Question 760
A scalable network architecture separates tiers and routes. The team confirms that a service with overlapping partner CIDR requires bounded private access. Which approach most directly resolves this gap?
Explanation
Correct Answer
The scenario identifies this requirement: A service with overlapping partner CIDR requires bounded private access. Select Publish a PrivateLink endpoint service instead of trying to route entire peer networks as the specified technical mechanism. Service-specific private endpoints avoid network-level CIDR overlap. This response addresses the problem described rather than a different design goal.
Incorrect Answers
Allow inbound from the application security group at the database port would help if app instances require TCP database access without opening all VPC CIDRs. Group references scope private tier access. That is not the symptom described here: a service with overlapping partner CIDR requires bounded private access. The matching response is Publish a PrivateLink endpoint service instead of trying to route entire peer networks, because service-specific private endpoints avoid network-level CIDR overlap.
For the alternative failure a direct S3 gateway endpoint path is missing from one private subnet route table, the control Associate that route table with the endpoint is relevant: subnet route associations determine private service reachability. Here the evidence instead is a service with overlapping partner CIDR requires bounded private access. The selected technical mechanism is Publish a PrivateLink endpoint service instead of trying to route entire peer networks: service-specific private endpoints avoid network-level CIDR overlap.
Use a multi-AZ ALB with redundant healthy targets solves a different operational problem where public services in two AZs are reached through only one static host. Managed load balancing removes single-host ingress. It does not directly address a service with overlapping partner CIDR requires bounded private access. The case calls for Publish a PrivateLink endpoint service instead of trying to route entire peer networks, since service-specific private endpoints avoid network-level CIDR overlap.