Amazon AWS SAA-C03 Cost-Optimized Networking, NAT, Endpoints, Connectivity, Routing, and Edge Caching Practice Test 2

 

Topic 20 Practice Test 2 covers Cost-Optimized Networking, NAT, Endpoints, Connectivity, Routing, and Edge Caching for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

An application VPC sends heavy DynamoDB traffic through a NAT gateway. A neighboring shared-services VPC already has a DynamoDB gateway endpoint, and the team proposes routing to that endpoint over VPC peering. What is the correct cost-optimized design?

1. Route the application VPC through the shared-services gateway endpoint over peering for this workload
2. Replace the peering connection with Transit Gateway and keep the single endpoint
3. Create a DynamoDB gateway endpoint in the application VPC and associate its route tables
4. Add another NAT gateway in the shared-services VPC for the stated production traffic path

Correct Answer(s)

 

C

Rationale

1. VPC peering provides private VPC-to-VPC routing, but gateway endpoints are not transitive resources that a peered VPC can consume through another VPC’s route table. In this scenario, the proposed shared gateway endpoint path is unsupported, so paying for this component would not solve the stated problem.
2. Transit Gateway adds transitive routing capabilities, but gateway endpoints still cannot be reached through a transit gateway from another VPC. The option is technically valid in other designs, but the endpoint must exist in the VPC whose route tables send traffic to DynamoDB; it does not optimize the required traffic path.
3. Gateway endpoints are VPC-specific route-table targets and cannot be extended through VPC peering, VPN, Transit Gateway, or Direct Connect; creating the endpoint locally provides private DynamoDB access with no additional endpoint charge. Here, the application VPC cannot reuse the neighboring gateway endpoint and can eliminate its own NAT path; that removes the paid network path the workload does not need.
4. Another NAT gateway would add fixed and processing charges and still would not turn the existing gateway endpoint into a shareable transitive resource. Here, the application can use its own no-additional-charge DynamoDB gateway endpoint instead; this alternative adds cost or capability that the workload does not require.

 

Question 2

An EKS cluster in private subnets pulls images from private Amazon ECR repositories. The team wants nodes to pull images without a NAT gateway. Which THREE endpoint paths are required for the standard private ECR image-pull flow? (Choose THREE.) (Choose 3.)

1. An egress-only internet gateway for the current application path
2. An interface endpoint for the Amazon ECR API
3. An interface endpoint for the Amazon ECR Docker registry
4. An S3 gateway endpoint for the stated client traffic

Correct Answer(s)

 

B, C, D

Rationale

1. An egress-only internet gateway supports outbound IPv6 internet access and is unrelated to the private endpoint set required for ECR and S3 service traffic. The architecture needs a different lever because the design specifically removes internet/NAT dependency by using VPC endpoints; this option would not materially reduce the targeted spend.
2. The ECR API endpoint lets private clients make control-plane calls such as obtaining authorization and repository metadata through PrivateLink. In the stated architecture, ECR control-plane communication must stay on private VPC connectivity; choosing this option targets the measured source of spend.
3. The ECR Docker endpoint carries registry operations used when container runtimes fetch image manifests and layers through the ECR registry interface. The scenario is governed by the fact that the runtime must reach the private ECR registry without internet egress, making this the economical design under the given constraints.
4. Amazon ECR stores image layers in Amazon S3, so private image pulls need an S3 path as well; a gateway endpoint supplies that route without NAT processing. With image layer downloads must reach S3 privately in addition to the ECR endpoints, this option avoids paying for capacity or processing that provides no required benefit.

 

Question 3

A CloudFront distribution serves JavaScript, CSS, and JSON responses that compress well. Viewer traffic is high, but compression is disabled. Which change can reduce bytes delivered to clients without changing application content?

1. Enable CloudFront compression for supported Gzip and Brotli responses
2. Add all viewer headers to the cache key
3. Disable edge caching for the compressed file types
4. Move the distribution behind a NAT gateway

Correct Answer(s)

 

A

Rationale

1. CloudFront can compress eligible objects for viewers that advertise supported encodings, and smaller transferred objects can reduce data-transfer volume while preserving the original application semantics. Operationally, the dominant content types compress efficiently and client bandwidth, not origin placement, is the targeted cost; the option therefore reduces unnecessary transfer or fixed networking charges.
2. Adding headers creates more cache variants and can lower cache efficiency; it does not inherently reduce the size of each response transferred to viewers. The scenario specifies that the requirement is fewer bytes per response rather than more request differentiation; this alternative does not align with that traffic or billing characteristic.
3. Disabling caching sends more requests to the origin and removes reuse benefits while leaving response payload size unchanged unless another layer compresses it. Using this would be reasonable only under different constraints, because the optimization should preserve or improve caching while reducing payload bytes; the current requirement points elsewhere.
4. CloudFront is a public edge service and does not require a customer NAT gateway for viewer delivery; inserting NAT would not compress objects. This does not fit the cost model: the cost lever is content encoding at the edge; another choice removes the unnecessary network charge more directly.

 

Question 4

A web application publishes immutable assets with content hashes in their filenames, such as app.8f21.js. CloudFront currently expires these objects after five minutes, producing frequent origin fetches. What change is most cost-effective?

1. Forward every cookie to the origin for the asset behavior
2. Set the TTL to zero so CloudFront validates every request
3. Replace CloudFront with an interface VPC endpoint for these application flows
4. Use a much longer cache TTL for the versioned immutable assets

Correct Answer(s)

 

D

Rationale

1. Cookies can be part of personalization or authentication, but forwarding them for immutable static assets creates cache variations and extra origin requests without changing the files. The mismatch is that the asset name already identifies content and no per-user rendering is needed; this option introduces or retains charges that the preferred design avoids.
2. A zero TTL defeats long-lived edge reuse and would increase origin validation or retrieval work for objects that never change under the same key. In context, the application already uses versioned names that make aggressive caching safe; this would spend money on a capability that is not required.
3. Interface endpoints provide private VPC access to supported services and do not cache public web assets near users. The workload does not benefit from this choice because the optimization concerns CDN cache lifetime, not private service reachability; its primary cost remains unchanged.
4. Content-hashed filenames let new object versions use new keys, so old objects can safely remain cached for long periods without serving a later release under the same name. The workload profile shows that the assets are immutable by key and the short TTL is causing avoidable origin requests; this design is therefore the best financial fit without breaking the requirement.

 

Question 5

A single-Region business application serves users mostly near that Region. Its current public Application Load Balancer meets latency and availability targets. A proposal adds AWS Global Accelerator solely because ‘global networking is faster,’ but no measurable performance problem exists. What is the cost-optimized decision?

1. Add Global Accelerator and keep every existing component unchanged for the affected private network flow
2. Keep the regional ALB design and do not add Global Accelerator without a justified requirement
3. Replace the ALB with Transit Gateway as the main routed network path for this application
4. Add Direct Connect for all internet users as the main network path for this workload

Correct Answer(s)

 

B

Rationale

1. Global Accelerator can improve global path performance and failover, but adding it to a satisfied single-Region workload increases cost without addressing a measured constraint. Applying this service would not help here, since there is no global latency, static-IP, or multi-Region availability requirement; the scenario calls for a more targeted network change.
2. Global Accelerator adds dedicated service charges in exchange for static anycast addresses, AWS-backbone routing, and global endpoint health features; those benefits should be tied to a real business need. Since the measured traffic pattern shows that the existing one-Region application already meets performance and availability objectives, this selection avoids paying for unused network features.
3. Transit Gateway connects VPC and hybrid networks and does not provide public HTTP load balancing for end users. The design goal is narrower than this option assumes because the application still needs a regional public load balancer rather than a network transit hub; the added capability is not justified by the savings.
4. Direct Connect is private connectivity between customer networks and AWS, not a mechanism for arbitrary public clients to reach a web application. This is not the best answer because the user population is public and already receives acceptable internet performance; the proposed component does not change the expensive path identified.

 

Question 6

Twenty small VPCs each contain the same six interface endpoints for common AWS services. Endpoint hourly charges dominate because traffic per VPC is tiny. The VPCs already attach to a Transit Gateway, and central DNS/routing can be managed safely. Which design should be cost-modeled?

1. Add duplicate interface endpoints to every Availability Zone in every VPC as the primary route for this traffic
2. Centralize the interface endpoints in a shared services VPC and route eligible consumers through the existing Transit Gateway
3. Replace all interface endpoints with S3 gateway endpoints as the primary network path for all affected workloads
4. Assign public IPv4 addresses to all workloads and delete private endpoints as the selected route for these requests

Correct Answer(s)

 

B

Rationale

1. Additional zonal endpoint ENIs can improve locality and resilience, but multiplying them further would increase the fixed cost that the company is trying to reduce. In this scenario, traffic is light and the issue is endpoint proliferation, not inadequate endpoint availability, so paying for this component would not solve the stated problem.
2. A shared endpoint VPC can reduce the number of paid interface endpoint ENIs across many low-volume VPCs, though Transit Gateway and cross-AZ processing must be included in the comparison. Here, fixed endpoint charges dominate and a transit hub already exists for controlled shared connectivity; that removes the paid network path the workload does not need.
3. Gateway endpoints have no additional charge but only support specific services such as S3 and DynamoDB; they cannot stand in for six arbitrary PrivateLink services. The option is technically valid in other designs, but the shared services require interface endpoint capabilities; it does not optimize the required traffic path.
4. Direct public access could remove endpoint charges but changes the security and routing model and adds public address and internet-path considerations. Here, the organization wants to retain private service access while reducing duplicate endpoint infrastructure; this alternative adds cost or capability that the workload does not require.

 

Question 7

A company is considering the new flat-rate Direct Connect pricing for a dedicated connection that reaches several AWS Regions. Ninety-five percent of traffic comes from two Regions, while the remaining Regions send very little data. How should it select a pricing tier?

1. Always choose the highest tier because all Regions must be included as the main path for this workload
2. Use SiteLink because it is included in every flat-rate tier as the selected network route for these requests
3. Replace the Direct Connect gateway with an internet gateway as the main routed network path for this application
4. Choose the lowest flat-rate tier covering the high-volume Regions and compare standard DTO for the small out-of-tier flows

Correct Answer(s)

 

D

Rationale

1. Higher tiers cover more Regions but cost more, so including low-volume Regions is not automatically economical when their standard DTO is less than the tier price difference. Because only a small fraction of traffic originates outside the primary Regions, this approach would not remove the charge or transfer pattern identified in the question.
2. Direct Connect SiteLink data transfer is billed separately and is not included by flat-rate pricing tiers, so it should not be assumed free. For the stated workload, the decision concerns regional tier coverage rather than location-to-location SiteLink traffic; selecting this would optimize the wrong layer.
3. An internet gateway would not preserve the dedicated hybrid connectivity or the flat-rate Direct Connect arrangement and does not solve tier selection. The architecture needs a different lever because the company intends to retain the dedicated connection and optimize its pricing coverage; this option would not materially reduce the targeted spend.
4. Direct Connect flat-rate tiers cover port hours and qualifying data transfer for Regions in the selected tier, while traffic from Regions outside that tier is billed at standard Direct Connect rates. In the stated architecture, most traffic is concentrated and paying for a broader tier may cost more than the small residual DTO; choosing this option targets the measured source of spend.

 

Question 8

A finance team wants to see whether NAT Gateway, inter-Availability-Zone transfer, or CloudFront spend has trended upward over the last six months, with interactive filtering by service and usage category. Which AWS tool best fits this analysis?

