Domain 5: Networking and Content Delivery
Explore AWS networking and content delivery concepts essential for CloudOps engineers. Understand how to design secure VPC architectures with private subnets and NAT gateways, optimize traffic routing using Route 53 latency and DNS firewall features, and implement cost-effective endpoint solutions. Gain skills to troubleshoot connectivity issues, manage hybrid network environments, and monitor network health using native AWS tools to ensure reliable application delivery.
Question 54
A company runs Linux-based application servers on Amazon EC2 instances in a private subnet across two Availability Zones. The instances must download operating system patches and reach public package repositories over IPv4, but the security team requires that the instances never accept unsolicited inbound traffic from the internet and keep only private IP addresses. The VPC already has both public subnets and private subnets. A route table for the public subnets sends 0.0.0.0/0 to an attached internet gateway.
Which design should the CloudOps engineer implement to provide the required outbound internet connectivity for the instances in the private subnets?
A. Add a route for 0.0.0.0/0 in each private-subnet route table pointing directly to the internet gateway and rely on the instances’ security groups to block inbound traffic.
B. Deploy a NAT gateway in a public subnet, associate it with an Elastic IP, and update each private-subnet route table to send 0.0.0.0/0 to the NAT gateway.
C. Create a VPC peering connection to another VPC that already has internet access and route 0.0.0.0/0 through the peering connection.
D. Modify the instances’ security groups to allow outbound HTTPS and HTTP traffic only, without changing any route tables or adding any gateway resources.
Question 55
An application in private subnets writes logs and downloads configuration files from Amazon S3. The instances currently access S3 through a NAT gateway, and the finance team wants to reduce NAT gateway data-processing charges. The security team also wants the traffic to remain on the AWS network and avoid traversing the public internet.
Which solution is the most cost-effective and operationally appropriate?
A. Create a gateway VPC endpoint for Amazon S3 and update the relevant private-subnet route tables to use the endpoint.
B. Keep using the NAT gateway because it already provides private access to Amazon S3 without public internet exposure.
C. Attach an internet gateway to the VPC and route the private subnets directly to it for S3 access.
D. Create an interface VPC endpoint for Amazon S3 as the preferred first choice for this use case.
Question 56
A company has expanded to dozens of application VPCs in a single AWS Region. The network team needs private ...