Exam AWS-SysOps topic 1 question 860 discussion

Really? network ACLs?? This question needs the way to connect between S3 bucket & the EC2, not limit S3 Bucket Access that bucket policy does. A&E are correct.

A,E this is correct for access s3 from private subnet

My problem with A is that RT are per subnet, not VPC, other way default NACLs has explicit allow, also why everyone is ignoring SG, its albo possibile to allow every ec2 sgs for outbound 80 TCP traffic. IDK weird question, would be much better if there were subnets in A specifed but not VPC

A E is correct

A. Deploy a NAT gateway, and configure the route tables accordingly in the VPC where the EC2 instances are running. E. Set up a VPC endpoint in the VPC where the EC2 instances are running, and configure the route tables accordingly. Seem correct, as the connectivity between EC2 and S3 is not defined in the question. The above two shall help build that connectivity securely

A and E is correct.

Verify that the EC2 instance has connectivity to S3 endpoints. The instance must be one of the following: EC2 instance with a public IP address and a route table entry with the default route pointing to an Internet Gateway. Private EC2 instance with a default route through a NAT gateway. Private EC2 instance with connectivity to Amazon S3 using a Gateway VPC endpoint. Above info from https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-access-s3-bucket/ Therefore, A & E are correct

A&E are correct: https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-access-s3-bucket/ "Private EC2 instance with a default route through a NAT gateway. Private EC2 instance with connectivity to Amazon S3 using a Gateway VPC endpoint."

definitely BE, it says restrict public IP addresses, the way to do this is to specify an IP range using NACL. and E for VPC endpoint to the s3

I'll go with A,E

AE is correct - one keep internet connection from inside out and second is using vpc endpoint approach

B & E are correct

Ans: B & E