Exam AWS Certified Solutions Architect - Professional SAP-C02 topic 1 question 56 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional SAP-C02

Question #: 56
Topic #: 1

[All AWS Certified Solutions Architect - Professional SAP-C02 Questions]

An AWS customer has a web application that runs on premises. The web application fetches data from a third-party API that is behind a firewall. The third party accepts only one public CIDR block in each client’s allow list.

The customer wants to migrate their web application to the AWS Cloud. The application will be hosted on a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The ALB is located in public subnets. The EC2 instances are located in private subnets. NAT gateways provide internet access to the private subnets.

How should a solutions architect ensure that the web application can continue to call the third-party API after the migration?

A. Associate a block of customer-owned public IP addresses to the VPC. Enable public IP addressing for public subnets in the VPC.
B. Register a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC.
C. Create Elastic IP addresses from the block of customer-owned IP addresses. Assign the static Elastic IP addresses to the ALB.
D. Register a block of customer-owned public IP addresses in the AWS account. Set up AWS Global Accelerator to use Elastic IP addresses from the address block. Set the ALB as the accelerator endpoint.

Show Suggested Answer

Suggested Answer: B 🗳️

by masetromain at Jan. 14, 2023, 1:07 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

masetromain

Highly Voted 2 years, 4 months ago

Selected Answer: B

The correct solution is B. Register a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC. This will ensure that the web application can continue to call the third-party API after the migration by using the customer-owned public IP addresses that were assigned to the NAT gateways. This ensures that the third-party API will only see traffic coming from the customer-owned IP addresses that are on the allow list. Option A,C and D doesn't make sense in this context.

upvoted 20 times

...

amministrazione

Most Recent 9 months, 1 week ago

B. Register a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC.

upvoted 1 times

...

ninomfr64

1 year, 5 months ago

Selected Answer: B

In this scenario EC2 instances access the 3P APIs via NAT Gateway. 3P API FW see IP of the NAT Gateway. You can assign Elastic IP to NAT Gateway and you can allocate an IP address from a pool that you have brought to your AWS account to the Elastic IP. Thus B is correct. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

upvoted 2 times

...