SAP-C02 Question 228
Select 3An organization is hosting a web application in a VPC that consists of public and private subnets. The application is deployed in the private subnet, and a load balancer is deployed in the public subnet to route traffic to the application. The application must access an external third-party API over the internet. Which of the following configurations ensures secure and functional connectivity for the application?
- A
Add a route in the private subnet's route table pointing to a NAT Gateway in the public subnet.
- B
Ensure the security group attached to the application instances allows outbound traffic to the third-party API's IP range on the required port.
- C
Configure the Network ACL for the private subnet to allow inbound traffic from the third-party API's IP range and corresponding outbound traffic.
- D
Attach an internet gateway to the VPC and associate it with the private subnet's route table.
- E
Add a route in the public subnet's route table pointing to the third-party API's IP range.
Show answer and explanation
Correct answers: A, B, C
Explanation
To allow private subnet instances to access the internet securely, they must route outbound traffic through a NAT Gateway in the public subnet. The security group must allow outbound traffic to the third-party API's IP range, and the Network ACL must also permit both inbound and outbound traffic. Associating an internet gateway with the private subnet or modifying the public subnet's route table does not meet the requirements or follow best practices.
- A. Correct.
Correct: A NAT Gateway in the public subnet allows private subnet instances to communicate with the internet securely. Adding a route in the private subnet's route table to the NAT Gateway ensures that outbound traffic is routed correctly.
- B. Correct.
Correct: Security groups must explicitly allow outbound traffic to the destination IP range and port. Without this rule, traffic to the third-party API will be blocked.
- C. Correct.
Correct: Network ACLs are stateless and require both inbound and outbound rules to allow traffic. Allowing traffic from and to the third-party API's IP range ensures traffic flows are permitted.
- D. Incorrect.
Incorrect: An internet gateway is required for public subnet internet access, but associating it with the private subnet's route table would expose private subnet instances to the internet, violating best practices.
- E. Incorrect.
Incorrect: Adding a route in the public subnet's route table pointing to the third-party API's IP range is unnecessary because the NAT Gateway handles routing for private subnet instances.