DEA-C01 Question 428
Select 2You are designing a secure data processing application on AWS that requires processing sensitive customer data. The application is deployed in an Amazon VPC. Compliance requirements mandate that the data must not traverse the public internet. Which combination of VPC components can you use to ensure secure access to Amazon S3 to store processed data, while meeting compliance requirements?
- A
A VPC endpoint for Amazon S3
- B
A NAT Gateway configured in a public subnet
- C
An internet gateway attached to the VPC
- D
A security group restricting access to Amazon S3 only
- E
A route table entry directing traffic to the VPC endpoint
Show answer and explanation
Correct answers: A, E
Explanation
To ensure compliance with the requirement that data does not traverse the public internet, you can use a VPC endpoint for Amazon S3, which provides private connectivity to S3 from within your VPC. Additionally, a route table entry must direct traffic for Amazon S3 to the VPC endpoint to ensure that the traffic remains private. This combination meets the compliance requirement effectively.
- A. Correct.
A VPC endpoint for Amazon S3 allows private connectivity to Amazon S3 without traversing the public internet.
- B. Incorrect.
A NAT Gateway allows instances in a private subnet to access the internet, but does not ensure compliance with the requirement to avoid the public internet.
- C. Incorrect.
An internet gateway is used to allow public internet access to resources in the VPC, which does not comply with the requirement to avoid public internet traversal.
- D. Incorrect.
A security group is used to control inbound and outbound traffic to/from resources in the VPC, but by itself, it does not ensure private access to Amazon S3.
- E. Correct.
A route table entry directing traffic to the VPC endpoint ensures that traffic to Amazon S3 is routed through the VPC endpoint, maintaining private connectivity.