Publish on-premises TCP services to AWS customers through a PrivateLink endpoint service

SAP-C02 By islever Editorial Last updated

Architect network connectivity strategies. Design reliable and resilient architectures.

Short answer

A Create a VPC endpoint service for TCP traffic behind a Network Load Balancer and make it reachable over Direct Connect.

Question

A company has many services running in its on-premises data center. The data center is connected to AWS using AWS Direct Connect (DX) and an IPSec VPN. The service data is sensitive and connectivity cannot traverse the internet. The company wants to expand into a new market segment and begin offering its services to other companies that are using AWS. Which solution will meet these requirements?
  1. Create a VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer, and make the service available over DX. Correct Answer
  2. Create a VPC Endpoint Service that accepts HTTP or HTTPS traffic, host it behind an Application Load Balancer, and make the service available over DX.
  3. Attach an internet gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.
  4. Attach a NAT gateway to the VPC, and ensure that network access control and security group rules allow the relevant inbound and outbound traffic.

Key Takeaways

A VPC endpoint service is fronted by a Network Load Balancer, so endpoint service consumers on AWS reach the on-premises application over the private Direct Connect path rather than the public internet.

Sensitive on-premises services must be offered to other companies that use AWS, and the traffic may not cross the internet. The existing Direct Connect and IPSec VPN path already provides private reachability into the VPC.

Common mistake: Trying to front the endpoint service with an Application Load Balancer. PrivateLink endpoint services require a Network Load Balancer or a Gateway Load Balancer, because the NLB operates at layer 4 and supports the TCP and TLS protocols the endpoint expects.

Expert Analysis

Why the Answer Is Correct

A VPC endpoint service backed by a Network Load Balancer publishes the on-premises service to AWS customers through PrivateLink. Because the VPC is already reachable over Direct Connect and the VPN, consumer traffic stays on the private network path, which satisfies the requirement that connectivity must not traverse the internet. An NLB is the only load balancer type that can front a VPC endpoint service.

Why the Other Options Are Wrong

B: An Application Load Balancer is layer 7 only and cannot be used with a VPC endpoint service, so HTTP or HTTPS endpoint services on an ALB are not supported. C and D: An internet gateway or a NAT gateway exposes or originates traffic over the public internet, which directly violates the requirement that the data is sensitive and must not traverse the internet.

Community Comment Notes

The community voted 89 to 1 for A, and the main justification was that PrivateLink endpoint services support only a Network Load Balancer or a Gateway Load Balancer, not an Application Load Balancer, and that a NAT or internet gateway path would cross the internet.

Official Reference

https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html

This link opens the official vendor documentation in a new tab.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. pangchn 👍 4 Answered A
    A This is a privatelink scenrio. Can't find a hard evidence but the Privatelink seem can only work with NLB. If need ALB, it will be Privatelink -> NLB -> ALB one evidence is the link lasithasilva709 posted another evidence is compare of ALB/NLB https://aws.amazon.com/elasticloadbalancing/features/?nc=sn&loc=2&dn=1 3rd evidence https://aws.amazon.com/about-aws/whats-new/2021/09/application-load-balancer-aws-privatelink-static-ip-addresses-network-load-balancer/
  2. backbencher2022 👍 3 Answered A
    A is the correct option. There is no direct support for ALB with Private Link / VPC Endpoint service. ALB can be a target group for NLB so, we can use ALB with NLB but not ALB directly. Check this page for more details - https://aws.amazon.com/about-aws/whats-new/2021/09/application-load-balancer-aws-privatelink-static-ip-addresses-network-load-balancer/
  3. lasithasilva709 👍 2 Answered A
    My understanding is that NLB should be used for a VPC endpoint service. Here are some resources: 1. To use AWS PrivateLink, create a Network Load Balancer for your application in your VPC, and create a VPC endpoint service configuration pointing to that load balancer. https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/aws-privatelink.html 2. https://aws.amazon.com/blogs/networking-and-content-delivery/application-load-balancer-type-target-group-for-network-load-balancer/
  4. CMMC 👍 2 Answered A
    #C & #D are out given the connectivity cannot traverse the internet. #A enables secure VPC endpoint to privately expose to other companies' VPCs without traversing the internet, and TCP to provide more controlled and secure comm protocol for sensitive data
  5. Dgix 👍 2 Answered B
    B is just a safe as A — TCP is not inherently safer. However, HTTPS and HTTP are much more commonly used when providing services to other companies. As we don't have any information as to the nature of the service, a safer bet (pun intended) is B.
Show 5 more comments
  1. asquared16 👍 2
    What do we know that makes B not a valid answer? It feels like the question is missing something.
  2. AWSPro1234 👍 2
    Answer is A. Many services is a key word , option B is for http and https.
  3. gfhbox0083 👍 2
    A, for sure. Connectivity cannot traverse the internet
  4. VerRi 👍 2 Answered A
    VPC endpoint + NLB = PrivateLink
  5. trungtd 👍 2 Answered A
    A, VPC endpoint used with NLB

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Modernize centralized firewall appliances with a Gateway Load Balancer and Auto Scaling

S-grade

Use Lambda over a CloudWatch Logs stream to count unique users per client

S-grade

Serve global game assets with Route 53 latency records and health checks

S-grade

Reach a cross-account S3 data lake through a gateway endpoint and an access point bucket policy

S-grade

Practice All SAP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full SAP-C02 Practice Test →

← Back to SAP-C02 Study Guide