Use VPC endpoints for S3 and Systems Manager plus VPC peering to the patch source

SAP-C02 By islever Editorial Last updated

Architect network connectivity strategies. Design a multi-account AWS environment. Determine a strategy to improve overall operational excellence.

Short answer

C Create VPC endpoints for Systems Manager and S3, delete the NAT gateway, and use VPC peering to reach the core account patch source.

Question

A company is changing the way that it handles patching of Amazon EC2 instances in its application account. The company currently patches instances over the internet by using a NAT gateway in a VPC in the application account. The company has EC2 instances set up as a patch source repository in a dedicated private VPC in a core account. The company wants to use AWS Systems Manager Patch Manager and the patch source repository in the core account to patch the EC2 instances in the application account. The company must prevent all EC2 instances in the application account from accessing the internet. The EC2 instances in the application account need to access Amazon S3, where the application data is stored. These EC2 instances need connectivity to Systems Manager and to the patch source repository in the private VPC in the core account. Which solution will meet these requirements?
  1. Create a network ACL that blocks outbound traffic on port 80. Associate the network ACL with all subnets in the application account. In the application account and the core account, deploy one EC2 instance that runs a custom VPN server. Create a VPN tunnel to access the private VPC. Update the route table in the application account.
  2. Create private VIFs for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route table in the core account.
  3. Create VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a VPC peering connection to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts. Correct Answer
  4. Create a network ACL that blocks inbound traffic on port 80. Associate the network ACL with all subnets in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.

Key Takeaways

VPC interface endpoints give instances private access to S3 and Systems Manager without any internet path, and VPC peering provides the private route to the core account's patch source instances, so the NAT gateway can be deleted entirely.

A company patches EC2 instances today through a NAT gateway to the internet and wants to switch to Systems Manager Patch Manager using a patch source repository hosted on EC2 in a dedicated private VPC in a core account. Instances in the application account must have no internet access, must reach S3, must reach Systems Manager, and must reach the patch source repository.

Common mistake: Blocking port 80 with a network ACL. A network ACL deny on a single port does not remove internet access, because traffic to other ports and to other destinations still reaches the internet, so it cannot satisfy the requirement that no instance may access the internet. Creating private VIFs also does not exist as a per-service construct for S3 and Systems Manager.

Expert Analysis

Why the Answer Is Correct

Two interface VPC endpoints are created, one for Amazon S3 and one for Systems Manager, so the application account instances reach both services over the AWS network using private addresses. Because the endpoints supply the routes to those services, the NAT gateway can be deleted, which is what actually removes the instances' internet access rather than merely filtering a port. To reach the patch source repository, a VPC peering connection gives a private path between the application VPC and the private VPC in the core account holding those EC2 instances, and the route tables in both accounts direct the patch traffic over the peering connection. That satisfies all three connectivity requirements with no internet exposure.

Why the Other Options Are Wrong

A: A network ACL blocking outbound port 80 does not eliminate internet access, since other outbound ports and destinations remain open, and deploying custom VPN servers in both accounts introduces a network appliance the company has to operate when VPC connectivity is already available. D: Blocking inbound port 80 is even less relevant, because the patching flow is outbound from the instances, so an inbound deny does not stop the instances from reaching the internet, and it also relies on a transit gateway where a peering connection is the simpler match. B: Private VIFs are a Direct Connect construct for linking an on-premises network, not a per-service endpoint for S3 and Systems Manager, so the described private VIFs for those two services do not exist, and a transit gateway is unnecessary for reaching a single peer VPC.

Community Comment Notes

The community voted 100 to 0 for C, and the top-voted comment explained that once the NAT gateway is deleted there is no need to block port 80 at all, because the VPC interface endpoints keep the traffic private, and linked the Systems Manager documentation on creating a VPC endpoint. Another commenter enumerated the other options' failures, that blocking a port is not sufficient and that private VIFs is the wrong mechanism.

Official Reference

https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.htm

This link opens the official vendor documentation in a new tab.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. kupo777 👍 3
    A, D A block of Port.80 is not enough. B private VIFs is inadequate. The correct answer is C.
  2. Daniel76 👍 2 Answered C
    Aftee delete NAT gateway theres no need to block outbound port 80. Use vpc interface endpoint to keep traffic private. https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html
  3. AzureDP900 👍 1
    C is right Here's why: The company needs to prevent all EC2 instances in the application account from accessing the internet, which means they can't use a NAT gateway. They need to access Amazon S3 and Systems Manager, so creating VPC endpoints for these services is the way to go. A VPC peering connection between the two accounts will allow the EC2 instances in the application account to access the patch source repository in the core account. Updating the route tables in both accounts is necessary to ensure that traffic is properly routed.
  4. Alagong 👍 3 Answered C
    answer : C
  5. SIJUTHOMASP 👍 1 Answered C
    Why not B?

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide