SCS-C02 Question 259
Select 3An application running in a private subnet of your VPC is unable to connect to an external third-party API over HTTPS. You have confirmed that the instance's operating system and application configuration are correct. Which of the following steps should you take to troubleshoot and resolve this issue?
- A
Check if the route table associated with the private subnet has a route to a NAT Gateway or NAT Instance.
- B
Verify that the security group attached to the instance allows outbound traffic on port 443.
- C
Ensure that an internet gateway is attached to the VPC and associated with the private subnet.
- D
Check if the Network ACL associated with the private subnet allows outbound traffic on port 443 and inbound return traffic.
- E
Inspect the endpoint policy of the AWS PrivateLink endpoint to ensure it allows HTTPS traffic to the third-party API.
Show answer and explanation
Correct answers: A, B, D
Explanation
In this scenario, the instance in the private subnet cannot access an external API. To troubleshoot, you need to ensure the network routing, security group, and Network ACL are correctly configured. A route to a NAT Gateway or NAT Instance is required for internet-bound traffic from private subnets. The security group must allow outbound traffic on port 443, and the Network ACL must support the required outbound and inbound traffic. An internet gateway and AWS PrivateLink are not relevant for resolving the issue in this specific scenario.
- A. Correct.
Correct. For instances in a private subnet to access the internet, a NAT Gateway or NAT Instance route must be configured in the route table.
- B. Correct.
Correct. Security groups control outbound traffic, and HTTPS communication requires outbound traffic on port 443.
- C. Incorrect.
Incorrect. An internet gateway is only required for public subnets. Instances in a private subnet communicate with the internet via a NAT Gateway or NAT Instance, not directly through an internet gateway.
- D. Correct.
Correct. Network ACLs must allow outbound traffic on port 443 and also allow return traffic on ephemeral ports (1024-65535).
- E. Incorrect.
Incorrect. AWS PrivateLink is not relevant in this scenario as it is used for private connections to AWS services or third-party services integrated with PrivateLink, not for general outbound internet traffic.