Q89 — AWS SAA-C03 Ch.11

Question 89 of 100 | ← Chapter 11

Q789. A company runs a real-time data ingestion solution on AWS. The solution consists of the most recent version of Amazon Managed Streaming for Apache Kafka (Amazon MSK). The solution is deployed in a VPC in private subnets across three Availability Zones.A solutions architect needs to redesign the data ingestion solution to be publicly available over the internet.The data in transit must also be encrypted.Which solution will meet these requirements with the MOST operational efficiency?

• A. Configure public subnets in the existing VPC. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication. ✓
• B. Create a new VPC that has public subnets. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
• C. Deploy an Application Load Balancer (ALB) that uses private subnets. Configure an ALB security group inbound rule to allow inbound traffic from the VPC CIDR block for HTTPS protocol.
• D. Deploy a Network Load Balancer (NLB) that uses private subnets. Configure an NLB listener for HTTPS communication over the internet.

Correct Answer: A. Configure public subnets in the existing VPC. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.

Explanation

In this solution, the existing VPC is reconfigured with public subnets to provide direct internet connectivity. The Amazon MSK cluster is then deployed in these public subnets. By enabling mutual TLS authentication in the MSK cluster security settings, the data in transit is encrypted, ensuring secure communication between clients and the Kafka cluster.This solution offers operational efficiency by reusing the existing VPC infrastructure and making the necessary changes to allow public access. It also leverages the built-in security features of MSK, such as mutual TLS authentication, to ensure encryption of data in transit.Here's why the other options are not the most operationally efficient choices:B. Creating a new VPC with public subnets: While creating a new VPC with public subnets is a viable option, it may introduce additional complexity and management overhead. Reconfiguring the existing VPC with public subnets is a more efficient approach.C. Deploying an Application Load Balancer (ALB) in private subnets: ALBs are primarily used for HTTP/HTTPS traffic and may not be the most efficient solution for making an MSK cluster publicly available over the internet. They are not specifically designed for streaming data ingestion scenarios.D. Deploying a Network Load Balancer (NLB) in private subnets: NLBs are designed for forwarding traffic to internal resources within a private network. While they can handle high-throughput TCP/UDP traffic, they may not be the most efficient solution for making an MSK cluster publicly available over the internet.Therefore, the solution that meets the requirement with the most operational efficiency is:A. Configure public subnets in the existing VPC. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.