A company must expose an internal API to partner VPCs — without internet exposure, VPC peering (CIDRs overlap), or giving partners broad network access. What's the secure sharing mechanism?
A.Open the API's security group to 0.0.0.0/0
0.0.0.0/0 exposes the service publicly — fails every requirement.
B.VPC peering with a NAT workaround for overlapping CIDRs
Peering can't span overlapping CIDRs and grants broad network adjacency.
C.AWS PrivateLink — expose the service via an NLB endpoint service consumed through interface endpoints
Correct. PrivateLink is purpose-built for cross-VPC service sharing.
D.A public ALB restricted by TLS client certificates
Public exposure violates the no-internet requirement.
Why this answer
PrivateLink exposes a service behind an NLB as an endpoint service; consumers create interface endpoints in their VPC — unidirectional, no CIDR overlap issues, no route-table coupling, and traffic never traverses the internet.
Correct answer: C · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Network Security practice session.
Practice Network Security