SAP-C02 Question 240
Select 2An organization has deployed an application in a private VPC that processes sensitive customer data. The application needs to interact with AWS services such as Amazon S3 and Amazon DynamoDB. To meet strict compliance requirements, the organization wants to ensure that all traffic remains within the AWS network and does not traverse the public internet. What should the Solutions Architect recommend?
- A
Create VPC endpoints for Amazon S3 and Amazon DynamoDB and configure the application to use these endpoints
- B
Use an internet gateway to route traffic to Amazon S3 and Amazon DynamoDB
- C
Enable AWS PrivateLink for Amazon S3 and Amazon DynamoDB and use the respective private endpoints
- D
Use a NAT Gateway to allow the application to access Amazon S3 and Amazon DynamoDB
- E
Configure VPC Flow Logs to monitor traffic, ensuring compliance requirements are met
Show answer and explanation
Correct answers: A, C
Explanation
To meet the compliance requirement of keeping traffic within the AWS network, you should use VPC endpoints or AWS PrivateLink. VPC endpoints for Amazon S3 and DynamoDB allow private connectivity to these services within the VPC, while AWS PrivateLink provides private access to supported AWS services via private endpoints. Using an internet gateway or NAT Gateway would route traffic through the public internet, violating the compliance requirement. VPC Flow Logs are a monitoring tool and do not affect traffic routing.
- A. Correct.
Correct. VPC endpoints for Amazon S3 and Amazon DynamoDB allow private connectivity between your VPC and these services, ensuring the traffic stays within the AWS network.
- B. Incorrect.
Incorrect. An internet gateway would route traffic through the public internet, which does not meet the compliance requirement of keeping traffic within the AWS network.
- C. Correct.
Correct. AWS PrivateLink enables private access to supported AWS services via private endpoints, ensuring traffic does not leave the AWS network.
- D. Incorrect.
Incorrect. A NAT Gateway allows instances in a private subnet to access the internet, but traffic would traverse the public internet, violating compliance requirements.
- E. Incorrect.
Incorrect. VPC Flow Logs provide traffic monitoring but do not ensure that traffic stays within the AWS network.