Q1 — AWS SAA-C03 Ch.17

Question 1 of 89 | ← Chapter 17

Q1301. A company deploys an API in a VPC behind a public Application Load Balancer(ALB). The company deploys a client application that needs to consume the API in a VPC that is in a second AWS account. The application is deployed in private subnets.The company wants to connect the application to the API securely. The company wants to optimize costs.Which solution will meet these requirements?

Correct Answer: A. Configure a VPC peering connection between the two VPCs. Update the route tables.

Explanation

Let's analyze each option to determine which one meets the requirements of securely connecting the client application in one VPC (in a second AWS account) to the API in another VPC behind a public ALB while optimizing costs:Option A: Configure a VPC peering connection between the two VPCs. Update the route tables. Security: VPC peering allows private communication between VPCs as if they were on the same network. Traffic between the VPCs does not traverse the public internet, which provides a secure way for the client application in the second VPC to access the API in the first VPC. Cost: VPC peering is a cost - effective solution. There are no data transfer charges for traffic between VPCs within the same AWS region when using VPC peering. The only cost is a small, one - time setup fee per peering connection.Implementation: To set up VPC peering, you create a peering connection between the two VPCs and then update the route tables in both VPCs to enable traffic flow between them. This option meets the requirement of optimizing costs while providing a secure connection. Option B: Establish an AWS Direct Connect connection between the two VPCs. Security: AWS Direct Connect provides a dedicated network connection from an on - premises location to AWS, which can be used to connect VPCs. However, in this case, both VPCs are in AWS, and using Direct Connect for this scenario is overkill. Direct Connect is more suitable for connecting on - premises data centers to AWS.Cost: AWS Direct Connect is a relatively expensive solution. It involves costs for the physical connection (such as port fees), data transfer fees, and potentially additional costs for cross - connects if using an AWS Direct Connect location. This option does not meet the requirement of optimizing costs. Option C: Deploy a NAT gateway in the application VPC. Update the route tables in the application VPC. Security: A NAT gateway is used to allow instances in a private subnet to initiate outbound traffic to the internet or other AWS services. If the client application uses a NAT gateway to access the API behind the public ALB, the traffic will traverse the public internet, which is not a secure way to connect the two VPCs. Cost: NAT gateways incur costs based on the amount of data processed and the number of hours they are running. Additionally, since the traffic will go out to the public internet, there will be data transfer costs. This option does not meet the security requirement and is not cost - optimized for this scenario. Option D: Create a transit gateway in the API account. Create transit gateway attachments in the application VPC, and configure routing.Security: A transit gateway can be used to connect multiple VPCs and on - premises networks securely. However, it is a more complex and feature - rich solution compared to VPC peering. For a simple connection between two VPCs, a transit gateway is an unnecessary over - engineering. Cost: Transit gateways have costs associated with them, including an hourly fee for the transit gateway itself and data processing charges for traffic that passes through it. This option is more expensive than VPC peering and does not offer significant advantages for this specific use case, so it does not meet the requirement of optimizing costs.Based on the above analysis, the solution that meets the requirements of securely connecting the application to the API while optimizing costs is Option A.So, the answer is A.