SCS-C02 · Question #240
A security engineer for a large company is managing a data processing application used by 1.500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port…
The correct answer is C. Create an AWS PrivateLink endpoint service in the parent company account attached to the NLB. AWS PrivateLink is designed to provide secure, private connectivity between VPCs across AWS accounts and regions without exposing traffic to the public internet. By using PrivateLink, the parent company can expose the application privately to the subsidiary companies. This…
Question
A security engineer for a large company is managing a data processing application used by 1.500 subsidiary companies. The parent and subsidiary companies all use AWS. The application uses TCP port 443 and runs on Amazon EC2 behind a Network Load Balancer (NLB). For compliance reasons, the application should only be accessible to the subsidianes and should not be available on the public internet. To meet the compliance requirements for restricted access, the engineer has received the public and private CIDR block ranges for each subsidiary. What solution should the engineer use to implement the appropriate access restrictions for the application?
Options
- ACreate a NACL to allow access on TCP port 443 (rom the 1.500 subsidiary CIDR block ranges
- BCreate an AWS security group to allow access on TCP port 443 from the 1,500 subsidiary CIDR
- CCreate an AWS PrivateLink endpoint service in the parent company account attached to the NLB.
- DCreate an AWS security group to allow access on TCP port 443 from the 1.500 subsidiary CIDR
How the community answered
(57 responses)- A4% (2)
- B14% (8)
- C75% (43)
- D7% (4)
Explanation
AWS PrivateLink is designed to provide secure, private connectivity between VPCs across AWS accounts and regions without exposing traffic to the public internet. By using PrivateLink, the parent company can expose the application privately to the subsidiary companies. This approach ensures that only the subsidiaries can access the application via PrivateLink interface endpoints in their respective AWS accounts, while also meeting the compliance requirement of keeping the application off the public internet. This solution scales well and provides strong security control.
Topics
Community Discussion
No community discussion yet for this question.