AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 29
Question 280
A provider wants to publish a privately hosted TCP application to other AWS accounts through supported AWS PrivateLink endpoint services. Its engineers propose using an internet-facing ALB as the endpoint-service backing integration in all cases. What supporting load balancer pattern should they confirm?
- Make the EC2 application publicly reachable and refer customers to its internet hostname.
- Use a Route 53 private hosted zone alone to transport packets from every customer VPC to the provider's backend.
- Use a supported Network Load Balancer-backed endpoint service integration, with the appropriate service permissions and consumer interface endpoints.
- Configure a Gateway Load Balancer endpoint service as the main TCP application publishing interface, assuming its transparent-appliance insertion semantics are identical to an NLB application endpoint service.
Explanation
Correct Answer
C:AWS PrivateLink endpoint services commonly use NLB front ends for published application traffic. The provider must meet the endpoint-service integration's supported load-balancer requirements.
Incorrect Answers
A:Public ingress does not satisfy the desired private cross-account consumption architecture.
B:Private DNS names do not create cross-VPC network connectivity. The endpoint service and consumer interface endpoints remain required.
D:Gateway Load Balancer endpoints serve transparent service insertion for network appliances. Publishing an ordinary privately consumed TCP application uses a supported NLB-backed endpoint service and its consumer interface endpoints.
Question 281
A branch-office router reports that an AWS Site-to-Site VPN tunnel is UP, but servers cannot reach EC2 instances in the VPC. The corporate and VPC CIDRs do not overlap. Which network checks are most relevant?
- Verify VPC subnet and transit/VGW route-table entries, propagated routes where used, return paths and relevant SG/NACL permissions.
- Create an S3 lifecycle expiration rule to force packets into the VPN tunnel.
- Assume tunnel status UP installs every application return route and bypasses all security groups automatically.
- Increase the RDS instance memory because a VPN route black hole is a database compute-capacity problem.
Explanation
Correct Answer
A:VPN tunnel establishment confirms an encrypted path can exist; forwarding still requires correct destination routing in both directions and allowed packets at VPC endpoints.
Incorrect Answers
B:Object retention policies are unrelated to hybrid IP routing and cannot repair missing return routes.
C:Tunnel state does not replace routing or instance security controls. A healthy tunnel can still carry no useful application traffic.
D:Database sizing does not determine whether a branch CIDR is routed through the hybrid tunnel and back.
Question 282
A company has an AWS Direct Connect private virtual interface to a hosted application. Its compliance standard requires cryptographic confidentiality across the network path. An engineer states that the dedicated physical circuit alone guarantees IPsec encryption. What should the architect advise?
- Rely on the direct connection's physical isolation as proof that all application payload bytes are encrypted.
- Replace the VPC security groups with S3 ACLs to encrypt traffic across the circuit.
- Add a supported encryption approach such as IPsec VPN over Direct Connect or appropriate MACsec where available and required.
- Change the Direct Connect port speed to 10 Gbps because faster circuits automatically enable end-to-end encryption.
Explanation
Correct Answer
C:Direct Connect provides a private dedicated path but does not inherently encrypt every packet. Encryption capability depends on the connection and supported overlay or link protection.
Incorrect Answers
A:Private transport and cryptographic confidentiality are different properties. Data can traverse a dedicated circuit without IPsec or other link encryption.
B:S3 object ACLs authorize object operations and do not encrypt arbitrary hybrid network packets.
D:Port speed affects capacity, not whether cryptographic protocols are used. The specified transport security must be configured.
Question 283
Remote auditors working from home need short-term access to internal AWS application servers without exposing SSH or RDP ports to the public internet. Which managed network access option should be considered?
- Create an S3 gateway endpoint and assume it tunnels an auditor's entire laptop network into the VPC.
- Use AWS Client VPN with authorized identities and subnet/security rules to provide controlled remote access to the private VPC.
- Use CloudFront signed cookies as an encrypted tunnel for arbitrary RDP and SSH client packets.
- Open RDP and SSH to 0.0.0.0/0 and rely solely on a strong local administrator password.
Explanation
Correct Answer
B:Client VPN establishes an authenticated VPN path for remote users to permitted VPC resources. Application ports can remain inaccessible directly from the internet.
Incorrect Answers
A:An S3 gateway endpoint serves supported S3 access from VPC routes, not authenticated end-user VPN connections.
C:Signed cookies protect access to supported CloudFront HTTP resources, not general remote network connectivity into VPC subnets.
D:Publicly exposing management services creates avoidable network attack paths. The scenario requires remote private-network access.
Question 284
A hybrid SAP workload uses AWS Site-to-Site VPN to send critical business traffic to its on-premises network. The team wants to avoid a single tunnel failure interrupting connectivity. Which resilience design is appropriate?
- Disable BGP or static fallback routing in all cases so no tunnel can advertise an alternate path.
- Build only one tunnel and assume the VPN service will invent an alternate path without configuration.
- Increase the EC2 instance volume size to reduce the probability of a tunnel outage.
- Configure supported redundant VPN tunnels and routing/failover behavior, and monitor each tunnel and its advertised paths.
Explanation
Correct Answer
D:Redundant VPN tunnels can preserve connectivity when one endpoint or tunnel fails, provided routing converges correctly and both paths are tested.
Incorrect Answers
A:Removing the needed routing mechanism can prevent failover even when a redundant tunnel exists. Routing must be consistent with the selected VPN design.
B:A single usable tunnel leaves a failure point. The resilience requirement calls for redundant routed connectivity.
C:Block-storage capacity has no causal connection to IPsec tunnel availability or route failover.
Question 285
A company has a supported dedicated 100-Gbps Direct Connect connection to an AWS location and compliant MACsec-capable routers. Security requires encrypted Ethernet frames on the physical cross-connect itself; application traffic also uses TLS for end-to-end confidentiality. Which additional Direct Connect feature protects the cross-connect?
- Enable MACsec on the eligible dedicated Direct Connect link, coordinate the CKN/CAK keys, and use compatible encryption settings at both ends.
- Enable an S3 bucket policy with aws:SourceVpce because this encrypts all Ethernet frames between the router and AWS Direct Connect.
- Only configure a new private VIF; BGP route advertisement automatically encrypts the link without a MACsec session.
- Increase the Direct Connect virtual-interface MTU, which negotiates AES-256 link encryption without keys.
Explanation
Correct Answer
A:MACsec provides supported link-level Layer-2 encryption; it does not replace application TLS or IPsec for end-to-end traffic.
Incorrect Answers
B:A bucket policy controls resource access, not frame encryption on a Direct Connect cross-connect.
C:Private VIF and BGP provide network routing, not automatic MACsec confidentiality.
D:MTU settings govern frame size and do not activate MACsec encryption/key exchange.
Question 286
A Direct Connect private virtual interface remains down at the BGP layer after a customer-edge router replacement, even though the physical circuit is up and the AWS BGP peer IP responds to ping. The downloaded virtual-interface router configuration specifies an MD5 authentication key, but the new router uses a different key. The network team has already verified the local and Amazon ASNs and peer addresses. Which change addresses this specific BGP session failure?
- Enable BFD on the link without changing the mismatched BGP MD5 key, because BFD replaces BGP peer authentication.
- Configure the customer-edge BGP neighbor with the MD5 authentication key that exactly matches the Direct Connect virtual-interface peer configuration, then recheck BGP establishment.
- Enable MACsec on the physical circuit and remove the BGP authentication configuration, because link encryption automatically supplies the BGP MD5 password.
- Change the VPC route tables to use a different next hop while leaving the failed BGP peering credentials unchanged.
Explanation
Correct Answer
B:A Direct Connect virtual-interface BGP neighbor requires matching MD5 authentication when the peer uses a configured key. AWS troubleshooting guidance explicitly checks exact MD5-key equality after peer IPs and ASNs are validated.
Incorrect Answers
A:BFD can detect fast path failures for established routing adjacencies, but it does not authenticate BGP peers or compensate for an MD5 secret mismatch. The BGP session still fails.
C:MACsec protects eligible Ethernet links when configured on both ends. It does not automatically synchronize or replace the separate BGP session MD5 authentication secret.
D:Route tables influence data forwarding after the network control plane works. They do not establish a BGP neighbor whose configured authentication key is wrong.
Question 287
A manufacturer has a single Direct Connect circuit linking production systems to AWS. Its uptime objective requires service continuation during a circuit or provider-facility failure. Which design provides a suitable backup path?
- Switch S3 objects to Intelligent-Tiering so the WAN automatically becomes redundant.
- Increase BGP hold timers indefinitely on the existing sole circuit.
- Add redundant Direct Connect connections in appropriate separate locations, or a tested VPN failover path, with resilient routing.
- Make the on-premises router's loopback address public and treat that address as an alternate Direct Connect circuit.
Explanation
Correct Answer
C:Independent network paths reduce the chance that one physical failure isolates AWS workloads. Redundancy must include practical routing and periodic failover tests.
Incorrect Answers
A:S3 storage-class selection does not affect the number of hybrid network circuits or transport failover.
B:Long timers do not create a second physical connection and may delay detection when the only circuit fails.
D:A loopback address is not another physical transport path to AWS. Circuit failure still removes connectivity.
Question 288
A company uses a Direct Connect gateway and private virtual interfaces. A developer expects any two VPCs attached through the gateway to exchange packets transitively without additional network architecture. Which behavior should the architect clarify?
- Treat all associated VPCs as one shared broadcast domain because the Direct Connect gateway merges their route tables.
- Add route-table entries targeting the Direct Connect gateway itself from VPC A toward VPC B, assuming it functions as an inter-VPC routing hub.
- Advertise both associated VPC CIDRs from the on-premises edge and assume BGP route propagation allows the two VPC attachments to exchange traffic through Direct Connect gateway.
- Design inter-VPC routing separately with supported constructs such as Transit Gateway or peering; Direct Connect gateway is not a general VPC transit router.
Explanation
Correct Answer
D:A Direct Connect gateway provides supported connectivity between Direct Connect virtual interfaces and associated gateways, but does not inherently enable arbitrary transit between attached VPCs.
Incorrect Answers
A:VPC route tables and CIDRs remain separate. A DX gateway does not automatically create a layer-2 shared LAN.
B:A Direct Connect gateway is a connectivity construct for supported VIFs and AWS resources, not a transitive VPC-to-VPC route target. Inter-VPC traffic requires an actual supported routed peering or transit architecture.
C:Advertising routes toward on-premises equipment does not grant transitive VPC-to-VPC forwarding inside a Direct Connect gateway. The associated VPC attachments do not become a private AWS transit hub solely because BGP carries their prefixes.
Question 289
A VPC application intermittently fails to reach a backend. The architect wants metadata showing which flows were accepted or rejected at selected VPC subnets without installing packet-capture agents on every instance. What feature helps?
- Use Route 53 Resolver DNS query logs as a complete packet-flow acceptance report.
- Replace every security group with an internet gateway because gateways expose the same flow telemetry.
- Enable VPC Flow Logs at an appropriate VPC, subnet or network-interface scope and send records to a controlled destination.
- Enable Route 53 Resolver query logging and expect it to record the ACCEPT or REJECT status of arbitrary database TCP flows through the VPC.
Explanation
Correct Answer
C:Flow Logs summarize IP flow metadata and accept/reject outcomes for supported traffic, helping correlate network behavior with security and routing configuration.
Incorrect Answers
A:DNS query logs show name resolution activity, not all application packet flows or their VPC accept/reject action.
B:An IGW provides routing, not the scoped VPC flow records needed to investigate packet acceptance and rejection.
D:Resolver query logs capture DNS queries and responses, not network traffic-flow acceptance/denial for established application TCP connections. VPC Flow Logs provide the relevant flow metadata.
Question 290
A network engineer has VPC Flow Logs showing REJECT for several database connection attempts. The engineer asks for full packet payloads and exact SQL commands directly from the flow log records. Which diagnostic approach is correct?
- Correlate Flow Logs' metadata with security groups, NACLs, routes and application logs; use other tools if payload capture is required.
- Disable NACLs and security groups permanently so Flow Logs have fewer rejected events.
- Read the Flow Logs record as a decrypted full-packet capture containing every SQL statement.
- Assume a REJECT record always means the database password was incorrect.
Explanation
Correct Answer
A:Flow Logs describe flow attributes and acceptance status, not arbitrary decrypted application packet contents. They can point to network filtering that needs configuration review.
Incorrect Answers
B:Removing all filtering sacrifices security instead of using the records to identify the narrowly misconfigured rule.
C:Flow Logs are not packet captures and do not include the full TCP or SQL payload required for application-level reconstruction.
D:Network-layer rejects often occur before a database login is attempted. Authentication logs are a separate evidence source.