A Company Currently Runs a Secure Application on Amazon EC2

question 226

Multiple Choice

A company currently runs a secure application on Amazon EC2 that takes files from on-premises locations through AWS Direct Connect, processes them, and uploads them to a single Amazon S3 bucket. The application uses HTTPS for encryption in transit to Amazon S3, and S3 server-side encryption to encrypt at rest. Which of the following changes should the Solutions Architect recommend to make this solution more secure without impeding application's performance?

• A) Add a NAT gateway. Update the security groups on the EC2 instance to allow access to and from the S3 IP range only. Configure an S3 bucket policy that allows communication from the NAT gateway's Elastic IP address only.
• B) Add a VPC endpoint. Configure endpoint policies on the VPC endpoint to allow access to the required Amazon S3 buckets only. Implement an S3 bucket policy that allows communication from the VPC's source IP range only.
• C) Add a NAT gateway. Update the security groups on the EC2 instance to allow access to and from the S3 IP range only. Configure an S3 bucket policy that allows communication from the source public IP address of the on-premises network only.
• D) Add a VPC endpoint. Configure endpoint policies on the VPC endpoint to allow access to the required S3 buckets only. Implement an S3 bucket policy that allows communication from the VPC endpoint only.

---

Definitions:

Ethical Standards

Principles that guide behavior and practices in both personal and professional contexts, based on notions of right and wrong.

Global Community

A term referring to the international network of individuals, societies, and nations interacting and interdependent upon one another.

Individual Level

Refers to psychological or behavioral processes occurring within a single person.

Extra Privileges

Special rights, advantages, or immunities granted to an individual or a group beyond the usual.