DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Attach a NAT Gateway to the private subnet and update the route table.

  Why it's wrong here

  A NAT Gateway allows instances in private subnets to initiate outbound connections to the internet, including public AWS service endpoints. However, the traffic still traverses the public internet to reach CloudWatch, which does not satisfy a requirement for *private* connectivity within the AWS network. This approach introduces an internet egress point, potentially increasing security exposure and data transfer costs.

• ✗

  Install the CloudWatch agent on each instance and configure it to use a proxy.

  Why it's wrong here

  While the CloudWatch agent is necessary to collect metrics and logs, merely configuring it to use a proxy server does not inherently establish private connectivity to CloudWatch. The proxy itself would still require a network path to CloudWatch, either via the public internet or through an existing private connection like a VPC Endpoint or Direct Connect, which this option does not provide. This solution only intermediates traffic, it doesn't create the private network path.

• ✗

  Attach an Internet Gateway to the VPC and assign public IPs to instances.

  Why it's wrong here

  Attaching an Internet Gateway to the VPC and assigning public IP addresses to EC2 instances places them in a public subnet, allowing direct internet access. While this enables communication with CloudWatch's public endpoints, it exposes the instances directly to the public internet, which is generally undesirable for security and compliance reasons, especially when private connectivity is preferred or required. This approach bypasses the need for private subnets entirely, sacrificing isolation.

• ✓

  Create a VPC Endpoint for CloudWatch (com.amazonaws.region.monitoring).

  Why this is correct

  Creating a VPC Endpoint for CloudWatch, specifically an interface endpoint using the `com.amazonaws.region.monitoring` service name, establishes a private connection between your VPC and CloudWatch. This allows EC2 instances in private subnets to send metrics and logs to CloudWatch entirely within the AWS network, bypassing the public internet. This solution significantly enhances security and compliance by keeping all traffic private and eliminating internet egress for this communication.

Go deeper

Related to this question