Practice Test 3 | AWS Certified Solutions Architect Associate | SAA-C03 | Dumps | Mock Test
You are working as an AWS architect for a start-up firm using EC2 instances in various AZ at us-east-1 region. The “us-east-1” region have three availability zones “AZ1”, “AZ2” and “AZ3”. Product Management Team has developed a new intranet application which needs to be accessed from VPC created in all AZ’s of “us-east-1” region. You have been assigned to a project to establish connectivity between all VPC’s in the three AZ’s to have a highly scalable secure solution. Which of the following would you recommend?
A. Attach an Internet Gateway to all the VPC’s at “us-east-1” & allow all users to access this application over the internet.
B. Deploy Network Load Balancers along with AWS PrivateLink to establish connectivity between the VPC’s in “us-east-1” region.
C. Use VPC Peering between all the VPC’s at “us-east-1” to provide connectivity between users & servers.
D. Create a VPN between instances at the various VPC’s in “us-east-1” to establish connectivity
Explanation:
Correct Answer – B
AWS PrivateLink provides secure private connectivity for services between separate VPC’s. For this, Network Load Balancers can be used in service provider while Elastic Network Interface is created in service consuming VPC. Using DNS, service provider service is resolved to the local IP address assigned to Elastic Network Interface which will forward all traffic to the Network Load Balancer in the provider network. Network Load Balancer will perform a source NAT for all traffic & forward to the provider instance
- Option A is incorrect as Using the Internet to establish connectivity between users & servers will not be a highly secure solution.
- Option C is incorrect. With VPC peering, all resources in each VPC will have access to resources in other VPC. Also, since only one client will be initiating a request to servers, VPC peering will not be an ideal solution.
- Option D is incorrect as VPN connectivity between the instance of various VPC’s will not be a scalable solution.
For more information on AWS PrivateLink, refer to the following URL:
https://docs.aws.amazon.com/vpc/latest/userguide/endpoint-service.html
Accessing Services Through AWS Private Links:
AWS PrivateLink is a highly available, scalable technology that enables you to privately connect your VPC to supported AWS services, services hosted by other AWS accounts (VPC endpoint services), and supported AWS Marketplace partner services. You do not require an internet gateway, NAT device, public IP address, AWS Direct Connect connection, or AWS Site-to-Site VPN connection to communicate with the service. The traffic between your VPC and the service does not leave the Amazon network.
To use AWS PrivateLink, create an interface VPC endpoint for a service in your VPC. This creates an elastic network interface in your subnet with a private IP address that serves as an entry point for the traffic, destined to the service. For more information, see VPC Endpoints.
You can create your own AWS PrivateLink-powered service (endpoint service) and enable other AWS customers to access your service. For more information, see VPC Endpoint Services (AWS PrivateLink).
For more information, refer to the following URLs:
https://aws.amazon.com/privatelink/
https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html#what-is-privatelink
Comments are closed, but trackbacks and pingbacks are open.