AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 77
Question 760
A company serves cached product documentation through CloudFront. For a cache miss, its primary S3 origin may return a configured 503 response during maintenance; a secondary origin has an updated copy. The requirement is to retry GET or HEAD retrieval from the secondary origin when the primary returns that status. What should be configured?
- Configure a Route 53 failover record for each viewer and expect it to change an already chosen CloudFront distribution origin.
- Add a higher S3 object-storage class to the primary origin, which automatically makes CloudFront reroute a 503 to an alternate origin.
- Enable failover for arbitrary HTTP POST mutations through CloudFront origin groups with no method restrictions.
- Use a CloudFront origin group with the primary and secondary origins and include the appropriate failover status code in its origin-failover criteria.
Explanation
Correct Answer
D:CloudFront origin groups can retry supported GET, HEAD, or OPTIONS requests against a secondary origin when a configured response status triggers failover on an origin request. Cached responses do not require origin retrieval.
Incorrect Answers
A:External DNS routing does not configure the origin selection policy inside an existing CloudFront distribution.
B:Changing an S3 storage class does not define a secondary CloudFront origin or failover trigger.
C:CloudFront origin failover is limited to supported read-style methods and does not apply to arbitrary POST requests.
Question 761
A TCP financial-protocol service needs a stable Layer-4 entry point and managed TLS termination, but does not require HTTP header inspection. Which listener should be assessed?
- Configure a supported TLS listener on a Network Load Balancer with appropriate certificates and target transport.
- Use a UDP listener with no TLS because all UDP payloads automatically receive TLS encryption.
- Use only an ALB HTTP listener and assume it handles an arbitrary custom binary protocol without HTTP framing.
- Use an S3 static website endpoint as the binary TCP/TLS network front door.
Explanation
Correct Answer
A:NLB can terminate TLS at Layer 4 while retaining an architecture built around TCP connections.
Incorrect Answers
B:A UDP listener does not implement a TCP/TLS connection handshake.
C:ALB application listeners expect supported HTTP-style requests, not any binary TCP stream.
D:S3 website hosting is HTTP content delivery, not a TCP proxy.
Question 762
A company selects an NLB for very high-performance TCP sessions. Later it asks for `/admin/*` HTTP routes to a different target group based on path. What design limitation must be addressed?
- Add NLB TCP listener rules that match the URL path as if TCP contained decoded HTTP application fields.
- Introduce an ALB or an HTTP-aware application proxy when URL path and host-header rules are required.
- Reduce NLB cross-zone balancing to make the HTTP URL path visible to its TCP layer.
- Use Route 53 weighted DNS to inspect individual URL paths under one hostname.
Explanation
Correct Answer
B:NLB routes at Layer 4 and does not perform ALB-style HTTP content inspection for path-based listener rules.
Incorrect Answers
A:NLB listener rules do not offer ALB HTTP path conditions.
C:Cross-zone forwarding behavior does not implement application-layer routing.
D:DNS answers precede HTTP requests and cannot see a request's `/admin` suffix.
Question 763
A Gateway Load Balancer is already deployed with a registered fleet of packet-inspection appliances. Targets are unhealthy even though the appliance processes normal TCP 443 user traffic. A packet capture shows no accepted GENEVE traffic on the appliance network interface. Which network configuration is required for the GWLB-to-appliance data path?
- Expose only TCP 443 on the appliances and assume GWLB uses that port for its encapsulated target data path.
- Configure the appliance target group as an ALB HTTP target group with path `/health` rather than the supported GENEVE protocol.
- Ensure the virtual appliance can decapsulate GENEVE traffic and its network controls permit UDP port 6081 between Gateway Load Balancer and appliance targets.
- Replace the appliance software with an S3 static website, which can decode GENEVE encapsulated packets.
Explanation
Correct Answer
C:Gateway Load Balancer uses GENEVE on UDP port 6081 to exchange encapsulated traffic with compatible appliances. The targets need supported decapsulation and appropriate route, security group, and NACL settings; target health checks also require proper configuration.
