SAP-C03 practice question: VPC design, IPAM and IPv6 dual-stack
Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A retailer runs its Amazon EKS clusters in three VPCs. Its IPv4 address space is nearly used up, and every new pod consumes an address, so the platform team cannot add capacity.
The pods call partner APIs on the internet, some reachable only over IPv4 and some only over IPv6. A legacy order service in one of the VPCs supports only IPv4 and will not change for at least a year.
No backend service may accept inbound connections from the internet, and the retailer wants to keep its NAT gateway spending to a minimum.
Which solution meets these requirements?
Choose one answer.
AA. Enable IPv6 on each VPC and send all outbound IPv6 traffic, including calls to the IPv6-only partner APIs, through the existing NAT gateways.
BB. Add a secondary IPv4 CIDR range to each VPC for new subnets, put the new pods in those public subnets with public IPv4 addresses, and route the subnets to an internet gateway for their outbound partner calls.
CC. Migrate the clusters to IPv6-only subnets, remove IPv4 from all three VPCs, and reach the IPv4 partner APIs through NAT64 and DNS64 on the NAT gateways.
DD. Create dual-stack subnets for the pods, route outbound IPv6 through an egress-only internet gateway, keep IPv4 outbound through the existing NAT gateways, and add no inbound internet routes.
Show the answer and explanation
Answer: D
A. Wrong: A NAT gateway translates IPv6 traffic only toward IPv4 destinations, through NAT64 with DNS64. It cannot carry traffic to IPv6-only partner APIs, and sending more traffic through NAT gateways raises the processing charges the retailer wants to keep down.
B. Wrong: Public addressing makes the pods reachable from the internet, which the backend services must not allow. A secondary range also adds only a fixed block of addresses, so the shortage returns as the clusters grow.
C. Wrong: IPv6-only subnets with NAT64 can reach IPv4 partners, but removing IPv4 from the VPCs breaks the legacy order service. That service supports only IPv4 and cannot change this year.
D. Right: Correct. Dual-stack subnets give the pods IPv6 addresses that do not run out, and an egress-only internet gateway allows outbound-only IPv6 traffic. IPv4 keeps working through the existing NAT gateways, and no inbound internet route is added.
Explanation
Dual-stack subnets give the pods IPv6 addresses with no shortage, an egress-only internet gateway keeps IPv6 traffic outbound-only without NAT processing charges, and IPv4 stays available for the legacy service. NAT gateways cannot reach IPv6-only destinations, public subnets allow inbound access, and IPv6-only VPCs break the legacy service.
Want more on VPC design, IPAM and IPv6 dual-stack? The 5 full-length practice sets have 5 more VPC design, IPAM and IPv6 dual-stack questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →