A company has multiple AWS Site-to-Site VPN connections between a VPC and its branch offices. The company manages an Amazon Elasticsearch Service (Amazon ES) domain that is configured with public…

Question

Options

• AConfigure an identity-based access policy on Amazon ES.
• BConfigure an IP-based domain access policy on Amazon ES.
• CDeploy a new Amazon ES domain in private subnets in a VPC, and import a snapshot from
• DReconfigure the Amazon ES domain in private subnets in a VPC.

• A
  11% (8)
• B
  81% (57)
• C
  4% (3)
• D
  3% (2)

Explanation

Option B is correct because an IP-based domain access policy on Amazon ES allows you to restrict access to specific IP address ranges - in this case, the public IPs of the branch office VPN endpoints - without requiring any infrastructure changes or data migration, thus preserving existing data.

Option A (identity-based policy) is wrong because identity-based policies control access based on IAM principals (users, roles), not network location. Branch offices connecting via Site-to-Site VPN don't inherently have IAM identities, so this wouldn't restrict access by office location.

Option C (new domain + snapshot import) is wrong because it requires creating a brand-new domain and migrating data via snapshot, which is operationally complex and unnecessary when a simple policy change achieves the goal.

Option D (reconfigure to private subnets) is wrong because moving an existing Amazon ES domain to a VPC isn't supported as an in-place reconfiguration - you'd have to create a new domain, making this functionally equivalent to option C but without even mentioning the snapshot, meaning data would be lost.

Memory tip: Think "IP-based = network location restriction." When a question involves restricting ES access to known network locations (offices, IP ranges) without touching the data, an IP-based resource policy is your answer - it's the simplest surgical change.

No community discussion yet for this question.