Incorrect Answers
A:Application-layer HTTPS on TCP 443 is not the transport GWLB uses for encapsulating forwarded packets.
B:GWLB appliance target groups use GENEVE, not ALB HTTP application target-group semantics.
D:S3 website hosting does not provide a virtual network appliance or a GENEVE implementation.
Question 764
A GWLB endpoint and appliance fleet have been deployed, but traffic between private subnets continues bypassing inspection. Route tables still point directly to the normal next hop. What is required?
- Scale the GWLB target group to more appliances without changing the bypass routes.
- Rename the gateway load balancer to include the destination subnet CIDR.
- Add an S3 bucket policy to redirect all VPC traffic to the security appliance.
- Update the relevant VPC route tables to direct the intended traffic through the GWLB endpoint, retaining valid return paths.
Explanation
Correct Answer
D:Deploying an appliance endpoint does not automatically alter every VPC route; explicit routing determines which flows are inspected.
Incorrect Answers
A:Extra appliances remain unused if packet paths never traverse the endpoint.
B:A resource name does not install a route-table next hop.
C:S3 authorization applies to S3 API requests, not general VPC route decisions.
Question 765
A stateful firewall fleet behind Gateway Load Balancer sees return packets through a different appliance or bypass route. Sessions fail because only one side of the flow is inspected by a given firewall state table. What must routing preserve?
- Design symmetric forward and return inspection paths with the appropriate GWLB stickiness and appliance-state handling.
- Enable independent random routing for forward and return packets across unrelated appliances.
- Disable all return routing to force clients to retry through the original appliance.
- Increase CloudFront edge cache TTL because a packet-flow symmetry problem is caused by stale CDN objects.
Explanation
Correct Answer
A:Stateful inspection needs a coherent per-flow view; asymmetric packet handling can make legitimate return traffic look unsolicited.
Incorrect Answers
B:Uncoordinated flow paths can separate connection setup from corresponding stateful inspection.
C:Dropping return traffic cannot provide a functional symmetric application session.
D:A private network firewall state issue is not an edge HTTP cache issue.
Question 766
A design review uses the term gateway load balancer and assumes it accelerates cached website images to customers worldwide, exactly like CloudFront. Which distinction should guide architecture?
- Use GWLB as an out-of-the-box static object edge cache with global HTTP POPs.
- Use Gateway Load Balancer for inline packet-processing appliances and CloudFront when HTTP edge caching/delivery is needed.
- Use CloudFront to transparently inject third-party GENEVE inspection appliances into all private subnets.
- Use EBS Multi-Attach as a global network CDN because multiple instances can see one volume.
Explanation
Correct Answer
B:GWLB is a network security appliance distribution component; CloudFront is a content-delivery service operating closer to viewers.
Incorrect Answers
A:GWLB does not implement CloudFront cache behaviors and edge object storage.
C:CloudFront does not provide GWLB's route-table-level inline packet insertion.
D:Block volume sharing has no bearing on global content delivery or firewall appliance distribution.
Question 767
A product website's bottleneck is repeated static image and CSS downloads from a single regional S3 origin. An engineer proposes AWS Global Accelerator to cache image bytes at edge locations. What is the proper service?
- Use Global Accelerator alone as the object cache because its anycast IPs persist entire S3 images by default.
- Replace the image origin with an NLB-backed HTTP service and rely on NLB connection distribution alone for edge object caching.
- Use CloudFront with caching policies for HTTP assets; reserve Global Accelerator for appropriate network endpoint routing/acceleration.
- Use Route 53 latency routing as a substitute for serving cached object bytes from nearby POPs.
Explanation
Correct Answer
C:CloudFront maintains edge caches of supported application content; Global Accelerator improves routing to configured regional endpoints without being a page cache.
