Amazon Exam SAP-C02 Topic 1 Question 43 Discussion

Actual exam question for Amazon's SAP-C02 exam

Question #: 43
Topic #: 1

A company has implemented a new security requirement According to the new requirement, the company must scan all traffic from corporate AWS instances in the company's VPC for violations of the company's security policies. As a result of these scans the company can block access to and from specific IP addresses.

To meet the new requirement, the company deploys a set of Amazon EC2 instances in private subnets to serve as transparent proxies The company installs approved proxy server software on these EC2 instances The company modifies the route tables on all subnets to use the corresponding EC2 instances with proxy software as the default route The company also creates security groups that are compliant with the security policies and assigns these security groups to the EC2 instances

Despite these configurations, the traffic of the EC2 instances in their private subnets is not being properly forwarded to the internet.

What should a solutions architect do to resolve this issue?

ADisable source'destination checks on the EC2 instances that run the proxy software

BAdd a rule to the security group that is assigned to the proxy EC2 instances to allow all traffic between instances that have this security group Assign this security group to all EC2 instances in the VPC.

CChange the VPC's DHCP options set Set the DNS server options to point to the addresses of the proxy EC2 instances

DAssign one additional elastic network interface to each proxy EC2 instance Ensure that one of these network interfaces has a route to the private subnets Ensure that the other network interface has a route to the internet.

Show Suggested Answer

Suggested Answer: A

Identify Proxy EC2 Instances:

Determine which EC2 instances in the private subnets are running the proxy server software.

Disable Source/Destination Checks:

For each of these EC2 instances, go to the AWS Management Console.

Navigate to the EC2 dashboard, select the instance, and choose 'Actions' > 'Networking' > 'Change Source/Dest. Check'.

Disable the source/destination check for these instances.

Disabling source/destination checks allows the EC2 instances to route traffic appropriately, enabling them to function as network appliances or proxies. This ensures that traffic from other instances in the private subnets can be routed through the proxy instances to the internet, meeting the company's security requirements.

Reference

Amazon EC2 User Guide on Source/Destination Checks

by Chaya at Sep 16, 2024, 10:51 PM

Limited Time Offer

25%

Off

Get Premium SAP-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

2 months ago

Hmm, adding a rule to the security group to allow all traffic seems a bit risky. I'd prefer a more targeted approach like option D.

upvoted 0 times

Sang

24 days ago

Yeah, option D with additional network interfaces seems like a safer bet.

upvoted 0 times

...

Samira

25 days ago

I think option D is the best choice to ensure proper forwarding of traffic.

upvoted 0 times

...

Kasandra

1 months ago

I agree, option D seems like a more secure solution.

upvoted 0 times

...

3 months ago

Option A seems like the way to go. Disabling source/destination checks should allow the traffic to flow properly through the proxy instances.

upvoted 0 times

Teresita

2 months ago

D) Assign one additional elastic network interface to each proxy EC2 instance Ensure that one of these network interfaces has a route to the private subnets Ensure that the other network interface has a route to the internet.

upvoted 0 times

...