Network access to data sources: DEA-C01 study notes and practice questions
What to know about Network access to data sources for the DEA-C01 exam, from the Data Security and Governance domain (18% of the exam guide), then 1 free question to test it. Part of the DEA-C01 study guide.
Network questions ask how a job in a private subnet reaches its data without the internet, or why it can’t connect.
VPC endpoints
Type
Services
Notes
Gateway endpoint
S3 and DynamoDB only
A route table entry; no hourly charge; the usual answer for private S3 access
Interface endpoint (AWS PrivateLink)
Most AWS APIs: Glue, KMS, Secrets Manager, STS, CloudWatch, Kinesis, Athena and more
An ENI with a private IP in your subnet; hourly and data charges
Endpoint policies limit which buckets or actions the endpoint allows.
Bucket policies can require aws:SourceVpce or aws:SourceVpc so data is reachable only through the endpoint.
A NAT gateway gives private subnets internet access, but sends AWS traffic over the public endpoints and costs per GB; endpoints are cheaper and private.
Service specifics
Glue connections place a job’s ENIs in a subnet. The security group needs a self-referencing inbound rule (all TCP from itself), and the subnet needs a route to S3 (gateway endpoint or NAT).
Redshift enhanced VPC routing forces COPY and UNLOAD traffic through the VPC, so endpoints, security groups and flow logs apply.
Redshift can be private (no public access) and reached through Redshift-managed VPC endpoints.
Lambda in a VPC needs endpoints or NAT to call AWS services.
EMR in private subnets needs an S3 gateway endpoint and access to EMR’s service endpoints.
MSK clusters live in your subnets; clients need routes and security group access.
Security groups and NACLs
Security groups are stateful, allow-only, attached to ENIs; reference other groups instead of IPs.
NACLs are stateless and apply to subnets; return traffic needs explicit rules.
VPC Flow Logs show accepted and rejected traffic for troubleshooting.
Common traps
A NAT gateway for S3 access when a free gateway endpoint does it privately.
Missing the self-referencing rule on a Glue connection’s security group.
An interface endpoint for S3 when the question asks for no extra cost.
A property-data vendor runs an AWS Lambda function in private subnets of a VPC. The function reads raw files from an Amazon S3 bucket and calls a partner's REST API. The partner allows requests only from a fixed list of IP addresses, which it will not change.
The security team does not want the function to have a public IP address, and it wants the S3 traffic to stay on the AWS network without incurring NAT data processing charges.
Which network design meets these requirements?
Choose one answer.
AA. Create an S3 gateway endpoint for the private subnets, and route partner traffic through a NAT gateway with a fixed Elastic IP.
BB. Move the function to a public subnet with an internet gateway, and rely on the function's changing public IP for the partner's allowlist.
CC. Create an S3 interface endpoint for the private subnets, and send the partner API traffic over an AWS Site-to-Site VPN to the partner's network.
DD. Assign an Elastic IP address to the Lambda function directly, so that the partner can allowlist that address.
Show the answer and explanation
Answer: A
A. Right: Correct. The S3 gateway endpoint keeps S3 traffic on the AWS network and avoids NAT data charges for S3. Partner traffic leaves through a NAT gateway with an Elastic IP, which gives the partner one fixed address to allowlist. Learn more: Gateway endpoints for Amazon S3 (opens in a new tab)
B. Wrong: A public subnet exposes the function, and the function's public IP can change between runs, so the partner's fixed allowlist would fail. The option breaks two requirements.
C. Wrong: A VPN to the partner is a bigger change than needed, and the partner has not agreed to it. The S3 interface endpoint also carries an hourly and per-GB charge that the gateway endpoint avoids.
D. Wrong: Lambda functions do not take Elastic IP addresses, and the function reaches the internet through a NAT gateway in the VPC. The option describes a configuration that Lambda does not support.
Explanation
A gateway endpoint keeps S3 traffic private without a NAT gateway, which avoids the NAT data processing charges for S3. A fixed partner allowlist needs a stable outbound address, which a NAT gateway with an Elastic IP provides for traffic leaving the VPC. A public subnet, an interface endpoint with a VPN, and direct Elastic IP assignment each fail one requirement.
S3 traffic takes the gateway endpoint, and only the partner calls go through the NAT gateway with its fixed Elastic IP.
Want more on Network access to data sources? The 5 full-length practice sets have 9 more Network access to data sources questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →