DVA-C02 Development with AWS Services Practice Question
A company runs a microservices architecture on Amazon ECS with Fargate. Each service exposes an HTTP API and needs to be accessible only from the company's internal network via a VPN. The services are deployed in private subnets. What is the MOST secure and scalable way to expose these services?
⚠ Common exam trap
A common mix-up: candidates confuse NAT Gateway (outbound only) with a solution for inbound traffic, or they assume an ALB in public subnets is acceptable because it can be restricted via security groups, but that still exposes the services to the internet at the network layer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC Endpoint service powered by PrivateLink and a Network Load Balancer in front of the services.
AWS PrivateLink with a VPC Endpoint service and a Network Load Balancer (NLB) allows you to expose services running in private subnets to other VPCs or on-premises networks via VPN without traversing the public internet. The NLB handles TCP traffic at Layer 4, and the VPC Endpoint service provides secure, scalable connectivity by creating elastic network interfaces in the consumer VPC, ensuring traffic stays within the AWS network. This approach is both secure (no public exposure) and scalable (NLB handles high throughput and availability).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a VPC Endpoint service powered by PrivateLink and a Network Load Balancer in front of the services.
Why this is correct
A VPC Endpoint service, powered by AWS PrivateLink, enables secure, private connectivity from other VPCs or on-premises networks (via VPN/Direct Connect) to services hosted within your VPC. By placing a Network Load Balancer (NLB) in front of the ECS services, the PrivateLink endpoint can expose these services securely. This setup ensures traffic remains entirely within the AWS network and your private network, bypassing the public internet and maintaining strict security for internal-only access.
- ✗
Place an Application Load Balancer in public subnets and point to the services' target groups.
Why it's wrong here
Placing an Application Load Balancer (ALB) in public subnets makes it internet-facing, meaning it is accessible from the public internet. While an ALB can route traffic to ECS services via target groups, this configuration directly exposes the microservices to the entire internet, which contradicts the requirement for secure, internal-only access from a VPN. This approach introduces significant security risks by making internal services publicly discoverable.
- ✗
Use a NAT Gateway to allow inbound traffic from the VPN to the services.
Why it's wrong here
A NAT Gateway is designed exclusively for instances in private subnets to initiate outbound connections to the internet or other AWS services while preventing unsolicited inbound connections. Its primary function is Network Address Translation for outbound traffic from private subnets. It does not support or facilitate inbound traffic from external sources, including a VPN, to services within a private VPC, making it entirely unsuitable for this use case.
- ✗
Use an Internet Gateway and route traffic from the VPN to the services.
Why it's wrong here
An Internet Gateway (IGW) is a highly available, redundant, and horizontally scaled VPC component that allows communication between instances in your VPC and the public internet. Its sole purpose is to enable public internet access for resources in public subnets. Routing traffic from a VPN through an Internet Gateway would force private VPN traffic onto the public internet, compromising the security and privacy required for internal-only access to microservices.
Visual reference
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.