SAP-C02 Question 242
Select 3A company is building a hybrid architecture where their on-premises applications need to communicate with AWS services over a private connection without traversing the internet. They are concerned about security and want to ensure that the communication to AWS services remains private and does not require a public IP address. Which of the following options will meet this requirement?
- A
Use AWS PrivateLink to create interface endpoints for the required AWS services.
- B
Configure a VPC endpoint gateway for AWS services that support it, such as Amazon S3 or DynamoDB.
- C
Use public AWS service endpoints with an IP whitelist for the on-premises network.
- D
Enable AWS Direct Connect with a private virtual interface (VIF) to access AWS private IP ranges.
- E
Create a Site-to-Site VPN connection and route traffic to public AWS service endpoints.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure private communication between on-premises applications and AWS services, you can use AWS PrivateLink to create interface endpoints, VPC gateway endpoints for supported services, or AWS Direct Connect with a private virtual interface. These options route traffic over AWS's private network or a dedicated private connection, avoiding the need for public IP addresses and maintaining security. Public AWS service endpoints and Site-to-Site VPN connections do not meet the requirement as they require routing traffic over the internet.
- A. Correct.
Correct. AWS PrivateLink provides interface endpoints that allow private communication between an on-premises environment and AWS services over AWS's private network.
- B. Correct.
Correct. Gateway endpoints allow private access to AWS services like Amazon S3 and DynamoDB without requiring public IP addresses.
- C. Incorrect.
Incorrect. Public AWS service endpoints require internet access and a public IP address, which does not meet the requirement of keeping the communication private.
- D. Correct.
Correct. AWS Direct Connect with a private VIF provides dedicated private connectivity between on-premises infrastructure and AWS, allowing access to AWS private IP ranges.
- E. Incorrect.
Incorrect. A Site-to-Site VPN connection routes traffic over the internet to AWS public endpoints, which does not meet the requirement of private communication.