AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 78
Question 770
A CloudFront distribution serves mostly public, identical responses, but a subset of uncached routes must forward an Authorization header to the origin for validation. Some cacheable pages also vary by locale. The team wants to maximize cache hits without mixing locale-specific content or withholding required headers. Which policy distinction should be used?
- Forward every request header as a cache-key dimension regardless of whether the origin response varies.
- Configure cache-key and origin request policies deliberately so only response-varying values affect caching while necessary headers reach the origin.
- Exclude every header from both cache key and origin request policy even when the origin requires a locale header.
- Put the locale header in an origin request policy only, while caching locale-specific page variants under one shared key that ignores locale.
Explanation
Correct Answer
B:CloudFront cache policies define which request values vary a cached object, while origin request policies can forward additional values without making them cache-key dimensions. Include locale in the cache key for genuinely locale-specific cached pages, forward Authorization to the uncached protected routes, and preserve correct content isolation.
Incorrect Answers
A:This can fragment the cache unnecessarily and reduce hit ratio.
C:The origin would lose data necessary to build the correct response.
D:Forwarding a header to the origin does not segment cached responses. If the response varies by locale, the cache key must include that variation or the route must bypass caching to avoid serving another locale’s content.
Question 771
A global streaming site needs to investigate an abrupt drop in its CloudFront cache-hit ratio within seconds. The engineering team needs per-request cache-result fields for a particular path pattern, not just aggregate one-minute metrics or delayed daily logs. It can consume records in Kinesis Data Streams and wants to limit observation cost. What should it configure?
- Enable only CloudFront additional real-time metrics and expect each aggregate one-minute datapoint to contain every viewer URI and individual cache-result code.
- Enable CloudFront standard access logging to S3 but assume that it delivers every request with a subsecond latency and per-path sampling controls.
- Attach a CloudFront real-time log configuration to the relevant cache behavior, select cache-result fields and an appropriate sampling rate, and deliver records to Kinesis Data Streams.
- Use Amazon S3 server access logs on the origin bucket to enumerate all requests satisfied entirely from CloudFront edge caches without reaching origin.
Explanation
Correct Answer
C:CloudFront real-time access logs can arrive within seconds in Kinesis Data Streams. The selected fields, cache behavior and sampling percentage let the team inspect live cache outcomes while controlling logging volume.
Incorrect Answers
A:CloudFront real-time metrics are aggregated operational measurements. They do not provide the per-request viewer URL and cache status required by this live request-level diagnosis.
B:Standard access logs serve asynchronous log delivery and do not offer the same seconds-scale Kinesis stream with selectable sample rate and per-cache-behavior real-time fields.
D:Origin-side S3 access logs capture requests that actually arrive at S3. A request served from an edge cache never reaches the origin, so origin logs cannot enumerate all viewer requests or hits.
Question 772
A critical CSS bundle is changed during an emergency deployment. CloudFront's configured long TTL keeps the previous file active under the same URL. Which release strategy should prevent prolonged staleness?
- Increase max-age and assume caches fetch the new bytes sooner.
- Raise the CloudFront minimum TTL above the origin’s Cache-Control max-age and rely on an origin no-cache header to refresh the existing cached URL immediately.
- Change the S3 object metadata and wait for regular edge expiration, without invalidating the old URL or changing the asset filename.
- Use versioned asset filenames or CloudFront invalidations in combination with appropriate cache TTL settings.
Explanation
Correct Answer
D:A new content-addressed/versioned name or invalidation makes the updated object available without waiting for the old TTL.
Incorrect Answers
A:Longer TTL prolongs eligibility of the stale cached response.
B:A positive distribution minimum TTL can keep an object cached even if its origin headers request less caching. It does not remove an already-cached old CSS asset during an emergency deployment.
C:Updating the origin metadata does not force all CloudFront edge locations to discard the old object before their existing cache lifetime elapses. That fails the emergency requirement to prevent prolonged staleness.
Question 773
A hub-and-spoke Transit Gateway connects production and development VPCs. Production traffic must not route directly to development, even though both attachments exist. Which segmentation control is appropriate?
- Associate relevant attachments with deliberately separated TGW route tables and govern propagation/routes according to the allowed paths.
- Put all attachments into one fully propagated route table and rely on their resource names for isolation.
- Use a single S3 access point policy as the network segmentation mechanism for all VPC CIDR traffic.
- Enable public DNS hostnames as the substitute for TGW route isolation.
Explanation
Correct Answer
A:TGW attachments and route-table association/propagation allow centralized connectivity segmentation between environments.
Incorrect Answers
B:Names do not restrict network reachability when routes permit it.
C:S3 access policies only govern S3 authorization, not TGW packet forwarding.
D:DNS naming cannot prevent IP routing across connected attachments.
Question 774
A new VPC is attached to Transit Gateway. Its EC2 hosts can reach one shared services subnet but the return route to the VPC's CIDR is absent from the services TGW route table. Which change is relevant?
- Increase the originating EC2 volume's IOPS to make reply packets find a path.
- Verify both attachment associations and explicit or propagated destination routes for the forward and return traffic.
- Add more unassociated VPC attachments and assume transit gateway automatically permits every return route.
- Enable database read replicas in the destination subnet to fix missing packet routing.
Explanation
Correct Answer
B:A reachable attachment is not enough; route tables on both sides must select a valid destination attachment path.
Incorrect Answers
A:Disk storage performance cannot insert a missing TGW route.
C:New attachments without correct associations or propagation do not create the necessary path.
D:Extra DB instances do not add a missing network next hop.
Question 775
A design grants a route to a destination through Transit Gateway but clients still cannot connect. The endpoint subnet route tables and security groups deny the flow. What is the correct troubleshooting model?
- Assume a TGW route automatically bypasses all security groups attached to source and destination instances.
- Disable every route table inspection because the TGW destination prefix alone guarantees reachability.
- Check end-to-end VPC subnet routes, TGW tables, security groups and NACLs in both directions.
- Use only DNS TTL adjustments to circumvent security group denies on the endpoint.
Explanation
Correct Answer
C:TGW routing is only one layer; VPC routes and network security controls still apply to every forwarded packet.
Incorrect Answers
A:TGW does not grant IAM/network authorization or override instance ingress restrictions.
B:Missing subnet routes can prevent packets from reaching an otherwise valid TGW route.
D:Address resolution is not equivalent to permitted TCP ingress and return traffic.
Question 776
A small startup needs private connectivity between just two VPCs with nonoverlapping IPv4 CIDRs. No transit hub, cross-account central policy or network appliance insertion is needed. Which simple architecture fits?
- Deploy Transit Gateway for two VPCs solely because direct peering is technically impossible.
- Use an S3 gateway endpoint to route arbitrary private TCP packets between VPC application hosts.
- Connect both VPCs to an internet gateway and call the connection a private VPC peering route.
- Create a VPC peering connection and configure the corresponding bidirectional routes and security rules.
Explanation
Correct Answer
D:Peering is suitable for direct private routing between a small number of mutually reachable VPCs.
Incorrect Answers
A:Peering is supported for such a simple pair when CIDRs and routing constraints are satisfied.
B:Gateway endpoints carry eligible AWS service traffic, not general VPC-to-VPC routing.
C:Public internet routing does not create the requested direct private peering path.
Question 777
VPC A peers with B, and B peers with C. An architect expects traffic from A to C to transit B using its two peering connections, even though A and C are not peers. What limitation applies?
- VPC peering is nontransitive; establish direct A-to-C connectivity or use an appropriate routing hub such as TGW.
- Enable route propagation on B's peering connections and assume B becomes a supported transit hub.
- Add a route in A for C’s CIDR through the existing A–B peering connection and expect B to forward the packets into B–C peering.
- Point every VPC default route at the middle VPC’s NAT gateway over peering and assume the gateway is an automatic transitive VPC router.
Explanation
Correct Answer
A:A VPC cannot forward traffic across peering connections as a transitive router by default.
Incorrect Answers
B:Peering does not offer general transitive routing like TGW.
C:VPC peering connections are nontransitive by design. Even with a CIDR route entry, AWS will not turn B into a transit hop that forwards A’s traffic through its separate peering relationship with C.
D:NAT gateway is not a general transitive routing service across two peering connections. Direct peering or a supported transit architecture is needed for private A-to-C connectivity.
Question 778
Two companies plan to peer VPCs that both use 10.10.0.0/16. A route table in each already contains that local range. What must be addressed before peering can provide reliable private IP connectivity?
- Accept the peering request and rely on security group names to disambiguate identical destination addresses.
- Renumber or redesign VPC address allocations to avoid overlapping CIDR blocks and then configure valid routes.
- Add another overlapping secondary IPv4 CIDR to both VPCs and expect VPC peering to translate duplicate destinations automatically.
- Increase the number of NAT gateways without readdressing and assume peering routes become nonoverlapping.
Explanation
Correct Answer
B:Overlapping VPC IP space prevents normal peering reachability because destinations cannot be unambiguously routed.
Incorrect Answers
A:Security group labels do not resolve overlapping IP routing destinations.
C:VPC peering does not provide network address translation for overlapping CIDR blocks. Additional overlapping blocks fail to produce unambiguous private routing between the two existing networks.
D:NAT egress alone does not transform a simple overlapping-CIDR peering connection into a valid direct routing design.
Question 779
A VPC peering connection is in Active state, yet TCP calls fail between workloads. Engineers discover neither side added peer-CIDR routes, and destination security groups block the port. Which step is needed?
- Replace the connection name and wait for automatic network routes to appear.
- Enable an S3 gateway endpoint and expect it to carry all VPC-to-VPC TCP traffic over the peer path.
- Configure peer CIDR routes in the correct subnet route tables and allow the required traffic through each network filter.
- Increase client DNS TTL without checking missing routes and denied ingress.
Explanation
Correct Answer
C:Active peering establishes a potential connection; it does not implicitly alter every subnet route and firewall rule.
Incorrect Answers
A:Renaming peering metadata does not install per-subnet routes.
B:Gateway endpoints only route traffic to supported services, not arbitrary peer workloads.
D:A reachable IP still fails when no packet path or permitted port exists.
Question 780
An app in three AZs needs private access to the Secrets Manager API through interface endpoints. The endpoint is deployed in one subnet, and its security group denies HTTPS from two consumer subnets. What is necessary?
- Assume every interface endpoint is a route-table-only gateway that ignores ENI security groups.
- Grant each consumer EC2 IAM AdministratorAccess to bypass denied endpoint TCP ingress.
- Enable NAT gateway public egress while still requiring all Secrets Manager traffic remain private.
- Place endpoint network interfaces in appropriate AZ/subnets and permit HTTPS from the consumer security groups with valid DNS/routing.
Explanation
Correct Answer
D:An interface endpoint has VPC ENIs and security-group enforcement; clients still require TCP access to its private addresses.
Incorrect Answers
A:An interface VPC endpoint creates elastic network interfaces in selected subnets, and its security groups can control inbound HTTPS from clients. Only gateway endpoints for supported services use route-table entries without endpoint ENIs.
B:IAM privilege does not replace network reachability or the endpoint security group's HTTPS rule.
C:Public egress changes the access path rather than fixing intended private endpoint connectivity.
