Q52 — AWS SAA-C03 Ch.15

Question 52 of 100 | ← Chapter 15

Q1152. An antivirus company wants to provide a virus scanning application for AWS account owners in the us- east-1 Region. The application runs on a group of Amazon EC2 instances in a VPC. The application receives data files on a custom TCP port, scans for viruses, and returns results to the caller.The company needs to design a scalable solution that can handle thousands of users.Which solution will meet these requirements?

• A. Register the EC2 instances that run the antivirus application in a target group that is associated with a public Application Load Balancer (ALB). Ensure that users connect to the application by using the DNS name of the ALB.
• B. Register the EC2 instances that run the antivirus application in a target group that is associated with a Network Load Balancer (NLB). Create an AWS PrivateLink endpoint service. Associate the PrivateLink endpoint with the NLB. Ensure that users connect to the application by using a PrivateLink endpoint in each user's account. ✓
• C. Attach the VPC that hosts the antivirus application to a transit gateway. Create a new VPC attachment for each user that wants to use the antivirus application. Update route tables accordingly.
• D. Use VPC peering to connect the VPC that hosts the antivirus application to the VPC of each application user. Update route tables on each side to route relevant traffic through the peering connection.

Correct Answer: B. Register the EC2 instances that run the antivirus application in a target group that is associated with a Network Load Balancer (NLB). Create an AWS PrivateLink endpoint service. Associate the PrivateLink endpoint with the NLB. Ensure that users connect to the application by using a PrivateLink endpoint in each user's account.

Explanation

To design a scalable solution for the antivirus company's application that can handle thousands of users in the us-east-1 Region, we need to consider the following requirements:The application runs on EC2 instances in a VPC.It receives data files on a custom TCP port, scans for viruses, and returns results. The solution must be scalable to handle thousands of users. The users could be in different AWS accounts or even outside AWS (though the options focus on AWS- based solutions).Key Considerations:Scalability: The solution must distribute traffic efficiently to the EC2 instances. Security: The solution should avoid exposing the application to the public internet unless necessary (though the problem does not explicitly forbid it).Ease of Use for Users: The solution should provide a simple way for users to connect to the application. Custom TCP Port: The application uses a custom TCP port, so the load balancer must support this (ALB does not support custom TCP ports; NLB does).Evaluation of Options:Option A: Register the EC2 instances in a target group associated with a public ALB. Users connect via the ALB's DNS name.Pros:ALB is highly available and scalable.Cons:ALB does not support custom TCP ports (it only supports HTTP/HTTPS, HTTP/2, and WebSockets). The application uses a custom TCP port, so this is not suitable. Exposing the application to the public internet via a public ALB may not be ideal for security (though the problem does not explicitly forbid it).Conclusion: Not suitable due to the custom TCP port requirement. Option B: Register the EC2 instances in a target group associated with an NLB. Create an AWS PrivateLink endpoint service and associate it with the NLB. Users connect via a PrivateLink endpoint in their account.Pros:NLB supports custom TCP ports, making it suitable for the application. AWS PrivateLink provides secure, private connectivity between the service and users' VPCs without traversing the public internet.Highly scalable and supports thousands of users (each user can create a PrivateLink endpoint in their own account).The service provider (antivirus company) does not need to manage VPC peering or transit gateways for each user.Cons:Slightly more complex setup initially, but this is a one-time cost for the service provider. Conclusion: This is the most scalable, secure, and user-friendly solution. Option C: Attach the VPC to a transit gateway. Create a new VPC attachment for each user. Update route tables.Pros:Provides connectivity between the service VPC and users' VPCs.Cons:Managing a transit gateway and a new attachment for each user is not scalable for thousands of users. It would become operationally complex and costly.Does not inherently support custom TCP ports (though the NLB in the service VPC could handle this, the transit gateway approach is not the right fit for this use case). Conclusion: Not suitable for thousands of users due to operational complexity. Option D: Use VPC peering to connect the service VPC to each user's VPC. Update route tables.Pros:Provides direct connectivity between VPCs.Cons:VPC peering does not scale well for thousands of users (each user would require a separate peering connection, which is not feasible).Does not inherently support custom TCP ports (though the NLB in the service VPC could handle this, the peering approach is not the right fit for this use case).Conclusion: Not suitable for thousands of users due to scalability limitations.Final Answer:B. Register the EC2 instances that run the antivirus application in a target group that is associated with a Network Load Balancer (NLB). Create an AWS PrivateLink endpoint service. Associate the PrivateLink endpoint with the NLB. Ensure that users connect to the application by using a PrivateLink endpoint in each user's account.This solution is the most scalable, secure, and user-friendly for the given requirements. It leverages the NLB's support for custom TCP ports and AWS PrivateLink for secure, private connectivity between the service and users' VPCs.