1. AWS Cost Explorer
2. AWS Budgets
3. VPC Flow Logs
4. AWS CloudTrail

Correct Answer(s)

 

A

Rationale

1. Cost Explorer provides interactive visualization and filtering of historical AWS cost and usage data, making it appropriate for trend analysis by service and usage dimensions before deeper line-item investigation. Operationally, the team needs exploratory historical network-cost trends rather than a raw export or an enforcement control; the option therefore reduces unnecessary transfer or fixed networking charges.
2. AWS Budgets tracks actual or forecast spend against configured thresholds and can notify or trigger actions, but it is not the primary interactive tool for exploring detailed six-month trends. The scenario specifies that the immediate task is analysis and filtering, not threshold alerting; this alternative does not align with that traffic or billing characteristic.
3. Flow Logs show network-flow metadata and byte counts but do not present the AWS billing history or service-level cost trend requested by finance. Using this would be reasonable only under different constraints, because the question asks how billed network categories changed over time; the current requirement points elsewhere.
4. CloudTrail records API actions for audit and investigation, not summarized historical network-service costs and data-transfer spending. This does not fit the cost model: the finance team needs cost exploration rather than control-plane event history; another choice removes the unnecessary network charge more directly.

 

Question 9

An organization wants an email warning when forecasted monthly data-transfer and networking spend is expected to exceed a defined dollar limit, before the bill closes. Which service should be configured?

1. AWS Cost Explorer saved report only
2. VPC Flow Logs delivered to Amazon S3
3. AWS Budgets with a forecasted cost alert
4. Route 53 health checks for these requests

Correct Answer(s)

 

C

Rationale

1. Cost Explorer can analyze trends and forecasts, but a saved report by itself is not the budget-threshold notification mechanism described. The mismatch is that the team needs an alert tied to a defined spending limit; this option introduces or retains charges that the preferred design avoids.
2. Flow Logs provide technical traffic records and can support analysis, but they do not natively compare forecasted AWS charges to a financial threshold and notify finance. In context, the trigger is projected cost rather than a particular flow event; this would spend money on a capability that is not required.
3. AWS Budgets can track cost or usage against configured limits and notify on actual or forecasted values, making it suitable for proactive guardrails around network spend. The workload profile shows that the requirement is a threshold-based forecast notification before month end; this design is therefore the best financial fit without breaking the requirement.
4. Route 53 health checks monitor endpoint health and can influence DNS failover; they do not forecast network billing or enforce monthly cost thresholds. The workload does not benefit from this choice because the requirement is financial monitoring rather than availability detection; its primary cost remains unchanged.

 

Question 10

An analyst must reconcile a network-cost anomaly to exact billing line items across accounts, including usage types and cost-allocation tags, and then query the exported data with SQL. Which billing data source is the best fit?

1. AWS Cost Explorer
2. Amazon CloudWatch metrics
3. AWS Config for this design
4. AWS Cost and Usage Report

Correct Answer(s)

 

D

Rationale

1. Cost Explorer is strong for interactive cost visualization and filtering, but the requirement calls for the most granular exported line items to support custom SQL reconciliation. Applying this service would not help here, since the investigation needs a detailed dataset that can be queried outside the console; the scenario calls for a more targeted network change.
2. CloudWatch stores operational metrics and can show service behavior, but it is not the authoritative granular billing export for AWS cost and usage line items. The design goal is narrower than this option assumes because the requested fields are billing usage types, account costs, and allocation tags; the added capability is not justified by the savings.
3. AWS Config records resource configurations and compliance history, which can explain topology changes but does not provide detailed charge line items for financial reconciliation. This is not the best answer because the task is cost accounting rather than configuration-state auditing; the proposed component does not change the expensive path identified.
4. The Cost and Usage Report provides highly granular AWS billing and usage records that can include resource and tag dimensions and can be delivered for downstream querying and reconciliation. Since the measured traffic pattern shows that the analyst needs line-level exported billing data rather than only interactive charts, this selection avoids paying for unused network features.

 

Question 11

Before redesigning a VPC to reduce transfer charges, an architect needs to identify the largest source-destination byte flows between network interfaces and determine whether traffic is crossing unexpected subnets. Which telemetry should be enabled?

1. AWS Budgets at the account level for the affected network flow
2. VPC Flow Logs on the relevant VPC, subnets, or network interfaces
3. CloudFront standard logs only as the primary route for this traffic
4. IAM Access Analyzer as the main network path for this workload

Correct Answer(s)

 

B

Rationale

1. Budgets can notify when spending crosses thresholds, but they do not show individual source-destination network conversations or subnet-level traffic paths. In this scenario, the investigation requires technical flow visibility before a topology change, so paying for this component would not solve the stated problem.
2. VPC Flow Logs capture metadata about IP traffic, including addresses, ports, actions, and byte or packet information depending on the selected format, which supports finding high-volume network paths. Here, the architect first needs traffic evidence about who is communicating and how much; that removes the paid network path the workload does not need.
3. CloudFront logs describe viewer requests handled by a distribution and do not capture arbitrary east-west or subnet traffic inside a VPC. The option is technically valid in other designs, but the suspected cost comes from internal VPC paths rather than only CDN delivery; it does not optimize the required traffic path.
4. Access Analyzer evaluates resource access and policy exposure; it does not measure network-flow bytes between interfaces or reveal top talkers. Here, the required evidence is traffic volume, not permissions relationships; this alternative adds cost or capability that the workload does not require.

 

Question 12

A shared inspection VPC is connected through Transit Gateway. A new route sends all traffic between two application subnets in the same VPC through the inspection VPC, even though policy does not require inspection for that internal flow. The change materially increased processed bytes. What is the cost-optimized correction?

1. Add another Transit Gateway to split the same internal flow as the main routed network path for this production application
2. Send the internal flow through a NAT gateway instead as the primary network path for all affected workloads operationally
3. Restore a direct local VPC path for the exempt internal flow and reserve transit inspection for traffic that requires it
4. Replicate the application into another Region as the selected private network route for all application requests for these application flows

Correct Answer(s)

 

C

Rationale

1. A second transit hub would add networking resources and would not remove the unnecessary decision to hairpin local traffic through a paid transit path. Because the traffic does not need any transit gateway for this approved local communication, this approach would not remove the charge or transfer pattern identified in the question.
2. NAT gateways are for address translation and would add their own processing charge without satisfying a requirement that is absent from this VPC-local flow. For the stated workload, the best optimization is to avoid the externalized path altogether; selecting this would optimize the wrong layer.
3. VPC-local routing can keep traffic inside the VPC without sending every byte through Transit Gateway attachments and inspection appliances, avoiding unnecessary transit processing when security policy permits. In the stated architecture, the specific east-west flow is exempt from inspection and the detour is the newly measured cost source; choosing this option targets the measured source of spend.
4. A second Region would introduce more deployment and possible transfer costs while failing to address the unnecessary local transit detour. The architecture needs a different lever because the issue is routing within one VPC rather than regional capacity or disaster recovery; this option would not materially reduce the targeted spend.

 

Question 13

A SaaS provider has one TCP service in a producer VPC and must expose only that service privately to hundreds of customer VPCs. Customers must not receive broad routed access to the producer network. Which connectivity model should the provider evaluate?

1. Publish the service with AWS PrivateLink and let customers create interface endpoints
2. Create a full-mesh VPC peering connection to every customer VPC
3. Attach every customer VPC to the provider’s internet gateway for these requests
4. Give the service a public IP and use CloudFront for this design

Correct Answer(s)

 

A

Rationale

1. PrivateLink exposes specific services through private endpoints without requiring full network peering or transitive routing, allowing consumers to reach the service while the provider keeps its VPC address space isolated. Operationally, the requirement is service-level private access for many consumers rather than general VPC-to-VPC connectivity; the option therefore reduces unnecessary transfer or fixed networking charges.
2. Peering provides broad IP connectivity between VPCs and becomes operationally cumbersome at large consumer counts, while also creating address-overlap and routing-management considerations. The scenario specifies that customers should reach one service, not the producer network as a whole; this alternative does not align with that traffic or billing characteristic.
3. Internet gateways are attached to VPCs, not shared across unrelated customer VPCs, and would not provide the required private service exposure model. Using this would be reasonable only under different constraints, because the service must remain privately reachable without broad public access; the current requirement points elsewhere.
4. CloudFront is intended for HTTP content delivery and a public endpoint would violate the private-only service requirement for an arbitrary TCP service. This does not fit the cost model: the design calls for selective private connectivity to many independent consumers; another choice removes the unnecessary network charge more directly.

