SOA-C02 Question 238
Single answerAn organization is running a web application hosted on Amazon EC2 instances in a private subnet within a VPC. The application needs to download security patches from an external repository hosted on the internet. For compliance reasons, the organization does not allow public internet access to its EC2 instances, even via a NAT gateway or NAT instance. Which solution should the SysOps Administrator implement to meet these requirements?
- A
Create a VPC endpoint for Systems Manager to enable secure access to the repository.
- B
Use AWS Systems Manager Session Manager to download the patches directly to the EC2 instance.
- C
Create a VPC endpoint for S3 and ensure the repository data is stored in an S3 bucket.
- D
Establish a site-to-site VPN connection between the VPC and the repository's external network.
Show answer and explanation
Correct answer: C
Explanation
The ideal solution is to use a VPC endpoint for S3 if the security patches are hosted in an S3 bucket. This allows the EC2 instances to download the patches privately without requiring public internet access, meeting compliance requirements. Other options either do not address the external repository access or are irrelevant to the scenario.
- A. Incorrect.
Incorrect. A VPC endpoint for Systems Manager facilitates secure communication for Systems Manager features but does not address downloading patches from an external internet repository.
- B. Incorrect.
Incorrect. Systems Manager Session Manager provides secure shell access to instances without requiring a public IP but does not facilitate downloading content from external sources.
- C. Correct.
Correct. Creating a VPC endpoint for S3 enables private connectivity to S3 buckets. If the security patches are hosted in an S3 bucket, this allows secure access without exposing the EC2 instances to the public internet.
- D. Incorrect.
Incorrect. A site-to-site VPN connection is used to connect on-premises networks to the AWS VPC but is unnecessary in this scenario. The requirement is to access an external repository securely without public internet access.