AWS Certified Solutions Architect - Professional SAP-C02 Exam - Question 361

Question

A software as a service (SaaS) company uses AWS to host a service that is powered by AWS PrivateLink. The service consists of proprietary software that runs on three Amazon EC2 instances behind a Network Load Balancer (NLB). The instances are in private subnets in multiple Availability Zones in the eu-west-2 Region. All the company's customers are in eu-west-2.

However, the company now acquires a new customer in the us-east-1 Region. The company creates a new VPC and new subnets in us-east-1. The company establishes inter-Region VPC peering between the VPCs in the two Regions.

The company wants to give the new customer access to the SaaS service, but the company does not want to immediately deploy new EC2 resources in us-east-1.

Which solution will meet these requirements?

Examice · Accepted Answer

To meet the requirements of giving the new customer access to the SaaS service without deploying new EC2 resources in us-east-1, the best solution is to configure a PrivateLink endpoint service in us-east-1 that utilizes the existing Network Load Balancer (NLB) in eu-west-2. This setup allows the new customer in us-east-1 to access the SaaS service hosted in eu-west-2 without requiring additional EC2 instances in the us-east-1 region. Additionally, granting specific AWS accounts access to connect to the SaaS service ensures that only authorized users can access it, which meets the security requirements.

heatblur · Answer

The best option among these is B. While it introduces some complexity, it's the most viable solution that aligns with AWS capabilities and the company's requirements. Creating an NLB in us-east-1 and targeting the IP addresses of the existing instances in eu-west-2 is a feasible approach. This setup allows the company to use their existing infrastructure in eu-west-2 while providing access to the customer in us-east-1 through the PrivateLink endpoint service in us-east-1. This avoids the immediate need to deploy new EC2 resources in the us-east-1 region.

It can't be A because AWS PrivateLink endpoint services cannot span regions. They are region-specific, so an endpoint service in us-east-1 cannot directly use an NLB located in eu-west-2.

devalenzuela86 · Answer

A

Explanation:
* Configuring a PrivateLink endpoint service in us-east-1 to use the existing NLB that is in eu-west-2 will allow the new customer to access the SaaS service without deploying new EC2 resources in us-east-1 1.
* Granting specific AWS accounts access to connect to the SaaS service will ensure that only authorized users can access the service 1.

kalitwol · Answer

Privatelink service is a regional service and cannot be accessed across regions.

George88 · Answer

B is correct.
See https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html

HunkyBunky · Answer

I guess A. Becuase this https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html documentation related only to PrivateLink connections WITHOUT VPC peering

shaaam80 · Answer

Answer B

ayadmawla · Answer

Answer is A.   Notice the reference to "Inter-Region VPC Peering" in the question.

See: https://aws.amazon.com/about-aws/whats-new/2018/10/aws-privatelink-now-supports-access-over-inter-region-vpc-peering/#:~:text=Applications%20in%20an%20AWS%20VPC,using%20Inter%2DRegion%20VPC%20Peering.

GibaSP45 · Answer

https://aws.amazon.com/pt/about-aws/whats-new/2018/10/aws-privatelink-now-supports-access-over-inter-region-vpc-peering/

igor12ghsj577 · Answer

A is the ans

Arnaud92 · Answer

B
https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html#inter-region-endpoint-services

saggy4 · Answer

A- Private link supports access over inter region vpc peering

pri32 · Answer

B will also work but unnecessaey complexities

Anonymous · Answer

A: AWS PrivateLink endpoints can now be accessed across both intra- and inter-region VPC peering connections.
https://aws.amazon.com/about-aws/whats-new/2019/03/aws-privatelink-now-supports-access-over-vpc-peering/

yog927 · Answer

It is A.
For all those saying can not access PrivateLink endpoint service across region.
 
"This release makes it possible for customers to privately connect to a service even if the service endpoint resides in a different AWS Region."

https://aws.amazon.com/about-aws/whats-new/2018/10/aws-privatelink-now-supports-access-over-inter-region-vpc-peering/

TonytheTiger · Answer

Option A :  you don't need to create a new NLB in the us-east-1.  Read  the link below for Inter-Region access to endpoint service .

https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html#inter-region-endpoint-services

Spike2020 · Answer

As of November 2024, AWS PrivateLink supports native cross-region connectivity. However, since this exam question appears to be set before this feature was available, we need to consider the solution using the previous architecture patterns.
Option A: Not viable because PrivateLink endpoint services must be in the same region as the NLB

Anonymous · Answer

This question was written before AWS PrivateLink supported cross-region connectivity. At that time, the only way to give a customer in us-east-1 access to a service in eu-west-2 without deploying resources in us-east-1 was the complex workaround described in Option B. This involved creating an NLB in us-east-1 and using an IP target group pointing back to the instances in eu-west-2. It was a complicated solution, but it was the only way to achieve the desired outcome given the limitations at the time. Therefore, B was the correct answer for the question as it was originally written.

But now the answer has changed to A.

cypkir · Answer

Answer: B

J0n102 · Answer

Answer: B

vibzr2023 · Answer

Answer: B Somehow A also supports but there is limitations to only S3
- Multi-Region Access Points are designed for Amazon S3, not directly for AWS PrivateLink.
- Provide a single global endpoint for accessing S3 buckets across multiple regions.
- Simplify data access and management for multi-region S3 deployments.
https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessConfiguration.html

marszalekm · Answer

https://repost.aws/questions/QU4qk3TdeBTyqZ-vcvODn84w/private-link-cross-region-cross-account-support

bjexamprep · Answer

Private link endpoint service can only use the NLB in the same region. So A is wrong.

mav3r1ck · Answer

This is the use case: https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html#inter-region-endpoint-services

VerRi · Answer

AWS PrivateLink now supports access over Inter-Region VPC Peering since 2018.
https://aws.amazon.com/about-aws/whats-new/2018/10/aws-privatelink-now-supports-access-over-inter-region-vpc-peering/

titi_r · Answer

A - correct.

mark_232323 · Answer

Option A is not possible because a PrivateLink endpoint service in us-east-1 cannot directly use an NLB in another Region (eu-west-2).

asquared16 · Answer

A is wrong, In this scenario, the existing NLB is located in the eu-west-2 Region, while the new customer is in the us-east-1 Region. PrivateLink does not support cross-Region connectivity directly. Therefore, you cannot create a PrivateLink endpoint service in us-east-1 and associate it with the NLB in eu-west-2.

To provide access to the SaaS service for the new customer in us-east-1, you need to create a load balancer (in this case, an NLB) in the us-east-1 Region and then configure a PrivateLink endpoint service in us-east-1 that uses that NLB. This NLB can then forward traffic to the instances in eu-west-2 over the inter-Region VPC peering connection, as described in the correct solution (option B).

youonebe · Answer

Creating an NLB in us-east-1 with IP target group pointing to the existing eu-west-2 instances is the most efficient solution because:
IP target groups can route traffic across VPC peering connections
This configuration allows the use of existing EC2 instances while providing local access in us-east-1
PrivateLink endpoint service can be configured with the new NLB to provide secure access

kujin · Answer

Option A is not feasible because AWS PrivateLink endpoint services are region-specific and cannot use an NLB from a different region.

career360guru · Answer

Option B is best option.

adelynllllllllll · Answer

A:

https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-share-your-services.html

sat2008 · Answer

When you create  PrivateLink endpoint service in us-east-1  you also need a NLB to handle traffic flow between target NLB . So A doesn't seem to be a complete answer

tushar321 · Answer

A. A looks to be right answer

seetpt · Answer

A for me

qaz12wsx · Answer

a because of this https://aws.amazon.com/about-aws/whats-new/2018/10/aws-privatelink-now-supports-access-over-inter-region-vpc-peering/

fabriciollf · Answer

Inter-Region endpoint services
"Service providers can leverage a Network Load Balancer in a remote Region and create an IP target group that uses the IPs of their instance fleet in the remote Region hosting the service."
https://docs.aws.amazon.com/whitepapers/latest/aws-privatelink/use-case-examples.html#:~:text=Inter%2DRegion%20access%20to%20endpoint%20services,-As%20customers%20expand&text=Inter%2DRegion%20VPC%20peering%20traffic%20is%20transported%20over%20Amazon's%20network,costs%20between%20the%20two%20Regions.

Woody1848 · Answer

"An interface endpoint is essentially a service-level ENI. The service is attached straight to
the VPC subnet through the ENI. This allows us to assign a private IP address from the
subnet pool directly to the service." (AWS Certified Advanced Networking - Specialty Exam Guide pg. 36)

There is no need to create EC2 resources in us-east-1 when creating a PrivateLink endpoint.

AzureDP900 · Answer

correct answer : A 
Using an existing NLB in eu-west-2 as the basis for a PrivateLink endpoint service in us-east-1 allows the company to quickly provide access to its SaaS service without having to create new EC2 resources or configure complex networking setups.

0b43291 · Answer

The correct solution is Option B: Create an NLB in us-east-1. Create an IP target group that uses the IP addresses of the company's instances in eu-west-2 that host the SaaS service. Configure a PrivateLink endpoint service that uses the NLB that is in us-east-1. Grant specific AWS accounts access to connect to the SaaS service.

Option A is not possible because PrivateLink endpoint services cannot span across AWS Regions. The existing NLB in eu-west-2 cannot be directly used for a PrivateLink endpoint service in us-east-1.

TomTom · Answer

Answer A is correct (now) Recently AWS announce, Now PrivateLink endpoint supports native cross-region connectivity.
https://aws.amazon.com/about-aws/whats-new/2024/11/aws-privatelink-across-region-connectivity/

AWS Certified Solutions Architect - Professional SAP-C02 Exam - Question 361

Discussion