Q16 — AWS SAA-C03 Ch.10

Question 16 of 100 | ← Chapter 10

Q616. A solutions architect needs to ensure that API calls to Amazon DynamoDB from Amazon EC2 instances in a VPC do not traverse the internet.What should the solutions architect do to accomplish this? (Select TWO )

• A. Create a route table entry for the endpoint ✓
• B. Create a gateway endpoint for DynamoDB ✓
• C. Create a new DynamoDB table that uses the endpoint
• D. Create an ENI for the endpoint in each of the subnets of the VPC
• E. Create a security group entry in the default security group to provide access

Correct Answer: A. Create a route table entry for the endpoint, B. Create a gateway endpoint for DynamoDB

Explanation

To ensure that API calls to Amazon DynamoDB from Amazon EC2 instances in a VPC do not traverse the internet, the solutions architect should perform the following steps:A. Create a route table entry for the endpoint.B. Create a gateway endpoint for DynamoDB.A. Creating a route table entry for the endpoint allows the VPC to route the traffic destined for DynamoDB through the gateway endpoint instead of routing it over the internet. B. Creating a gateway endpoint for DynamoDB enables the EC2 instances in the VPC to directly access DynamoDB without going through the public internet. The gateway endpoint provides a secure and private connection between the VPC and DynamoDB.Option C is not the correct choice:C. Creating a new DynamoDB table that uses the endpoint is not necessary to ensure that API calls do not traverse the internet. The DynamoDB table itself does not control the network path taken by the API calls.Option D is not the correct choice either:D. Creating an ENI for the endpoint in each of the subnets of the VPC is not required to achieve the goal of preventing API calls from traversing the internet. It is the gateway endpoint that enables the direct connection, not the ENI.Option E is not the correct choice either:E. Creating a security group entry in the default security group does not directly address the requirement of preventing API calls from traversing the internet. Security group entries control inbound and outbound traffic to the EC2 instances but do not affect the network path taken by the API calls. Therefore, the correct choices to accomplish the requirement are A. Create a route table entry for the endpoint and B. Create a gateway endpoint for DynamoDB.%