SAP-C02 Q571 · Networking

Question

A company mandates that all internal AWS communications use private IPs. A solutions architect created interface VPC endpoints for public AWS services like S3. However, service names are still resolving to public IP addresses, and the internal apps cannot connect. What should the architect do to resolve this issue?

Accepted Answer

**Answer B: Enable the private DNS option on the VPC attributes.**

The problem statement is the key: service names are **resolving to public IP addresses**. This is a DNS resolution issue, not a routing or security group issue.

When you create an interface VPC endpoint (powered by AWS PrivateLink), AWS creates an **endpoint-specific DNS name** like `vpce-0abc123.s3.us-east-1.vpce.amazonaws.com`. However, by default, the standard service DNS name (e.g., `s3.amazonaws.com`) still resolves to **public IP addresses**.

To make the standard service DNS name resolve to the **private IP addresses** of the ENIs created by the interface endpoint, you must:

1. **Enable DNS hostnames** on the VPC (`enableDnsHostnames = true`)
2. **Enable DNS support** on the VPC (`enableDnsSupport = true`)
3. **En

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips