Exam AWS Certified SysOps Administrator - Associate topic 1 question 156 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate

Question #: 156
Topic #: 1

[All AWS Certified SysOps Administrator - Associate Questions]

A company wants to use only IPv6 for all its Amazon EC2 instances. The EC2 instances must not be accessible from the internet, but the EC2 instances must be able to access the internet. The company creates a dual-stack VPC and IPv6-only subnets.

How should a SysOps administrator configure the VPC to meet these requirements?

A. Create and attach a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.
B. Create and attach an internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway. Attach the custom route table to the IPv6-only subnets.
C. Create and attach an egress-only internet gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the egress-only internet gateway. Attach the custom route table to the IPv6-only subnets.
D. Create and attach an internet gateway and a NAT gateway. Create a custom route table that includes an entry to point all IPv6 traffic to the internet gateway and all IPv4 traffic to the NAT gateway. Attach the custom route table to the IPv6-only subnets.

Show Suggested Answer

Suggested Answer: C 🗳️

by Liongeek at Nov. 16, 2022, 8:25 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Rabbit117

9 months, 3 weeks ago

Selected Answer: C

IPv6 address are public by default therefor they are accessible from the internet. If you want an IPv6 instance to have access to the internet but not accessible from the internet you should use an IPv6 egress-only internet gateway. Then add a route in the route table to point internet traffic, ::/0 to the egress-only internet gateway. https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html

upvoted 2 times

...

jipark

1 year, 4 months ago

Selected Answer: C

IPv6 only (egress) : Internet G/W IPv4 only (ingress) : NAT G/w

upvoted 3 times

...

Christina666

1 year, 5 months ago

Selected Answer: C

Egress-only internet gateway basics IPv6 addresses are globally unique, and are therefore public by default. If you want your instance to be able to access the internet, but you want to prevent resources on the internet from initiating communication with your instance, you can use an egress-only internet gateway. To do this, create an egress-only internet gateway in your VPC, and then add a route to your route table that points all IPv6 traffic (::/0) or a specific range of IPv6 address to the egress-only internet gateway. IPv6 traffic in the subnet that's associated with the route table is routed to the egress-only internet gateway. An egress-only internet gateway is stateful: it forwards traffic from the instances in the subnet to the internet or other AWS services, and then sends the response back to the instances.

upvoted 4 times

...