Q85 — AWS SAA-C03 Ch.15

Question 85 of 100 | ← Chapter 15

Q1185. A solutions architect manages an Amazon DynamoDB table for a company's ecommerce application.The company's security team identifies that Amazon EC2 instances in a VPC are accessing DynamoDB through the internet. The security team expresses concern about sending and receiving data across the internet.The solutions architect must modify the DynamoDB access pattern so that data stays entirely within the Amazon network.Which solution will meet these requirements MOST cost-effectively?

• A. Create an interface VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB.
• B. Use a VPN to route all DynamoDB network traffic to the EC2 instances through the company's corporate network infrastructure.
• C. Create a gateway VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB. ✓
• D. Use a virtual private gateway to route all DynamoDB network traffic to the EC2 instances through the company's corporate network infrastructure.

Correct Answer: C. Create a gateway VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB.

Explanation

To meet the requirement of ensuring that Amazon DynamoDB access by EC2 instances within a VPC stays entirely within the Amazon network and is cost-effective, the best solution is C. Create a gateway VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB.Analysis of Options:Option A: Create an interface VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB.Limitation: While an interface VPC endpoint can be used to access DynamoDB privately, it is typically more expensive than a gateway VPC endpoint for this use case. Interface endpoints are designed for services that require a more complex network setup, such as those that use HTTP/HTTPS APIs with specific ports. DynamoDB, however, can be accessed more efficiently and cost-effectively using a gateway endpoint. Option B: Use a VPN to route all DynamoDB network traffic to the EC2 instances through the company's corporate network infrastructure.Limitation: Using a VPN to route DynamoDB traffic through the corporate network infrastructure is not cost- effective and introduces unnecessary complexity and latency. It also requires additional maintenance and security considerations, as the traffic would traverse multiple networks. Option C: Create a gateway VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB.Advantage: A gateway VPC endpoint is the most cost-effective way to enable private access to DynamoDB from within a VPC. It allows EC2 instances to communicate with DynamoDB using their private IP addresses, ensuring that the traffic stays entirely within the Amazon network. Gateway endpoints are free to use (except for data transfer costs, which are the same as internet data transfer costs but without the need for internet access) and do not require additional infrastructure or maintenance. Option D: Use a virtual private gateway to route all DynamoDB network traffic to the EC2 instances through the company's corporate network infrastructure.Limitation: Similar to Option B, using a virtual private gateway to route DynamoDB traffic through the corporate network infrastructure is not cost-effective and introduces unnecessary complexity and latency. It also requires additional security and maintenance considerations.Conclusion:C. Create a gateway VPC endpoint for DynamoDB so that the EC2 instances in the VPC use their private IP addresses to access DynamoDB. is the most cost-effective solution to meet the requirements. It ensures that DynamoDB access stays entirely within the Amazon network, providing a secure and efficient way for EC2 instances to communicate with DynamoDB.