Enabling Public Access for Amazon MSK with Operational Efficiency

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

A Configure public subnets in the existing VPC and enable mutual TLS authentication on the MSK cluster to meet public access and encryption requirements efficiently.

Question

A company runs a real-time data ingestion solution on AWS. The solution consists of the most recent version of Amazon Managed Streaming for Apache Kafka (Amazon MSK). The solution is deployed in a VPC in private subnets across three Availability Zones. A solutions architect needs to redesign the data ingestion solution to be publicly available over the internet. The data in transit must also be encrypted. Which solution will meet these requirements with the MOST operational efficiency?
  1. Configure public subnets in the existing VPC. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication. Correct Answer
  2. Create a new VPC that has public subnets. Deploy an MSK cluster in the public subnets. Update the MSK cluster security settings to enable mutual TLS authentication.
  3. Deploy an Application Load Balancer (ALB) that uses private subnets. Configure an ALB security group inbound rule to allow inbound traffic from the VPC CIDR block for HTTPS protocol.
  4. Deploy a Network Load Balancer (NLB) that uses private subnets. Configure an NLB listener for HTTPS communication over the internet.

Key Takeaways

The exam tests the prerequisite that MSK clusters require public subnets to accept internet traffic, distinguishing this from generic load balancer patterns.

This question explores how to securely expose an Amazon MSK cluster to the internet while maintaining data encryption. The correct approach leverages native MSK capabilities to allow public connectivity via specific subnet configurations.

Common mistake: Candidates often select NLB or ALB options (C/D) assuming a standard web architecture, failing to recognize that MSK handles its own client connections directly and does not sit behind a traditional Layer 7 load balancer for client ingress.

Expert Analysis

Why the Answer Is Correct

Amazon MSK natively supports public access when the broker instances are placed in public subnets and security settings like mTLS or SASL are enabled. Option A correctly identifies that moving the existing cluster to public subnets within the current VPC is the most operationally efficient path compared to creating a new infrastructure.

Why the Other Options Are Wrong

Options C and D suggest using ALB or NLB, but MSK clients connect directly to brokers; placing them behind a load balancer adds unnecessary complexity and cost without being the standard design for raw Kafka ingestion. Option B suggests creating a new VPC, which violates the "most operational efficiency" requirement by introducing cross-VPC peering or migration overhead.

Community Comment Notes

Community consensus strongly favors A, noting that Kafka handles its own load balancing internally. As user MatAlves noted, AWS documentation confirms that enabling public access requires the cluster to be associated with public subnets. Users also correctly pointed out that creating a new VPC (Option B) is inefficient compared to reconfiguring the existing one.

Official Reference

https://docs.aws.amazon.com/msk/latest/developerguide/msk-access.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always look for 'operational efficiency' as a key discriminator. If you can achieve the goal by modifying the existing resource's configuration rather than building new infrastructure, that is usually the correct answer.

Frequently Asked Questions

Can I use an NLB to expose MSK to the internet?

No, MSK is designed to handle client connections directly. Using an NLB adds complexity and cost without providing the necessary functionality for Kafka protocol handling.

Why is creating a new VPC not the best choice?

Creating a new VPC requires additional setup like VPC peering and route table updates, which reduces operational efficiency compared to simply changing the subnet type of the existing cluster.

More SAA-C03 FAQ →

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. haci 👍 11 Answered A
    Since we are talking about real-time data (UDP packets) ALB is not a viable solution. You don't need to listen HTTPS, so D is eliminated. If you create a new VPC, you must create link between the old one and this is not mentioned in B. So It is A for me.
  2. MatAlves 👍 4 Answered A
    "You can turn on public access to an MSK cluster at no additional cost... To turn on public access to a cluster, first ensure that the cluster meets all of the following conditions: - The subnets that are associated with the cluster must be public. - Unauthenticated access control must be off and at least one of the following access-control methods must be on: SASL/IAM, SASL/SCRAM, mTLS. - ..." https://docs.aws.amazon.com/msk/latest/developerguide/public-access.html
  3. Marunio 👍 3 Answered A
    A, since Kafka is loadbalancing itself. - https://dattell.com/data-architecture-blog/load-balancing-with-kafka/#:~:text=Load%20balancing%20with%20Kafka%20is,partitions%20while%20preserving%20message%20ordering. B - why create new VPC? C / D - Kafka is loadbalacing itself, also NLB can't handle HTTPS.
  4. Dantecito 👍 1 Answered D
    D. NLB forward traffic from the internet to private subnet where the cluster is. MSK use layer 4. A. B. use public subnets exposing the cluster C. Similar to D but MSK requires a Layer 4.
  5. FlyingHawk 👍 1 Answered A
    For MSK to get public access, you must associate it with a public subnet, so rule out C and D, B is to create a new VPC, which is more complicated and more operations, so A is correct.
Show 3 more comments
  1. Scheldon 👍 1 Answered A
    AnswerA I need to agree that answer will probably be Option A.
  2. Andy_09 👍 4
    Option A
  3. Indrasis 👍 2 Answered A
    A is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide