Q61 — AWS SAA-C03 Ch.10

Question 61 of 100 | ← Chapter 10

Q661. A company's website hosted on Amazon EC2 instances processes classified data stored in Amazon S3. Due to security concerns,the company requires a private and secure connection between its EC2 resources and Amazon S3,Which solution meets these requirements?

• A. Set up S3 bucket policies to allow access from a VPC endpoint ✓
• B. Set up an IAM policy to grant read-write access to the S3 bucket.
• C. Set up a NAT gateway to access resources outside the private subnet
• D. Set up an access key ID and a secret access key to access the S3 bucket

Correct Answer: A. Set up S3 bucket policies to allow access from a VPC endpoint

Explanation

To meet the requirement of having a private and secure connection between the EC2 instances and Amazon S3 for processing classified data, the solution that meets these requirements is:A. Set up S3 bucket policies to allow access from a VPC endpoint.Here's the rationale behind this solution:Option A: Set up S3 bucket policies to allow access from a VPC endpoint By setting up S3 bucket policies, specifically allowing access from a VPC endpoint, you can establish a private and secure connection between the EC2 instances and Amazon S3. A VPC endpoint allows traffic to flow directly from the VPC to S3 without traversing the public internet, enhancing security and preventing exposure of data to the public.Option B: Set up an IAM policy to grant read-write access to the S3 bucket. While an IAM policy can control access to the S3 bucket, it does not address the requirement of establishing a private and secure connection between the EC2 instances and Amazon S3. IAM policies primarily focus on managing user and resource permissions within AWS services.Option C: Set up a NAT gateway to access resources outside the private subnet. A NAT gateway is typically used for outbound internet connectivity from private subnets, and it does not establish a private connection between EC2 instances and Amazon S3. It does not directly fulfill the requirement of a private and secure connection for accessing classified data in S3.Option D: Set up an access key ID and a secret access key to access the S3 bucket. Access keys are used for programmatic access to AWS resources and are not specifically related to establishing a private and secure connection between EC2 instances and Amazon S3. They provide credentials for authentication but do not address the requirement of a private connection.Therefore, the correct solution to meet the requirement is to set up S3 bucket policies to allow access from a VPC endpoint (Option A). This ensures a private and secure connection between the EC2 instances and Amazon S3, providing the necessary security for processing classified data.