Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 142 discussion

Bad question design. None of the answers is correct. None of the answers mentions how to satisfy the requirement of "All APIs need to be called with an authenticated user". Another requirement "make the set of APIs accessible only from a VPC". "the set" doesn't mean the whole set. Here "the set" means a part of the whole set. A: The set of APIs are still publicly accessible. B: Removing DNS entry doesn't remove the public accessibility. C: This is making the whole set of APIs private. If this answer can be specific to "the set" APIs, this could be a good answer. D: Using EC2 instances is always a bad answer.

should be C as on the question has said 'no need for public IP" ==> private in API gateway = VPC endpoint

All given answers are not ideal.. the closet one is C BUT.. .when mentioning the requirement to have only 'a set of API to be private' means 'not all'.. turning the endpoint from public to private will turn all to Private ,, which is not fully correct as per the question.. I suppose the given answer or question missing an info.. or AWS starts playing with AI

https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-apis.html

Option C

Refer https://aws.amazon.com/blogs/compute/introducing-amazon-api-gateway-private-endpoints/

Answer is C as explain in https://repost.aws/knowledge-center/api-gateway-vpc-connections

Regional to Private fits the use-case

the best possible answer from all the options is C

it's C, although it begs the questions about APIs that need to stay public...

C. Update the API endpoint from Regional to private in API Gateway.

The correct answer is C. Update the API endpoint from Regional to private in API Gateway. Create an interface VPC endpoint in the VPC. Create a resource policy, and attach it to the API. Use the VPC endpoint to call the API from the VPC. This solution will meet the requirements with the least amount of effort because it utilizes the built-in features of API Gateway and VPC to restrict access to the API. With this method, no additional infrastructure or configurations are necessary. A and B are not correct because they would require additional infrastructure and configurations. D is not correct because it would require provisioning an EC2 instance and installing an Apache server, introducing additional complexity and management overhead.

C is correct