Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 612 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Associate SAA-C03

Question #: 612
Topic #: 1

[All AWS Certified Solutions Architect - Associate SAA-C03 Questions]

A company has an application that runs on Amazon EC2 instances in a private subnet. The application needs to process sensitive information from an Amazon S3 bucket. The application must not use the internet to connect to the S3 bucket.

Which solution will meet these requirements?

A. Configure an internet gateway. Update the S3 bucket policy to allow access from the internet gateway. Update the application to use the new internet gateway.
B. Configure a VPN connection. Update the S3 bucket policy to allow access from the VPN connection. Update the application to use the new VPN connection.
C. Configure a NAT gateway. Update the S3 bucket policy to allow access from the NAT gateway. Update the application to use the new NAT gateway.
D. Configure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint.

Show Suggested Answer

Suggested Answer: D 🗳️

by nnecode at Sept. 22, 2023, 11:07 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Guru4Cloud

Highly Voted 1 year, 5 months ago

Selected Answer: D

The solution that will meet these requirements is to: Configure a VPC endpoint for Amazon S3 Update the S3 bucket policy to allow access from the VPC endpoint Update the application to use the new VPC endpoint The key reasons are: VPC endpoints allow private connectivity from VPCs to AWS services like S3 without using an internet gateway. The application can connect to S3 through the VPC endpoint while remaining in the private subnet, without internet access.

upvoted 8 times

...

1 year, 5 months ago

D is the correct...https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/what-are-vpc-endpoints.html

upvoted 1 times

...

awslearnerin2022

1 year, 5 months ago

Selected Answer: D

VPC endpoint enables communication between VPC subnet and S3 bucket.

upvoted 1 times

...

nnecode

1 year, 5 months ago

Selected Answer: D

A VPC endpoint is a managed endpoint in your VPC that is connected to a public AWS service. It provides a private connection between your VPC and the service, and it does not require an internet gateway or a NAT device. Option A (internet gateway) would involve exposing the S3 bucket to the internet, which is not recommended for security reasons. Option B (VPN connection) would require additional setup and would still involve traffic going over the internet. Option C (NAT gateway) is used for outbound internet access from private subnets, not for accessing S3 without the internet.

upvoted 4 times

...