Q26 — AWS SAA-C03 Ch.11

Question 26 of 100 | ← Chapter 11

Q726. A company deploys Amazon EC2 instances that run in a VPC. The EC2 instances load source data into Amazon S3 buckets so that the data can be processed in the future. According to compliance laws, the data must not be transmitted over the public internet. Servers in the company's on-premises data center will consume the output from an application that runs on the EC2 instances.Which solution will meet these requirements?

• A. Deploy an interface VPC endpoint for Amazon EC2. Create an AWS Site-to-Site VPN connection between the company and the VPC.
• B. Deploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC. ✓
• C. Set up an AWS Transit Gateway connection from the VPC to the S3 buckets. Create an AWS Site-to- Site VPN connection between the company and the VPC.
• D. Set up proxy EC2 instances that have routes to NAT gateways. Configure the proxy EC2 instances to fetch S3 data and feed the application instances.

Correct Answer: B. Deploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC.

Explanation

To meet the requirement of not transmitting data over the public internet while allowing on-premises servers to consume the output from the EC2 instances running in a VPC, the most suitable solution is:B. Deploy a gateway VPC endpoint for Amazon S3. Set up an AWS Direct Connect connection between the on-premises network and the VPC.Option B, deploying a gateway VPC endpoint for Amazon S3 and setting up an AWS Direct Connect connection between the on-premises network and the VPC, is the recommended solution to meet the requirements:- Gateway VPC endpoint for Amazon S3: A gateway VPC endpoint enables private communication between a VPC and S3. It allows EC2 instances in the VPC to access S3 buckets without traversing the public internet.- AWS Direct Connect: AWS Direct Connect establishes a dedicated network connection between the on-premises network and the VPC. It provides a private and secure connectivity option, ensuring data does not traverse the public internet.By deploying a gateway VPC endpoint for Amazon S3, the EC2 instances can load source data into S3 buckets securely within the VPC. The gateway VPC endpoint ensures that the data does not leave the private network infrastructure.Setting up an AWS Direct Connect connection between the on-premises network and the VPC establishes a dedicated, private connection. This allows the on-premises servers to consume the output from the EC2 instances securely and directly, without transmitting data over the public internet.Option A, deploying an interface VPC endpoint for Amazon EC2 and creating an AWS Site-to-Site VPN connection between the company and the VPC, does not address the requirement of not transmitting data over the public internet. The interface VPC endpoint for Amazon EC2 is for accessing EC2 APIs, not for transferring data to S3.Option C, setting up an AWS Transit Gateway connection from the VPC to the S3 buckets and creating an AWS Site-to-Site VPN connection, is not necessary for this scenario. AWS Transit Gateway is primarily used for routing and connecting multiple VPCs and on-premises networks, and it adds unnecessary complexity for accessing S3 buckets.Option D, setting up proxy EC2 instances with NAT gateways, introduces additional complexity and overhead. It requires configuring and managing proxy instances and NAT gateways to fetch S3 data and feed the application instances, which is not the most efficient and straightforward solution for this scenario.Therefore, the solution that best meets the requirements is B: Deploy a gateway VPC endpoint for Amazon S3 and set up an AWS Direct Connect connection between the on-premises network and the VPC. This solution ensures that data is not transmitted over the public internet while allowing secure communication between the EC2 instances and the on-premises servers.