AWS Certified Advanced Networking - Specialty ANS-C01 — Topic 1 Question 278

Question

A network engineer maintains a company's AWS infrastructure. The network engineer used AWS Transit Gateway to set up a hub and spoke architecture. The network engineer created a shared services VPC to centralize access to interface VPC endpoints. The company uses AWS Organizations to manage AWS accounts for multiple teams in a single organization. Each team in the company has a separate account and VPC. All the team accounts require access to the interface VPC endpoints. The network engineer needs a solution to grant each account the minimum required access. Each team's account must have access only to a list of authorized interface VPC endpoints. The solution must have minimal effect on the current architecture. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

Correct answer: D. The correct answer is D. Option D: Associate an endpoint policy with each interface VPC endpoint. In each policy, deny all the traffic except for traffic from accounts that are authorized to access the corresponding service. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

AWS Certified Advanced Networking - Specialty ANS-C01 — Question 278