Topic 1 Question 279
A company uses AWS CloudFormation to deploy applications within multiple VPCs that are all attached to a transit gateway. Each VPC that sends traffic to the public internet must send the traffic through a shared services VPC. Each subnet within a VPC uses the default VPC route table, and the traffic is routed to the transit gateway. The transit gateway uses its default route table for any VPC attachment.
A security audit reveals that an Amazon EC2 instance that is deployed within a VPC can communicate with an EC2 instance that is deployed in any of the company's other VPCs. A solutions architect needs to limit the traffic between the VPCs. Each VPC must be able to communicate only with a predefined, limited set of authorized VPCs.
What should the solutions architect do to meet these requirements?
Update the network ACL of each subnet within a VPC to allow outbound traffic only to the authorized VPCs. Remove all deny rules except the default deny rule.
Update all the security groups that are used within a VPC to deny outbound traffic to security groups that are used within the unauthorized VPCs.
Create a dedicated transit gateway route table for each VPC attachment. Route traffic only to the authorized VPCs.
Update the main route table of each VPC to route traffic only to the authorized VPCs through the transit gateway.
ユーザの投票
コメント(9)
- 正解だと思う選択肢: C
C is correct. Option C suggests creating a dedicated transit gateway route table for each VPC attachment. This allows fine-grained control over the routing of traffic between VPCs. By creating separate route tables, the architect can specify the allowed routes for each VPC attachment and limit traffic to only the authorized VPCs. This approach ensures that communication between VPCs is restricted and provides a secure and controlled network environment.
👍 4gd12023/06/24 - 正解だと思う選択肢: C
Correct Answer is C
👍 2psyx212023/06/21 - 正解だと思う選択肢: C
The wording for C is bad though, if ec2 in one VPC can communicate to another EC2 in any VPC, then TGW is the one linking them together, aka TGW already has a route table.
Now, creating a new route table? so the TGW will not look at the old route table? bad wording though
👍 2nexus20202023/06/26
シャッフルモード