SAP-C03 practice question: Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR)
Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A car maker runs its connected-vehicle platform as about 40 microservices on Amazon EKS in a telematics account. A dealer-portal team in a separate account must call two of those services.
The platform team wants every call authorized by the caller's IAM identity rather than by network location, and the telematics services must not need code changes to enforce it. The two accounts use overlapping CIDR ranges, so the teams cannot route traffic between their VPCs by IP address.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Peer the telematics VPC with the dealer VPC, add routes between the subnets, and restrict each service with a security group that allows only the dealer account's address range.
BB. Install an open-source service mesh on the EKS cluster with a sidecar proxy in every pod, extend the mesh to the dealer account through an east-west gateway, and authorize each call with the mesh's mutual TLS service identities.
CC. Publish each service through a public Amazon API Gateway REST API, and give the dealer team API keys in a usage plan that controls how often they can call each service.
DD. Create a VPC Lattice service network with the two services, share it with the dealer account through AWS RAM, attach IAM auth policies that allow only the dealer portal's role, and have the portal sign requests with SigV4.
Show the answer and explanation
Answer: D
A. Wrong: VPC peering requires non-overlapping CIDR ranges, so the overlap blocks this design. Security groups also filter by network address and cannot check the caller's IAM identity.
B. Wrong: A mesh can authorize calls with mutual TLS identities, but those are mesh certificates rather than IAM identities. The platform team would also run the control plane and sidecars for 40 services and stretch the mesh across accounts, which goes against the low-overhead requirement.
C. Wrong: API keys identify a client application but are not IAM identities, and the traffic crosses the public internet. This design misses the identity-based authorization requirement.
D. Right: Correct. VPC Lattice connects services across VPCs and accounts without routing by IP address, so overlapping CIDR ranges do not matter. IAM auth policies check the signed caller identity on each request, so the telematics services need no code change and the platform team runs no mesh. Learn more: What is Amazon VPC Lattice? (opens in a new tab)
Explanation
The overlapping CIDR ranges rule out peering, and the IAM-identity requirement rules out security groups and API keys. VPC Lattice gives cross-account service connectivity with IAM auth policies and no mesh to run, which a self-managed mesh does not match on operational effort.
Want more on Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR)? The 5 full-length practice sets have 5 more Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →