ANS-C01 Question 162

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  Why D Works Create an S3 gateway endpoint Traffic from the VPC (and routed via Direct Connect) goes to S3 over private IPs, never touching the public internet. Set up Route 53 Resolver inbound endpoint On-premises DNS servers forward queries for *.s3.amazonaws.com to the inbound endpoint. Applications resolve the private IP of S3 endpoint. On-premises traffic flows privately With Direct Connect and private DNS, S3 is accessed without using public IPs.

• Chose D3

  S3 Gateway endpoint supports private IP space (RFC 1918) It works over Direct Connect It does not require public IPs or NAT Route 53 Resolver inbound endpoint allows on-prem DNS servers to resolve s3.amazonaws.com to private IPs Most cost-effective and AWS-recommended hybrid pattern

• 1

  A - the key to this configuration is "...to privately access AWS resources". This would remove option B as it is setting up for a public IP addressing use. This link shows using Public and Private IP Address configurations For the Private, it is using a VPC Interface Endpoint and doesn't require the inbound Resolver endpoint.