 

Question 14

A company already operates one NAT gateway for several private subnets because workloads must access many external APIs. A new application makes only a few hundred KMS API calls per month. Adding a KMS interface endpoint would introduce additional endpoint hourly charges. What should the architect do first?

1. Compare the incremental interface-endpoint cost with the tiny KMS traffic through the already-required NAT gateway before adding the endpoint
2. Add the KMS interface endpoint automatically because every endpoint is free as the selected network route for these requests
3. Create an S3 gateway endpoint for KMS calls as the main routed network path for this production application operationally
4. Deploy another NAT gateway dedicated to KMS as the primary network path for all affected workloads where practical

Correct Answer(s)

 

A

Rationale

1. Interface endpoints add fixed hourly and per-GB charges, while the existing NAT cost is already required for unrelated internet traffic; very low incremental KMS volume may not justify another endpoint on cost grounds alone. The workload profile shows that the NAT gateway cannot be removed and KMS traffic is negligible; this design is therefore the best financial fit without breaking the requirement.
2. Interface endpoints are billed for endpoint hours and data processing, so they are not universally free and should be evaluated against the traffic and architecture they replace. The mismatch is that this low-volume service does not drive the existing NAT gateway cost; this option introduces or retains charges that the preferred design avoids.
3. Gateway endpoints for S3 and DynamoDB do not provide KMS API connectivity, so this would not change the KMS traffic path. In context, the destination service requires a KMS-capable interface endpoint if an endpoint is chosen; this would spend money on a capability that is not required.
4. A second NAT gateway would add fixed and processing charges for a tiny flow and would not provide a cost benefit over the already-required egress path. The workload does not benefit from this choice because the existing NAT has ample capacity and remains necessary for other APIs; its primary cost remains unchanged.

 

Question 15

A high-traffic domain in Route 53 points to an Application Load Balancer. The team currently uses a CNAME on a subdomain and is reviewing DNS-query cost. Which record type can route directly to the ALB while avoiding Route 53 query charges for the AWS-resource alias?

1. Keep the CNAME because Route 53 never bills CNAME queries for these application flows
2. Create a private hosted zone for the public application for the current application path
3. Use a Route 53 alias A/AAAA record that targets the Application Load Balancer
4. Replace Route 53 with a NAT gateway as the selected route for these requests

Correct Answer(s)

 

C

Rationale

1. Route 53 charges for CNAME queries, and a CNAME can also trigger another resolver lookup for the target name, depending on the configuration. Applying this service would not help here, since the objective is specifically to reduce DNS query charges for an AWS resource target; the scenario calls for a more targeted network change.
2. Private hosted zones answer DNS inside associated VPCs and are not a substitute for public DNS resolution for internet users. The design goal is narrower than this option assumes because the application must remain publicly resolvable while pointing to the ALB; the added capability is not justified by the savings.
3. Route 53 alias records can target supported AWS resources such as Elastic Load Balancing load balancers, and Route 53 does not charge for alias queries to those AWS resources. Since the measured traffic pattern shows that the DNS target is an ALB and the team wants to remove billable Route 53 CNAME-query handling, this selection avoids paying for unused network features.
4. A NAT gateway performs outbound address translation for private workloads and provides no authoritative DNS-record function for an internet-facing domain. This is not the best answer because the optimization concerns DNS query billing, not VPC egress translation; the proposed component does not change the expensive path identified.

 

Question 16

A gaming backend uses two Site-to-Site VPN connections solely to aggregate throughput, but traffic studies show peak usage now fits comfortably within one connection’s supported tunnel capacity. Availability requirements are satisfied by the two tunnels that come with a single VPN connection. What should be evaluated?

