ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Solutions Architect - Professional SAP-C02 All Questions

View all questions & answers for the AWS Certified Solutions Architect - Professional SAP-C02 exam
Go to Exam

Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 521 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional SAP-C02
Question #: 521
Topic #: 1
[All AWS Certified Solutions Architect - Professional SAP-C02 Questions]

A company is changing the way that it handles patching of Amazon EC2 instances in its application account. The company currently patches instances over the internet by using a NAT gateway in a VPC in the application account.

The company has EC2 instances set up as a patch source repository in a dedicated private VPC in a core account. The company wants to use AWS Systems Manager Patch Manager and the patch source repository in the core account to patch the EC2 instances in the application account. The company must prevent all EC2 instances in the application account from accessing the internet.

The EC2 instances in the application account need to access Amazon S3, where the application data is stored. These EC2 instances need connectivity to Systems Manager and to the patch source repository in the private VPC in the core account.

Which solution will meet these requirements?

  • A. Create a network ACL that blocks outbound traffic on port 80. Associate the network ACL with all subnets in the application account. In the application account and the core account, deploy one EC2 instance that runs a custom VPN server. Create a VPN tunnel to access the private VPC. Update the route table in the application account.
  • B. Create private VIFs for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route table in the core account.
  • C. Create VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a VPC peering connection to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.
  • D. Create a network ACL that blocks inbound traffic on port 80. Associate the network ACL with all subnets in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.
Show Suggested Answer Hide Answer
Suggested Answer: C 🗳️
by kupo777 at July 2, 2024, 10:29 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
SIJUTHOMASP
4 months ago
Selected Answer: C
Why not B?
upvoted 1 times
...
Daniel76
7 months, 1 week ago
Selected Answer: C
Aftee delete NAT gateway theres no need to block outbound port 80. Use vpc interface endpoint to keep traffic private. https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html
upvoted 2 times
...
AzureDP900
7 months, 4 weeks ago
C is right Here's why: The company needs to prevent all EC2 instances in the application account from accessing the internet, which means they can't use a NAT gateway. They need to access Amazon S3 and Systems Manager, so creating VPC endpoints for these services is the way to go. A VPC peering connection between the two accounts will allow the EC2 instances in the application account to access the patch source repository in the core account. Updating the route tables in both accounts is necessary to ensure that traffic is properly routed.
upvoted 1 times
...
Alagong
9 months, 3 weeks ago
Selected Answer: C
answer : C
upvoted 3 times
...
kupo777
9 months, 4 weeks ago
A, D A block of Port.80 is not enough. B private VIFs is inadequate. The correct answer is C.
upvoted 3 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago