A SaaS firm hosts an internal risk-scoring API in a service VPC that three client VPCs must reach without traversing the internet, using private DNS and endpoint policies. Client networks overlap in CIDR ranges. Which private access design meets these constraints?
Select an answer to reveal the explanation.
Short Explanation
You need private doors that don't collide. PrivateLink gives each VPC its own endpoint with overlapping IPs intact. It's like unlisted direct lines instead of a shared hallway.
Full Explanation
AWS PrivateLink publishes the service as an endpoint service backed by a Network Load Balancer, and each consumer creates an interface endpoint with its own elastic network interface and private DNS name in its VPC, so traffic stays on the AWS backbone, endpoint policies limit actions, and overlapping CIDRs never conflict because no peering or route exchange occurs. VPC peering requires non-overlapping CIDRs and creates full mesh routing complexity, failing the overlap constraint and expanding reachability beyond the API. An internet-facing ALB with security groups traverses public IPs and relies on IP filtering rather than private connectivity, violating the no-internet requirement. Client VPN with public DNS and mTLS provides remote user access over encrypted tunnels but does not give VPC-to-service private connectivity and still exposes public records. On the exam, link overlapping CIDRs and private service consumption to PrivateLink interface endpoints. In practice, verify endpoint policies, Private DNS override, and NLB health checks.