ANS-C01 practice question 20 of 35

A company is using a NAT gateway to allow internet connectivity for private subnets in a VPC in the us-west-2 Region. After a security audit, the…

A company is using a NAT gateway to allow internet connectivity for private subnets in a VPC in the us-west-2 Region. After a security audit, the company needs to remove the NAT gateway. In the private subnets, the company has resources that use the unified Amazon CloudWatch agent. A network engineer must create a solution to ensure that the unified CloudWatch agent continues to work after the removal of the NAT gateway. Which combination of steps should the network engineer take to meet these requirements? (Choose three.)

Answer options

A: Validate that private DNS is enabled on the VPC by setting the enableDnsHostnames VPC attribute and the enableDnsSupport VPC attribute to true. Correct answer

B: Create a new security group with an entry to allow outbound traffic that uses the TCP protocol on port 443 to destination 0.0.0.0/0

C: Create a new security group with entries to allow inbound traffic that uses the TCP protocol on port 443 from the IP prefixes of the private subnets. Correct answer

D: Create the following interface VPC endpoints in the VPC: com.amazonaws.us-west-2.logs and com.amazonaws.us-west-2.monitoring. Associate the new security group with the endpoint network interfaces. Correct answer

E: Create the following interface VPC endpoint in the VPC: com.amazonaws.us-west-2.cloudwatch. Associate the new security group with the endpoint network interfaces.

F: Associate the VPC endpoint or endpoints with route tables that the private subnets use.

Correct Answer:

A. Validate that private DNS is enabled on the VPC by setting the enableDnsHostnames VPC attribute and the enableDnsSupport VPC attribute to true.; C. Create a new security group with entries to allow inbound traffic that uses the TCP protocol on port 443 from the IP prefixes of the private subnets.; D. Create the following interface VPC endpoints in the VPC: com.amazonaws.us-west-2.logs and com.amazonaws.us-west-2.monitoring. Associate the new security group with the endpoint network interfaces.

Explanation

After removing the NAT gateway, the CloudWatch agent can communicate privately by using interface VPC endpoints.
1. Ensure VPC DNS hostnames/support are enabled so that endpoints are resolved (A).
2. Create interface endpoints com.amazonaws.us-west-2.logs and com.amazonaws.us-west-2.monitoring and attach a security group that allows inbound TCP 443 from the private-subnet CIDR ranges (D, C). No route-table updates are needed for interface endpoints.

Why Incorrect

B – Outbound rules on a new security group are not required; instances already initiate traffic. E – Service name com.amazonaws.region.cloudwatch does not exist; Logs and Monitoring endpoints are required. F – Interface endpoints do not require route-table association; routing is through the local subnet.

References

1. Amazon CloudWatch User Guide – “Interface VPC endpoints (AWS PrivateLink)” → Table 1: Required endpoints (logs, monitoring).

2. VPC User Guide – “Gateway and interface endpoints” → “Interface endpoint routing”.

3. VPC User Guide – “VPC DNS attributes enableDnsHostnames and enableDnsSupport” (2024-03-12).

4. AWS Security Blog, “Securing CloudWatch agent traffic with VPC interface endpoints”, 2022-08-18, steps 1-3.

Keep practicing

Take the free ANS-C01 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test