SOA-C03 practice question: StackSets and resource sharing (2 of 2)

Deployment, Provisioning, and Automation A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A solar installer runs a central networking account that owns a VPC with private subnets, NAT gateways and a Direct Connect connection. Application teams in other accounts in the same AWS Organization must launch their EC2 instances directly into those central subnets, while the networking team keeps sole control of routing. Which approach should a CloudOps engineer use?

Choose one answer.

A. Create a VPC peering connection from each application account's VPC to the central VPC.
B. Deploy a copy of the VPC to every application account with a CloudFormation StackSet.
C. Create IAM roles in the networking account that the application teams assume to launch instances there.
D. Share the central subnets with the application accounts by using AWS Resource Access Manager.

Show the answer and explanation

Answer: D

A. Wrong: Peering connects separate VPCs, so instances would still launch into each team's own VPC. It also does not route traffic to the central NAT gateways or Direct Connect connection. Learn more: What is VPC peering? (opens in a new tab)
B. Wrong: A StackSet would create separate VPCs in each account, each needing its own NAT gateways and connectivity. Instances would not run in the central subnets. Learn more: Managing stacks across accounts and Regions with StackSets (opens in a new tab)
C. Wrong: This would put the application teams' instances in the networking account, mixing ownership and billing. It also gives them access to the networking account itself. Learn more: IAM roles (opens in a new tab)
D. Right: Correct. VPC sharing through AWS RAM lets other accounts in the organization launch resources into the shared subnets. The owner account keeps control of route tables, gateways and the VPC itself. Learn more: Share your VPC subnets with other accounts (opens in a new tab)

Explanation

VPC sharing uses AWS RAM to share subnets with other accounts in an organization. Participants launch their own resources into the shared subnets, while the owner manages the VPC, routes and gateways. Peering and per-account VPCs keep networks separate.

SOA-C03 practice question: StackSets and resource sharing (2 of 2)

Explanation

Study

Keep practicing