Incorrect Answers
A:Anycast routing does not imply storage and caching of HTTP responses.
B:A Network Load Balancer can distribute network connections to targets but does not store or serve cached HTTP assets at edge locations. CloudFront provides the content distribution and caching missing from this proposal.
D:DNS choice alone cannot create copies of the origin's static assets.
Question 768
A standard AWS Global Accelerator has one endpoint group in us-east-1 containing two healthy Application Load Balancer endpoints: an established release and a new canary release. The operations team wants approximately 5% of connections directed to the canary while keeping the Region’s overall traffic dial unchanged at 100%. What should they adjust?
- Reduce the endpoint-group traffic dial to 5%; this sends exactly 5% of that Region’s accepted connections only to the canary endpoint.
- Create Route 53 weighted aliases for the two ALB hostnames, but leave accelerator endpoint weights unchanged while all clients continue using its fixed anycast IP addresses.
- Keep Global Accelerator endpoint weights equal and shorten an ALB target-group stickiness duration until the canary receives approximately 5% of new accelerator connections.
- Assign a small relative weight to the canary endpoint and a much larger weight to the established endpoint within the same Global Accelerator endpoint group.
Explanation
Correct Answer
D:Endpoint weights control relative traffic share across healthy endpoints in one endpoint group. A low canary weight compared with the established endpoint produces a small test portion, subject to health and availability exceptions.
Incorrect Answers
A:A regional traffic dial changes the portion directed to the endpoint group across Regions; it does not divide connections between two individual ALB endpoints inside the same group.
B:A DNS policy for different hostnames does not determine how an already used Global Accelerator anycast address distributes incoming connections among registered endpoints.
C:An ALB session-stickiness setting affects routing after the connection has reached an ALB; it cannot set Global Accelerator’s initial division of connections between separate ALB endpoints.
Question 769
A voice gaming platform evaluates Global Accelerator for UDP sessions while another team expects it to cache HTML documents and accept any proprietary Layer-2 framing. Which validation is necessary?
- Match the accelerator's supported TCP/UDP listeners, endpoint types and ports to the application protocol; use a CDN separately for caching.
- Assume it accepts any Layer-2 transport and caches its contents without protocol configuration.
- Deploy it as the only storage system for HTML and expect originless object retrieval.
- Choose every listener port solely from the Route 53 hosted-zone record type.
Explanation
Correct Answer
A:Global Accelerator provides supported Layer-4 endpoint acceleration, not a universal packet encapsulation or HTTP object-cache service.
Incorrect Answers
B:The product has defined listener protocols and regional endpoint integration.
C:Acceleration routes traffic to endpoints; it is not persistent object storage.
D:DNS record type does not establish which traffic protocols or ports a listener can terminate.
Question 770
A CloudFront distribution serves mostly public, identical responses, but a subset of uncached routes must forward an Authorization header to the origin for validation. Some cacheable pages also vary by locale. The team wants to maximize cache hits without mixing locale-specific content or withholding required headers. Which policy distinction should be used?
- Forward every request header as a cache-key dimension regardless of whether the origin response varies.
- Configure cache-key and origin request policies deliberately so only response-varying values affect caching while necessary headers reach the origin.
- Exclude every header from both cache key and origin request policy even when the origin requires a locale header.
- Put the locale header in an origin request policy only, while caching locale-specific page variants under one shared key that ignores locale.
Explanation
Correct Answer
B:CloudFront cache policies define which request values vary a cached object, while origin request policies can forward additional values without making them cache-key dimensions. Include locale in the cache key for genuinely locale-specific cached pages, forward Authorization to the uncached protected routes, and preserve correct content isolation.
Incorrect Answers
A:This can fragment the cache unnecessarily and reduce hit ratio.
C:The origin would lose data necessary to build the correct response.
D:Forwarding a header to the origin does not segment cached responses. If the response varies by locale, the cache key must include that variation or the route must bypass caching to avoid serving another locale’s content.