1. Add two more VPN connections to improve cost efficiency for the current private application path
2. Remove the second VPN connection and keep one properly configured connection with its redundant tunnels
3. Replace the VPNs with CloudFront as the selected private network route for all application requests
4. Put the VPN traffic through a NAT gateway as the primary route for this traffic

Correct Answer(s)

 

B

Rationale

1. Additional VPN connections can increase aggregate path options or throughput but add hourly charges and operational complexity rather than reducing cost when unused. In this scenario, current measured load already fits within one redundant connection, so paying for this component would not solve the stated problem.
2. An AWS Site-to-Site VPN connection includes two tunnels for redundancy, while each additional VPN connection adds connection-hour cost; excess parallel connections should be justified by throughput or routing requirements. Here, measured traffic no longer needs the second connection for bandwidth and one connection meets the resilience requirement; that removes the paid network path the workload does not need.
3. CloudFront accelerates and caches HTTP content for viewers but is not a general private IPsec connection between a customer network and VPC resources. The option is technically valid in other designs, but the application still needs hybrid network connectivity, just not duplicate paid connections; it does not optimize the required traffic path.
4. NAT gateways do not aggregate or replace IPsec VPN connections and would add processing charges on a path that already has sufficient capacity. Here, the cost issue is excess VPN connection count rather than address translation; this alternative adds cost or capability that the workload does not require.

 

Question 17

An API Gateway HTTP API forwards requests to a backend that is expensive to run. A partner integration occasionally sends bursts far above the agreed request rate, creating avoidable backend scaling and transfer. Which control should be applied to the partner’s access pattern?

1. Increase the NAT gateway count for the backend subnets
2. Provision a larger Direct Connect port for the stated client traffic
3. Disable CloudFront compression as the main network path for this workload
4. Configure appropriate API Gateway throttling or quota controls for the partner

Correct Answer(s)

 

D

Rationale

1. More NAT gateways can improve zonal egress design but do not limit inbound API request rates or enforce a partner’s consumption agreement. Because the required action is admission control rather than more outbound capacity, this approach would not remove the charge or transfer pattern identified in the question.
2. Direct Connect bandwidth affects hybrid transport and cannot enforce per-partner request rates on a public API Gateway endpoint. For the stated workload, the bottleneck is excessive request volume, not insufficient private WAN bandwidth; selecting this would optimize the wrong layer.
3. Disabling compression would increase transferred bytes for compressible responses and would not stop the partner from exceeding the API request rate. The architecture needs a different lever because the optimization requires throttling requests before backend work occurs; this option would not materially reduce the targeted spend.
4. API Gateway supports request throttling and quota mechanisms that can constrain client consumption before excess calls reach downstream services, helping align backend utilization with an agreed traffic envelope. In the stated architecture, the cost spike comes from partner bursts that exceed a defined request rate; choosing this option targets the measured source of spend.

 

Question 18

An enterprise has one Direct Connect connection and now needs private north-south access from the same data center to VPCs in three AWS Regions. A proposal orders a separate physical Direct Connect connection for each Region. Which architecture should be evaluated first?

1. Order a dedicated Direct Connect circuit in every Region by default for these application flows
2. Use VPC peering from the data center to each VPC for the current application path
3. Use a Direct Connect gateway with the existing connection and associate the required VPC gateways
4. Create S3 gateway endpoints in all three VPCs as the selected route for these requests

Correct Answer(s)

 

C

Rationale

1. Separate circuits may be justified for capacity, location diversity, or resilience, but they are not inherently required merely because VPCs exist in multiple Regions. The scenario specifies that the existing connection can use a global Direct Connect gateway for the stated north-south reach; this alternative does not align with that traffic or billing characteristic.
2. VPC peering connects VPC address spaces and does not terminate an on-premises physical Direct Connect link or act as the hybrid gateway for a data center. Using this would be reasonable only under different constraints, because one side of each required path is on premises rather than another VPC; the current requirement points elsewhere.
3. A Direct Connect gateway can extend a Direct Connect connection to VPCs in multiple AWS Regions through supported virtual gateway associations, allowing one physical connection to serve a broader set of VPC destinations. Operationally, the requirement is shared data-center-to-VPC connectivity, not three independent physical circuits; the option therefore reduces unnecessary transfer or fixed networking charges.
4. S3 gateway endpoints provide private VPC access to S3 and cannot provide general hybrid connectivity from a data center to arbitrary VPC workloads. This does not fit the cost model: the enterprise needs broad private VPC reach over its existing Direct Connect connection; another choice removes the unnecessary network charge more directly.

 

Question 19

A company distributes large public files from an EC2 origin. CloudFront is already configured, but many viewers download the same files directly from the origin’s public URL, bypassing the CDN and generating higher regional internet transfer. Which architecture change best protects the cost optimization?

1. Restrict origin access so viewers must use the CloudFront distribution
2. Create a NAT gateway for the EC2 origin
3. Enable inter-Region VPC peering for the affected private network flow
4. Add a second public IP address to the origin

Correct Answer(s)

 

A

Rationale

1. Limiting direct origin access ensures public downloads traverse the intended CDN path, where edge caching and CloudFront transfer economics can reduce repeated regional internet delivery. The workload profile shows that direct origin URLs are bypassing the cache and causing the measured transfer expense; this design is therefore the best financial fit without breaking the requirement.
2. A NAT gateway controls outbound internet access for private resources and does not force external viewers to use CloudFront for inbound downloads. The mismatch is that the problem is an alternate public origin path rather than origin egress translation; this option introduces or retains charges that the preferred design avoids.
3. VPC peering provides private routing between VPCs and does not prevent public clients from connecting to a publicly exposed EC2 origin. In context, the cost leak is viewer bypass of the CDN; this would spend money on a capability that is not required.
4. Another public address would create an additional bypass path rather than funnel traffic through the caching layer. The workload does not benefit from this choice because all viewer access should be consolidated on CloudFront; its primary cost remains unchanged.

 

Question 20

A regional office uploads backup files to an S3 bucket in the same nearby AWS Region. S3 Transfer Acceleration is enabled, but speed tests show no meaningful improvement over the standard regional endpoint and the feature adds transfer charges. What should the company do?

1. Keep Transfer Acceleration because it is always free when performance is unchanged
2. Use the standard S3 endpoint and suspend Transfer Acceleration for this workload
3. Add a NAT gateway solely in front of the S3 accelerated endpoint
4. Route the uploads through AWS Global Accelerator for the current application path

Correct Answer(s)

 

B

Rationale

1. Transfer Acceleration can incur additional data-transfer charges, so lack of a speed benefit is a reason to reconsider it rather than assume there is no cost. Applying this service would not help here, since the speed comparison demonstrates that the paid accelerated path is unnecessary; the scenario calls for a more targeted network change.
2. S3 Transfer Acceleration is designed for long-distance transfers that can benefit from CloudFront edge ingress and optimized network paths, and additional transfer charges can apply when it is used. Since the measured traffic pattern shows that the nearby clients gain no measured acceleration, so the paid feature provides no economic benefit, this selection avoids paying for unused network features.
3. A NAT gateway would add hourly and data-processing charges and would not create a performance advantage for clients that already reach S3 effectively. The design goal is narrower than this option assumes because the cost issue is an unnecessary acceleration feature, not missing address translation; the added capability is not justified by the savings.
4. Global Accelerator serves supported application endpoints and is not a substitute for S3 Transfer Acceleration or the standard S3 upload endpoint. This is not the best answer because the clients already have adequate direct regional S3 performance; the proposed component does not change the expensive path identified.

• < Amazon AWS SAA-C03 Cost-Optimized Networking, NAT, Endpoints, Connectivity, Routing, and Edge Caching Practice Test 1
• Microsoft DP-700 Fabric Workspace Settings: Spark, Domains, OneLake, and Airflow Practice Test 1 >