Q15 — AWS SAA-C03 Ch.16

Question 15 of 100 | ← Chapter 16

Q1215. A company has a VPC with multiple private subnets that host multiple applications. The applications must not be accessible to the internet. However, the applications need to access multiple AWS services.The applications must not use public IP addresses to access the AWS services.Which solution will meet these requirements MOST cost-effectively?

Correct Answer: A. Configure interface VPC endpoints for the required AWS services. Route traffic from the private subnets through the interface VPC endpoints.

Explanation

To meet the requirements of keeping applications in private subnets inaccessible to the internet while allowing them to access multiple AWS services without using public IP addresses, the most cost-effective solution is:A. Configure interface VPC endpoints for the required AWS services. Route traffic from the private subnets through the interface VPC endpoints.Analysis:Interface VPC Endpoints:Functionality: Interface VPC endpoints are elastic network interfaces with private IP addresses that serve as an entry point for traffic destined to supported AWS services. They enable private connectivity between your VPC and supported AWS services without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.Cost-Effectiveness: Interface VPC endpoints are charged based on data processing and data transfer costs, which are typically lower than the costs associated with NAT gateways, especially for applications that generate a significant amount of outbound traffic to AWS services. Security and Compliance: By using interface VPC endpoints, you can ensure that traffic to AWS services remains within the AWS network, enhancing security and compliance.NAT Gateway:Functionality: A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services, but prevents the internet from initiating a connection with those instances. Cost Considerations: NAT gateways incur charges for data processing and data transfer, which can become significant if the applications generate a large amount of outbound traffic. Additionally, deploying a NAT gateway in each private subnet would increase costs further. Not Required: Since the applications do not need to access the internet, using a NAT gateway is unnecessary and would not be the most cost-effective solution.Internet Gateway:Functionality: An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet. Inapplicability: Since the applications must not be accessible to the internet, deploying an internet gateway in each private subnet is not a viable solution.AWS Direct Connect:Functionality: AWS Direct Connect establishes a dedicated network connection from your premises to AWS, which can be used to access AWS services.Cost and Complexity: AWS Direct Connect involves significant setup costs and ongoing fees for the dedicated connection. It is typically used for high-bandwidth, low-latency requirements and is not necessary for accessing AWS services from private subnets within the same region. Overkill: For the requirements specified, AWS Direct Connect would be an overkill and not the most cost- effective solution.In summary, configuring interface VPC endpoints for the required AWS services and routing traffic from the private subnets through these endpoints is the most cost-effective solution that meets the company's requirements.