SAA-C03 Q473 · Networking

Question

A company is designing a serverless application to process a large number of events within an AWS account. The application saves the events to a data warehouse for further analysis. The application sends incoming events to an Amazon SQS queue. Traffic between the application and the SQS queue must not use public IP addresses. Which solution will meet these requirements?

Accepted Answer

**Requirement 1: Serverless application sends events to SQS** — A VPC endpoint for SQS allows resources within a VPC to communicate with SQS without traversing the public internet.

**Requirement 2: Traffic must not use public IP addresses** — A **VPC Interface Endpoint** (powered by AWS PrivateLink) creates an Elastic Network Interface (ENI) with a **private IP address** inside your VPC subnet. All traffic from the application to SQS flows through this private ENI, never touching the public internet or requiring public IP addresses.

**Requirement 3: Enforce the private-only path** — Setting the **SQS queue policy to deny all access except from the VPC endpoint** ensures that even if someone tries to access the queue from outside the VPC (e.g., via the public SQS endpoint), the request is

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips