Q20 — AWS SAA-C03 Ch.10

Question 20 of 100 | ← Chapter 10

Q620. A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier n the public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets.The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead.What should the solutions architect do to meet these requirements?

• A. Deploy a NAT instance in the VPC.Route all the internet-based traffic through tho NAT instance.
• B. Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet- bound traffic to the NAT gateway. ✓
• C. Configure an internet gateway and attach it to tho VPC Modify the private subnet route table to direct internet-bound traffic to the internet gateway.
• D. Configure a virtual private gateway and attach it to the VPC.Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.

Correct Answer: B. Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet- bound traffic to the NAT gateway.

Explanation

To meet the requirement of maximizing security without increasing operational overhead in the given scenario, the solutions architect should recommend the following approach:B. Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet- bound traffic to the NAT gateway.B. Deploying a NAT gateway in the public subnets and modifying the private subnet route table to direct all internet-bound traffic to the NAT gateway is the recommended approach. This setup allows the MySQL cluster in the private subnets to securely retrieve product catalog and pricing information from the third- party provider hosted on the internet.By using a NAT gateway, the outbound traffic from the private subnets is routed through the NAT gateway in the public subnets. This provides a controlled and secure communication channel for the MySQL cluster to access the internet resources without exposing the private subnets directly to the internet.Option A is not the best choice:A. Deploying a NAT instance in the VPC and routing all internet-based traffic through the NAT instance can work, but it requires the management and configuration of the NAT instance as well as regular maintenance. Using a NAT gateway is a more managed and scalable solution.Option C is not the best choice either:C. Configuring an internet gateway and attaching it to the VPC would allow direct inbound and outbound access from the private subnets to the internet, which is not desirable from a security perspective. The requirement is to maximize security.Option D is not the best choice either:D. Configuring a virtual private gateway and attaching it to the VPC is used for establishing VPN connections with an on-premises network and does not provide a solution for securely accessing internet resources from the private subnets.Therefore, the most appropriate strategy to maximize security without increasing operational overhead in this scenario is to deploy a NAT gateway in the public subnets and modify the private subnet route table to direct all internet-bound traffic to the NAT gateway (option B).