ANS-C01 Question 355
Select 2Your organization has deployed a custom service in a VPC on AWS. The service needs to be accessed by clients from another VPC within the same AWS Region, as well as from on-premises systems over a VPN connection. Which combination of options would allow secure, scalable, and private access to the service?
- A
Use AWS PrivateLink to expose the custom service as an endpoint service and configure on-premises and VPC clients to connect to the endpoint.
- B
Set up a VPC peering connection between the two VPCs and configure routing to allow on-premises clients to access the service via the peered VPC.
- C
Deploy an Application Load Balancer (ALB) in front of the service and allow access to the ALB from the peered VPC and on-premises systems.
- D
Use AWS PrivateLink for VPC access and configure a Transit Gateway for on-premises systems to connect to the service.
- E
Create a public-facing Elastic Load Balancer and secure it using security groups to allow both VPC and on-premises clients to access the service.
Show answer and explanation
Correct answers: A, D
Explanation
The correct solutions combine AWS PrivateLink for secure and private access to the custom service from VPCs and on-premises systems. PrivateLink provides endpoint services that can be securely accessed from other VPCs, and combining it with a Transit Gateway enables scalable and centralized routing for on-premises connectivity. VPC peering, ALBs, and public-facing load balancers either lack scalability, privacy, or introduce public exposure risks, making them less ideal solutions in this scenario.
- A. Correct.
This is a valid solution as AWS PrivateLink enables secure and private access to services within a VPC from other VPCs or on-premises systems via endpoint services.
- B. Incorrect.
This option is not fully correct because VPC peering does not natively allow on-premises access to the peered VPC without additional complex configurations like Transit Gateway or VPN routing.
- C. Incorrect.
This option does not maintain private connectivity as it exposes the service through an ALB, which isn't inherently private. It could lead to public access if misconfigured.
- D. Correct.
This is a valid solution as AWS PrivateLink provides private VPC access, and using a Transit Gateway allows centralized routing for on-premises systems to connect securely.
- E. Incorrect.
This option involves using a public-facing Elastic Load Balancer, which does not meet the requirement for private access and could expose the service to the internet.