Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 949 discussion

C - PrivateLink exists because of its main benefit of bidirectional communication for secure access without public internet exposure. By doing this, you're restricting the SaaS provider's ability to establish sessions. Option C is misleading and just plain wrong. Option D alone is enough.

https://docs.aws.amazon.com/prescriptive-guidance/latest/integrate-third-party-services/architecture-1.html It is limited to only TCP traffic and unidirectional communication. The third-party workloads cannot initiate communication back to your account.

I think C is corret 2. Restrict Inbound Traffic via Security Groups: To prevent the third-party SaaS provider from establishing inbound connections to your VPC, use Security Groups attached to the VPC Endpoint Interface. Outbound Traffic Allowed: Ensure that your security groups allow outbound traffic to the SaaS provider’s IP ranges or endpoints. Restrict Inbound Traffic: You should block all inbound traffic on the VPC Endpoint Interface by configuring the security group rules. For example: Inbound Rules: Block all traffic (or leave it empty). Outbound Rules: Allow outbound connections to the IP addresses or ports specified by the SaaS provider.

Answer is D

D is correct