Q78 — AWS SAA-C03 Ch.11

Question 78 of 100 | ← Chapter 11

Q778. A solutions architect creates a VPC that includes two public subnets and two private subnets. A corporate security mandate requires the solutions architect to launch all Amazon EC2 instances in a private subnet. However, when the solutions architect launches an EC2 instance that runs a web server on ports 80 and 443 in a private subnet, no external internet traffic can connect to the server.What should the solutions architect do to resolve this issue?

Correct Answer: B. Provision an internet-facing Application Load Balancer (ALB) in a public subnet. Add the EC2 instance to the target group that is associated with the ALEnsure that the DNS record for the website resolves to the ALB.

Explanation

To resolve the issue of external internet traffic not being able to connect to the web server running on ports 80 and 443 in a private subnet, the following solution can be implemented:B. Provision an internet-facing Application Load Balancer (ALB) in a public subnet. Add the EC2 instance to the target group that is associated with the ALB. Ensure that the DNS record for the website resolves to the ALB.\1. Provision an internet-facing Application Load Balancer (ALB) in a public subnet: By creating an ALB in a public subnet, the load balancer will have a public IP address and be accessible from the internet.\2. Add the EC2 instance to the target group that is associated with the ALB: By adding the EC2 instance running the web server to the target group of the ALB, the ALB can forward incoming traffic to the EC2 instance.\3. Ensure that the DNS record for the website resolves to the ALB: Update the DNS record for the website to point to the public IP address or DNS name of the ALB. This allows external internet traffic to reach the ALB, which will then distribute the traffic to the EC2 instance.Here's why the other options are not the most suitable choices:A. Attach the EC2 instance to an Auto Scaling group in a private subnet. Ensure that the DNS record for the website resolves to the Auto Scaling group identifier:Attaching the EC2 instance to an Auto Scaling group in a private subnet does not directly address the issue of external internet traffic being unable to connect to the web server. Auto Scaling groups are typically used for managing the scaling of EC2 instances and not for enabling internet connectivity.C. Launch a NAT gateway in a private subnet. Update the route table for the private subnets to add a default route to the NAT gateway. Attach a public Elastic IP address to the NAT gateway:A NAT gateway is used to allow private subnets to access the internet, but it does not enable external internet traffic to connect to resources in a private subnet. It is not designed to provide inbound connectivity to EC2 instances running in a private subnet.D. Ensure that the security group that is attached to the EC2 instance allows HTTP traffic on port 80 and HTTPS traffic on port 443. Ensure that the DNS record for the website resolves to the public IP address of the EC2 instance:Allowing inbound traffic on port 80 and 443 in the security group attached to the EC2 instance alone will not enable external internet traffic to reach the instance. Since the EC2 instance is in a private subnet, it does not have direct internet connectivity. The solution requires a component like an ALB in a public subnet to act as a gateway between the internet and the private subnet.Therefore, the most suitable solution to resolve the issue and allow external internet traffic to connect to the web server running on ports 80 and 443 in a private subnet is:B. Provision an internet-facing Application Load Balancer (ALB) in a public subnet. Add the EC2 instance to the target group that is associated with the ALB. Ensure that the DNS record for the website resolves to the ALB.