AWS Certified Solutions Architect – Professional (SAP-C02) — Question 427

A company has implemented a new security requirement. According to the new requirement, the company must scan all traffic from corporate AWS instances in the company's VPC for violations of the company's security policies. As a result of these scans, the company can block access to and from specific IP addresses.

To meet the new requirement, the company deploys a set of Amazon EC2 instances in private subnets to serve as transparent proxies. The company installs approved proxy server software on these EC2 instances. The company modifies the route tables on all subnets to use the corresponding EC2 instances with proxy software as the default route. The company also creates security groups that are compliant with the security policies and assigns these security groups to the EC2 instances.

Despite these configurations, the traffic of the EC2 instances in their private subnets is not being properly forwarded to the internet.

What should a solutions architect do to resolve this issue?

Answer options

• A. Disable source/destination checks on the EC2 instances that run the proxy software.
• B. Add a rule to the security group that is assigned to the proxy EC2 instances to allow all traffic between instances that have this security group. Assign this security group to all EC2 instances in the VPC.
• C. Change the VPCs DHCP options set. Set the DNS server options to point to the addresses of the proxy EC2 instances.
• D. Assign one additional elastic network interface to each proxy EC2 instance. Ensure that one of these network interfaces has a route to the private subnets. Ensure that the other network interface has a route to the internet.

Correct answer: A

Explanation

By default, AWS EC2 instances perform source/destination checks to ensure that the instance is either the source or destination of any traffic it receives or sends. Since transparent proxies act as intermediaries and must forward traffic destined for other IP addresses, this check must be disabled on the proxy instances to allow them to forward packets. Other options like modifying DHCP options or adding extra network interfaces do not resolve this fundamental EC2 forwarding restriction.