS Systems Manager for patching, and an internal patch source repository in another VPC.

Submitted by yasin.bd· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

A company is changing the way that it handles patching of Amazon EC2 instances in its application account. The company currently patches instances over the internet by using a NAT gateway in a VPC in the application account. The company has EC2 instances set up as a patch source repository in a dedicated private VPC in a core account. The company wants to use AWS Systems Manager Patch Manager and the patch source repository in the core account to patch the EC2 instances in the application account. The company must prevent all EC2 instances in the application account from accessing the internet. The EC2 instances in the application account need to access Amazon S3, where the application data is stored. These EC2 instances need connectivity to Systems Manager and to the patch source repository in the private VPC in the core account. Which solution will meet these requirements?

Options

  • ACreate a network ACL that blocks outbound traffic on port 80. Associate the network ACL with all
  • BCreate private VIFs for Systems Manager and Amazon S3. Delete the NAT gateway from the
  • CCreate VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from the
  • DCreate a network ACL that blocks inbound traffic on port 80. Associate the network ACL with all

How the community answered

(54 responses)
  • A
    6% (3)
  • B
    4% (2)
  • C
    78% (42)
  • D
    13% (7)

Why each option

The company needs to prevent Amazon EC2 instances in an application account from accessing the internet while ensuring they can privately connect to Amazon S3 for application data, AWS Systems Manager for patching, and an internal patch source repository in another VPC.

ACreate a network ACL that blocks outbound traffic on port 80. Associate the network ACL with all

Network ACLs blocking specific ports (like 80) are insufficient to fully prevent all internet access and do not provide private connectivity to AWS services.

BCreate private VIFs for Systems Manager and Amazon S3. Delete the NAT gateway from the

Private VIFs are components of AWS Direct Connect used for connecting on-premises networks to AWS VPCs, not for providing private connectivity between resources *within* AWS or from a VPC to AWS public services.

CCreate VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from theCorrect

Option C correctly identifies that creating VPC endpoints for Amazon S3 (Gateway or Interface Endpoint) and AWS Systems Manager (Interface Endpoints) enables private and secure communication with these AWS services. Deleting the NAT gateway then fully prevents the EC2 instances from accessing the public internet, satisfying the primary security requirement.

DCreate a network ACL that blocks inbound traffic on port 80. Associate the network ACL with all

Blocking inbound port 80 prevents incoming web traffic, not outbound internet access from the EC2 instances, which is the requirement.

Concept tested: Private connectivity to AWS services (VPC Endpoints), network isolation, Systems Manager Patch Manager

Source: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice