Exam AWS Certified Advanced Networking - Specialty ANS-C01 topic 1 question 51 discussion

It is A) and C) A - EC2 requires IAM role that allows write operations to Amazon SQS C - Being in private subnet, interface endpoint is required to access SQS

A and C are correct. C - VPC has no public subnet , therefore VPC interface endpoint is needed to get to SQS A- IAM roles are also needed for write operations B- Incorrect , default SG allows 0.0.0.0/0 on any port for outbound traffic from EC2 D- Incorrect, Network ACL allows 0.0.0.0/0 inbound by default E- Incorrect, Amazon SQS uses interface endpoint (privatelink), so no routes are needed in the routing table unlike Gateway Endpoints.

Option C and E - These are all on private subnets. NACL's untouched and should allow all in/outbound traffic by default. SQS being a public service, and no IGW, and you have to create the SQS endpoint, then you need to have a route for the connectivity. This makes the most sense.

a &c for correct answer!

AC are the correct answers.

For sure A and C.

Yes A & C are correct. E is incorrect as Routes are needed for gateway endpoints only.

A and C https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-sending-messages-from-vpc.html

Option A is incorrect because the EC2 instance does not need an IAM role to send messages to an Amazon SQS queue. Option B is incorrect because the default security group allows all outbound traffic. Option C is correct because there is no interface VPC endpoint configured for Amazon SQS . Option D is incorrect because the network ACL allows all inbound and outbound traffic. Option E is correct because SQS could be on a different address range and routes are not setup.

Option A is incorrect because the EC2 instance does not need an IAM role to send messages to an Amazon SQS queue. Option B is incorrect because the default security group allows all outbound traffic. Option C is correct because there is no interface VPC endpoint configured for Amazon SQS . Option D is incorrect because the network ACL allows all inbound and outbound traffic. Option E is correct because SQS could be on a different address range and routes are not setup.

A and C are correct

switching to A and C.

CD - Need VPC interface endpoint to communicate with SQS from private subnet. Default NACL will block all the inbound traffic.

BBBBBBBEEEEEEE

B, E - correct. B. The security group is blocking traffic to the IP address range used by Amazon SQS: By default, Amazon SQS uses the Amazon S3 endpoint for the region. If the default security group applied to the instance is blocking outbound traffic to the Amazon S3 endpoint, then the EC2 instance cannot send messages to the Amazon SQS queue. E. There is no route configured in the subnet route table for the IP address range used by Amazon SQS: The EC2 instance in the private subnet requires a route to the Amazon SQS endpoint. If there is no route configured in the subnet route table, then the traffic will not be able to reach the Amazon SQS service.