A security architect is reviewing an AWS environment. Applications in VPC A need to access a third-party SaaS service hosted in VPC B (owned by a different AWS account). The SaaS provider requires that traffic must not traverse the public internet. The SaaS service must be highly available, and the consumer (VPC A) must not have access to any other resources in VPC B. Which solution is the MOST secure and scalable?

Answer options:

The SaaS provider creates an AWS PrivateLink endpoint service backed by a Network Load Balancer in VPC B. The consumer creates an interface VPC endpoint in VPC A.

Set up VPC peering between VPC A and VPC B. Update route tables to direct traffic to the SaaS application instances.

Deploy an AWS Transit Gateway and attach both VPCs. Use Transit Gateway route tables to restrict access to the specific SaaS application subnets.

Create a Site-to-Site VPN connection between Virtual Private Gateways attached to VPC A and VPC B.

How to approach this question

Identify the AWS service designed specifically for secure, unidirectional SaaS service consumption across accounts.

Full Answer

A.The SaaS provider creates an AWS PrivateLink endpoint service backed by a Network Load Balancer in VPC B. The consumer creates an interface VPC endpoint in VPC A.✓ Correct

AWS PrivateLink allows you to privately access services hosted on AWS in a highly available and scalable manner, without using public IPs and without requiring the traffic to traverse the internet. It provides unidirectional access, meaning the consumer can access the service, but the provider cannot initiate connections to the consumer.

Common mistakes

Choosing VPC Peering, which provides bidirectional access to the entire VPC.

Question 14 All questions Question 16

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 5

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its AWS network architecture across 50 AWS accounts and 3 AWS ...Hard Q02A company uses AWS Organizations to manage multiple accounts. The security team mandates that no ...Medium Q03A financial institution requires a disaster recovery strategy for its critical trading applicatio...Hard Q04An enterprise is setting up a new multi-account AWS environment using AWS Control Tower. They nee...Medium Q05A company has a complex AWS environment with hundreds of linked accounts under AWS Organizations....Hard

View all 75 questions →