Q70 — AWS SAA-C03 Ch.13

Question 70 of 100 | ← Chapter 13

Q970. A company is deploying a new web application on AWS in a VPC. The application needs to have secure and controlled access to Amazon DynamoDB to store application data.The application runs on multiple Amazon EC2 instances that are in multiple Availability Zones in the VPC. The company wants to design a solution to allow the EC2 instances to securely access the DynamoDB tables without traversing the public internet.Which solution will meet these requirements with the LEAST overhead? (Select TWO.)

Correct Answer: A. Create an IAM role that has permission to access the DynamoDB tables.Associate the role with the EC2 instances., E. Use VPC endpoints for DynamoDB to allow private network traffic between the EC2 instances and DynamoDB.

Explanation

The correct answers are:A. Create an IAM role that has permission to access the DynamoDB tables. Associate the role with the EC2 instances.E. Use VPC endpoints for DynamoDB to allow private network traffic between the EC2 instances and DynamoDB.Explanation:A. Create an IAM role that has permission to access the DynamoDB tables. Associate the role with the EC2 instances.- This is the recommended approach as it allows the EC2 instances to access the DynamoDB tables without the need to store and manage credentials on the instances.- By associating the IAM role with the EC2 instances, the application running on the instances can use the role's permissions to access DynamoDB.B. Store IAM user access keys in environment variables on the EC2 instances. Configure the application to use the access keys to access DynamoDB.- This is not a recommended solution, as it requires managing and storing sensitive credentials (access keys) on the EC2 instances, which can be a security risk.C. Enable encryption at rest for DynamoDB by using AWS Key Management Service (AWS KMS).Configure the EC2 instances to use AWS KMS encryption.- This solution addresses the encryption of data at rest in DynamoDB, but does not provide a mechanism for the EC2 instances to securely access DynamoDB.D. Configure the application on the EC2 instances to use the AWS Security Token Service (AWS STS) AssumeRole API to assume an IAM role that grants access to the DynamoDB tables.- This is a valid solution, as it allows the EC2 instances to temporarily assume an IAM role with the necessary permissions to access DynamoDB.- However, it may have slightly more overhead compared to the IAM role approach in option A, as it requires additional API calls to the AWS STS service.E. Use VPC endpoints for DynamoDB to allow private network traffic between the EC2 instances and DynamoDB.- This is an essential part of the solution, as it allows the EC2 instances to access DynamoDB over a private network connection, without traversing the public internet.- This, combined with the IAM role approach in option A, provides a secure and low-overhead solution for the application to access DynamoDB.In summary, the two best solutions are A (IAM role) and E (VPC endpoints for DynamoDB), as they provide a secure and low-overhead way for the EC2 instances to access the DynamoDB tables.