Q87 — AWS SAA-C03 Ch.10

Question 87 of 100 | ← Chapter 10

Q687. A company has deployed an application in an AWS account. The application consists of microservices that run on AWS Lambda and Amazon Elastic Kubernetes Service (Amazon EKS). A separate team supports each microservice. The company has multiple AWS accounts and wants to give each team its own account for its microservices.A solutions architect needs to design a solution that will provide service-to-service communication over HTTPS (port 443). The solution also must provide a service registry for service discovery. Which solution will meet these requirements with the LEAST administrative overhead?

• A. Create an inspection VPC. Deploy an AWS Network Firewall firewall to the inspection VPC. Attach the inspection VPC to a new transit gateway. Route VPC-to-VPC traffic to the inspection VPC. Apply firewall rules to allow only HTTPS communication
• B. Create a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to communicate with the services. Associate those VPCs with the service network ✓
• C. Create a Network Load Balancer (NLB) with an HTTPS listener and target groups for each microservice. Create an AWS PrivateLink endpoint service for each microservice. Create an interface VPC endpoint in each VPC that needs to consume that microservice
• D. Create peering connections between VPCs that contain microservices. Create a prefix list for each service that requires a connection to a client. Create route tables to route traffic to the appropriate VPC Create security groups to allow only HTTPS communication

Correct Answer: B. Create a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to communicate with the services. Associate those VPCs with the service network

Explanation

The solution that meets the requirements with the least administrative overhead is: **B. Create a VPC Lattice service network. Associate the microservices with the service network. Define HTTPS listeners for each service. Register microservice compute resources as targets. Identify VPCs that need to communicate with the services. Associate those VPCs with the service network** Here's why: * **VPC Lattice:** VPC Lattice is a managed service that simplifies service discovery and communication between microservices across multiple VPCs. It eliminates the need for complex peering connections and manual routing configurations.* **Service Network:** The service network acts as a central hub for service discovery and communication. You can associate microservices with the network, define HTTPS listeners for each service, and register compute resources as targets.* **Simplified Communication:** VPC Lattice automatically handles routing and service discovery, making it easy for microservices to communicate with each other over HTTPS. * **Reduced Administrative Overhead:** VPC Lattice manages the underlying infrastructure, reducing the administrative burden of configuring peering connections, route tables, security groups, and other network components. **Why other options are less efficient:** * **A. Create an inspection VPC. Deploy an AWS Network Firewall firewall to the inspection VPC. Attach the inspection VPC to a new transit gateway. Route VPC-to-VPC traffic to the inspection VPC. Apply firewall rules to allow only HTTPS communication.** This approach requires significant infrastructure setup and configuration, including a dedicated inspection VPC, transit gateway, and firewall rules. It's more complex and involves more administrative overhead.* **C. Create a Network Load Balancer (NLB) with an HTTPS listener and target groups for each microservice. Create an AWS PrivateLink endpoint service for each microservice. Create an interface VPC endpoint in each VPC that needs to consume that microservice.** This solution involves creating multiple NLBs, PrivateLink endpoints, and VPC endpoints, leading to increased complexity and administrative overhead.* **D. Create peering connections between VPCs that contain microservices. Create a prefix list for each service that requires a connection to a client. Create route tables to route traffic to the appropriate VPC Create security groups to allow only HTTPS communication.** This approach requires manually configuring peering connections, prefix lists, route tables, and security groups for each microservice, which is highly manual and prone to errors. **In summary:** VPC Lattice provides the most efficient and streamlined solution for service-to-service communication over HTTPS with minimal administrative overhead.