Answer-first summary for fast verification
Answer: Configure an endpoint service, and grant the customers permission to create a connection to the endpoint service., Deploy an AWS Transit Gateway, and connect the SaaS VPC to it. Share the transit gateway with the customers. Configure routing on the transit gateway.
To address the requirement of avoiding IP address overlap and not connecting over the internet, the solution involves using AWS PrivateLink and AWS Transit Gateway. AWS PrivateLink allows customers to access the SaaS provider's services privately without traversing the internet, thus avoiding IP address conflicts. This is achieved by configuring an endpoint service (Option B) which allows customers to create a connection to the service without exposing their internal IP addresses. AWS Transit Gateway (Option E) simplifies network architecture by connecting multiple VPCs and on-premises networks through a central hub, enabling the SaaS provider to share their VPC with customers securely and efficiently. This setup ensures that traffic between the SaaS provider and its customers is routed privately within the AWS network, meeting the requirement of not connecting over the internet. Options A and C, which involve deploying the SaaS service behind a Network Load Balancer or an Application Load Balancer, do not inherently solve the IP address overlap issue or ensure private connectivity. Option D, configuring a VPC peering connection and routing traffic through NAT gateways, does not provide a scalable solution for multiple customers with overlapping IP addresses and does not inherently ensure private connectivity without internet traversal.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
A SaaS provider hosts its solution on Amazon EC2 instances within a VPC in AWS. All customers also operate their environments in AWS. During a design meeting, it was discovered that customers have overlapping IP addresses with the provider's AWS deployment. Customers have refused to share their internal IP addresses and do not want to connect to the SaaS service over the internet.
Which two steps should be combined to create a solution that meets these requirements?
A
Deploy the SaaS service endpoint behind a Network Load Balancer.
B
Configure an endpoint service, and grant the customers permission to create a connection to the endpoint service.
C
Deploy the SaaS service endpoint behind an Application Load Balancer.
D
Configure a VPC peering connection to the customer VPCs. Route traffic through NAT gateways.
E
Deploy an AWS Transit Gateway, and connect the SaaS VPC to it. Share the transit gateway with the customers. Configure routing on the transit gateway.