Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Solutions Architect - Professional · AWS
Select 2 answers.
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
After analyzing the question carefully and considering recent AWS updates (especially the support for security groups on Network Load Balancers (NLBs) introduced in August 2023), the best answer combination is: D. Check the security group for the EC2 instances to ensure it allows ingress from the clients. E. Check the security group for the NLB to ensure it allows ingress from the interface endpoint subnets.
Option A is incorrect because it focuses on communication between the NLB subnets and the logging service subnets, which is not the primary path for PrivateLink traffic.
To resolve connectivity issues between clients using VPC endpoints and the logging service: NLB Security Group (Option E): The NLB must allow traffic from the subnets where the client's interface endpoints reside. Since clients connect via PrivateLink, the NLB’s security group must permit ingress from the CIDR blocks of the client’s interface endpoint subnets. EC2 Security Group (Option C): The EC2 instances hosting the logging service must allow traffic from the NLB’s subnets. The NLB forwards traffic to the EC2 instances, and their security group must permit ingress from the NLB’s subnet CIDRs (or the NLB’s security group).