ANS-C01 Question 431
Single answerYou are managing the network security of an application hosted on AWS that requires strict compliance with regulatory standards. The application is hosted in a VPC with multiple subnets, and you need to ensure that no outbound internet traffic is allowed from a specific private subnet except for traffic directed to a specific external compliance server. How should you architect the solution to meet this requirement?
- A
Configure a NAT gateway in the private subnet and add a route to the compliance server using an Elastic IP.
- B
Use a VPC endpoint to connect to the compliance server and deny all other outbound traffic using network ACLs.
- C
Deploy a proxy server in the private subnet, configure it to allow traffic only to the compliance server, and deny all other outbound traffic.
- D
Create a custom route table for the private subnet that routes 0.0.0.0/0 to a NAT gateway in a public subnet, while adding a specific route to the compliance server.
Show answer and explanation
Correct answer: C
Explanation
To meet the requirement of allowing traffic only to a specific external compliance server while denying all other outbound internet traffic, the best approach is to use a proxy server in the private subnet. The proxy server can be configured to enforce strict rules on outbound traffic destinations. Other options either enable broader internet access or do not support external server connections, making them unsuitable for this scenario.
- A. Incorrect.
Incorrect. A NAT gateway enables outbound internet access, which contradicts the requirement to prevent all other outbound traffic.
- B. Incorrect.
Incorrect. VPC endpoints are used to privately connect to AWS services, not external servers, so this would not work for an external compliance server.
- C. Correct.
Correct. A proxy server can be configured to allow traffic only to specific destinations, such as the compliance server, while denying all other outbound traffic, thus meeting the requirement.
- D. Incorrect.
Incorrect. Routing all outbound traffic (0.0.0.0/0) through a NAT gateway would allow unrestricted internet access, which violates the requirement.