A Company Has Two AWS Accounts, Each Containing One VPC

question 134

Multiple Choice

A company has two AWS accounts, each containing one VPC. The first VPC has a VPN connection with its corporate network. The second VPC, without a VPN, hosts an Amazon Aurora database cluster in private subnets. Developers manage the Aurora database from a bastion host in a public subnet as shown in the image. A security review has flagged this architecture as vulnerable, and a Security Engineer has been asked to make this design more secure. The company has a short deadline and a second VPN connection to the Aurora account is not possible. How can the Security Engineer securely set up the bastion host?

• A) Move the bastion host to the VPC with VPN connectivity. Create a VPC peering relationship between the bastion host VPC and Aurora VPC.
• B) Create an SSH port forwarding tunnel on the Developer's workstation to the bastion host to ensure that only authorized SSH clients can access the bastion host.
• C) Move the bastion host to the VPC with VPN connectivity. Create a cross-account trust relationship between the bastion VPC and Aurora VPC, and update the Aurora security group for the relationship.
• D) Create an AWS Direct Connect connection between the corporate network and the Aurora account, and adjust the Aurora security group for this connection.

---

Definitions:

Metering Valve

A component in the braking system that regulates the pressure to the brakes, often used in rear to balance braking force.

Proportioning Valve

A valve in a vehicle's braking system that adjusts the pressure between the front and rear brakes, ensuring balanced braking.

Delay

A situation in which something happens later than planned or expected.

Lockup

A feature in automatic transmissions that locks the torque converter under certain conditions to improve fuel efficiency and reduce slippage.