AWS Certified Advanced Networking - Specialty ANS-C01Demo

By Amazon · Question Mode

QuestionQ48

Network Security, Compliance, and Governance

A software-as-a-service (SaaS) provider runs its solution on Amazon EC2 instances in a VPC in the AWS Cloud. Every provider customer also has an environment in the AWS Cloud.

A recent design meeting determined that customer IP address ranges overlap the provider's AWS deployment. The customers have said they will not disclose their internal IP addresses and do not want to access the provider's SaaS service through the internet.

Which combination of steps is included in a solution that fulfills these requirements?

Choose two
  • A Deploy the SaaS service endpoint behind a Network Load Balancer.
  • B Configure an endpoint service, and grant the customers permission to create a connection to the endpoint service.
  • C Deploy the SaaS service endpoint behind an Application Load Balancer.
  • D Configure a VPC peering connection to the customer VPCs. Route traffic through NAT gateways.
  • E Deploy an AWS Transit Gateway, and connect the SaaS VPC to it. Share the transit gateway with the customers. Configure routing on the transit gateway.
Explanation

AWS PrivateLink provides private connectivity to a service without VPC-to-VPC routing and supports overlapping IP address ranges. The service provider places the service behind a Network Load Balancer, creates an endpoint service from it, and grants the customer AWS principals permission to create interface endpoints to that endpoint service.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!