ANS-C01 Exam Dumps : Amazon AWS Certified Advanced Networking - Specialty

Inbound Rule 1 (Allow TCP 443 from 0.0.0.0/0): This rule allows all sources, including the public internet, to access the interface VPC endpoints. Since interface VPC endpoints are used within the VPC for communication with AWS services, this rule is unnecessarily permissive. Removing this rule enhances security while still allowing communication within the VPC using Rule 2 (TCP 443 from the VPC CIDR).

Outbound Rule 1 (Allow All Protocols, All Ports to 0.0.0.0/0): This rule is overly permissive and unnecessary for interface VPC endpoints, as traffic destined for AWS services through these endpoints does not need unrestricted outbound access. Removing this rule ensures that outbound traffic is limited to what is required for communication with the AWS services through the interface endpoints.

Enabling acceleration for a Site-to-Site VPN connection uses AWS Global Accelerator to route traffic from the on-premises network to an AWS edge location that is closest to the customer gateway device1. AWS Global Accelerator optimizes the network path, using the congestion-free AWS global network to route traffic to the endpoint that provides the best application performance2. Setting the transit gateway as the target gateway enables connectivity between the on-premises network and multiple VPCs that are attached to the transit gateway3.

The correct approach is to use AWS Systems Manager Session Manager, which allows you to manage your EC2 instances through a secure and browser-based interface. By deploying and configuring SSM Agent on each instance, you can enable Session Manager to communicate with the instances. By deploying VPC endpoints for Session Manager, you can enable the instances to connect to the AWS service without requiring an internet gateway, NAT device, or VPN connection. You can also use IAM policies and SSM documents to implement role-based access control for managing the instances. This approach has the least maintenance overhead, as it does not require any additional infrastructure or configuration.