Exam ANS-C00 All Questions

View all questions & answers for the ANS-C00 exam

Exam ANS-C00 topic 1 question 170 discussion

Exam question from Amazon's ANS-C00

Question #: 170
Topic #: 1

Your company is expanding its cloud infrastructure and moving many of its flat files and static assets to S3. You currently use a VPN to access your compute infrastructure, but you require more reliability for your static files as you are offloading all of your important data to AWS. What is your best course of action while keeping costs low?

A. Create a Direct Connect connection using a Private VIF to access both compute and S3 resources.
B. Create an S3 endpoint and create a route to the endpoint prefix list for your VPN to allow access to your S3 resources.
C. Create two Direct Connect connections. Each connected to a Private VIF to ensure maximum resiliency.
D. Create a Direct Connect connection using a Public VIF and route your VPN over the DX connection to your VPN endpoint.

Show Suggested Answer

Suggested Answer: D 🗳️
An S3 endpoint cannot be used with a VPN. A Private VIF cannot access S3 resources. A Public VIF with a VPN will ensure security for your compute resources and access to your S3 resources. Two DX connections are very expensive and a Private VIF still won't allow access to your S3 resources.

by Vlan at March 8, 2021, 9:10 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Vlan

Highly Voted 3 years, 9 months ago

Public VIF is a prerequisite so I go with D

upvoted 8 times

vnsuk

3 years, 8 months ago

D not low cost

upvoted 1 times

mazayi

3 years, 8 months ago

The key requirement is "reliability" though... VPN by itself is not reliable hence the best solution for reliability would be to put the VPN on top of a DX

upvoted 1 times

...

arhelp

Most Recent 1 year, 5 months ago

Answer is B. You don't need a DX to connect to S3 endpoints. Use VPC endpoints for S3 and DynamoDB.

upvoted 1 times

...

slackbot

2 years, 2 months ago

at the time of this question writing - D. currently - B, for S3 now supports VPC interface endpoint, which is routable from outside the VPC

upvoted 1 times

...

ChauPhan

3 years, 8 months ago

but you require more reliability for your static files as you are offloading all of your important data to AWS => D

upvoted 1 times

ChauPhan

3 years, 8 months ago

A. S3 need Public VIF B. We need S3 Private Link = S3 interface endpoint, usually S3 is gateway endpoint. C. Expensive and Private VIF so can't use for S3

upvoted 1 times

...

dev62

3 years, 9 months ago

Why not B. As interface endpoint can be accessed via VPN / DX.

upvoted 2 times

JamesTR

3 years, 9 months ago

Because Interface Endpoint for S3 was just introduced in Feb 2021. I suspect that B refers to old Gateway endpoints for Amazon S3 which is NOT accessible via DX. https://aws.amazon.com/about-aws/whats-new/2021/02/amazon-s3-now-supports-aws-privatelink/

upvoted 3 times

wahlbergusa

3 years, 8 months ago

B is referring to Gateway Endpoint because it mentions prefix list which is the method Gateway Endpoint uses. Interface Endpoints use DNS resolution to steer the traffic. Hence B is not correct.

upvoted 5 times

sapien45

3 years, 4 months ago

thank you, Interface endpoint leverage use an DNS hostname, not prefix list https://docs.aws.amazon.com/vpc/latest/privatelink/vpce-interface.html Answer : D

upvoted 1 times

...