AWS Certified Professional SAP-C02 Amazon Web Services Study Notes

B is correct. WhenPrivate DNSis enabled for an interface endpoint, AWS automatically updates the public service DNS names (e.g., s3.amazonaws.com) to resolve toprivate IPsinside the VPC. This ensures all traffic stays within the AWS network and complies with the private IP policy.

A is not necessary — VPC endpoints already route via local network.

C only affects security group rules, not DNS resolution.

D is unnecessary unless using custom DNS resolution systems.

The correct solution is to use an IAM Identity Center account instance in the member account dedicated to Company B. This keeps Company B’s authentication isolated from Company A’s organization-level IAM Identity Center identity source. AWS documentation states that account instances of IAM Identity Center support isolated application deployments in a single AWS account, and WorkSpaces directories can be associated with an IAM Identity Center organization or account instance. That directly satisfies the requirement that WorkSpaces authentication use only Company B’s own IdP. Option B is wrong because IAM Identity Center supports only one identity source per instance, so simply adding a second identity source to Company A’s existing instance is not the right design. Option C overcomplicates access with IAM SAML federation and does not configure WorkSpaces authentication properly. (AWS Documentation)

===============

This option uses AWS DataSync to replicate the on-premises images to the EFS file system over the Direct Connect connection. AWS DataSync is a service that automates and accelerates data transfer between on-premises storage systems and AWS storage services. It can transfer data to and from Amazon EFS, Amazon FSx for Windows File Server, and Amazon S3. To use AWS DataSync, the company needs to deploy an AWS DataSync agent to an on-premises server that has access to the NFS file system. The agent connects to the AWS DataSync service endpoint in the AWS Region where the EFS file system is located. The company can use an AWS PrivateLink interface endpoint to connect to the service endpoint securely and privately over the Direct Connect connection. The company can then create a task in AWS DataSync that specifies the source location (the NFS file system), the destination location (the EFS file system), and the options for the data transfer (such as schedule, bandwidth limit, and verification). AWS DataSync will then perform the data transfer efficiently and securely, using encryption in transit and at rest.