SAP-C02 Q575 · Networking

Question

How can a company patch EC2 instances without internet access, using a patch source in another account, while accessing Systems Manager and S3?

Accepted Answer

This question has three distinct requirements, and option C satisfies all of them:

**Requirement 1: No internet access**
→ **VPC Interface Endpoints** (AWS PrivateLink) allow EC2 instances to communicate with AWS Systems Manager (SSM) and Amazon S3 entirely over the private AWS network, without needing an internet gateway, NAT gateway, or public IP addresses. Specifically, you need endpoints for:
- `com.amazonaws.region.ssm`
- `com.amazonaws.region.ssmmessages`
- `com.amazonaws.region.ec2messages`
- `com.amazonaws.region.s3` (Gateway or Interface endpoint)

**Requirement 2: Access a patch source in another AWS account**
→ **VPC Peering** establishes a private network connection between two VPCs, even across different AWS accounts. This allows the EC2 instances to reach the patch repositor

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips