SOA-C03 practice question: VPC endpoints, PrivateLink and peering (2 of 2)

Networking and Content Delivery A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A pet insurer created an interface VPC endpoint for AWS Secrets Manager in its application VPC and selected the option to turn on private DNS. Flow logs and NAT gateway metrics show that application calls to secretsmanager.us-east-1.amazonaws.com still leave through the NAT gateway. The endpoint's security group allows HTTPS from the application subnets. The VPC was created years ago with a custom configuration. What is the MOST likely cause?

Choose one answer.

A. Interface endpoints for Secrets Manager accept traffic only from Lambda functions, so EC2 instances keep using the public endpoint.
B. The application subnets need a route to the interface endpoint, because interface endpoints are reached through route table entries.
C. The endpoint policy is missing, so Secrets Manager rejects private requests and the SDK retries through the public endpoint.
D. The VPC's enableDnsSupport or enableDnsHostnames attribute is turned off, so the private hosted zone for the endpoint is not used.

Show the answer and explanation

Answer: D

A. Wrong: Interface endpoints accept traffic from any resource in the VPC that can reach their network interfaces. There is no restriction to Lambda functions. Learn more: Access an AWS service using an interface VPC endpoint (opens in a new tab)
B. Wrong: Interface endpoints are elastic network interfaces with private IP addresses in the subnets. They are reached through the local route, so no route table entry is needed. Learn more: Configure route tables (opens in a new tab)
C. Wrong: Endpoints get a default policy that allows full access when no custom policy is set. SDKs do not fall back to the public endpoint after a denial. Learn more: Access an AWS service using an interface VPC endpoint (opens in a new tab)
D. Right: Correct. Private DNS for interface endpoints requires both VPC DNS attributes to be true. If either is off, the service name keeps resolving to public addresses, and traffic follows the default route to the NAT gateway. Learn more: Access an AWS service using an interface VPC endpoint (opens in a new tab)

Explanation

Interface endpoints with private DNS make the normal service name resolve to the endpoint's private addresses, but only when the VPC's enableDnsSupport and enableDnsHostnames attributes are both true. Older or custom VPCs sometimes have them off, so names resolve publicly and traffic uses the NAT gateway. Checking DNS resolution from an instance quickly confirms the cause.

SOA-C03 practice question: VPC endpoints, PrivateLink and peering (2 of 2)

Explanation

Study

Keep practicing