Amazon AWS SAA-C03 High-Performance Networking, Load Balancing, CloudFront, Global Accelerator, and Private Connectivity Practice Test 1

 

Topic 15 Practice Test 1 covers High-Performance Networking, Load Balancing, CloudFront, Global Accelerator, and Private Connectivity for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A company runs /images and /api on separate EC2 target groups behind one public endpoint. It needs URL-path routing without adding another load balancer. Which design is most appropriate?

1. Use AWS Transit Gateway with separate route tables
2. Use an Application Load Balancer with path-based listener rules
3. Use a Network Load Balancer with one TCP listener
4. Use AWS Global Accelerator with two endpoint groups

Correct Answer(s)

 

B

Rationale

1. AWS Transit Gateway provides a regional hub for connecting many VPCs and hybrid attachments, with transit gateway route tables controlling how attachments can communicate. Here, Transit Gateway routes network prefixes and does not inspect application URLs. This does not meet the full requirement.
2. An Application Load Balancer operates at the HTTP application layer and can route requests by host, path, header, method, or other request attributes. Here, ALB listener rules can evaluate the path before forwarding each request. This is the supported architecture.
3. A Network Load Balancer handles transport-layer flows at very high scale and supports TCP, UDP, TLS, and related protocols while providing fixed per-zone addresses. Here, NLB distributes transport connections and does not provide URL-path listener rules. This does not meet the full requirement.
4. AWS Global Accelerator provides static anycast entry addresses and carries client traffic across the AWS global network to healthy regional endpoints based on policy and health. Here, Global Accelerator selects regional endpoints but does not split requests by HTTP path. This does not meet the full requirement.

 

Question 2

A telemetry service receives millions of UDP packets per minute and clients must connect to fixed IP addresses. Which AWS load-balancing choice best fits?

1. Use an Application Load Balancer with an HTTPS listener
2. Put Amazon CloudFront in front of the service
3. Use Route 53 latency records pointing directly to instances
4. Use a Network Load Balancer with a UDP listener

Correct Answer(s)

 

D

Rationale

1. Application Load Balancers are designed for HTTP and HTTPS workloads, including content-based routing, WebSockets, and HTTP/2 or gRPC listener and target patterns. Here, ALB is built around HTTP-family application protocols rather than arbitrary UDP datagrams. This does not meet the full requirement.
2. Amazon CloudFront is a global content delivery network that serves cached objects from edge locations close to viewers and can proxy dynamic HTTP traffic to an origin. Here, CloudFront is an HTTP content delivery service and is not a generic UDP load balancer. This does not meet the full requirement.
3. Route 53 latency-based routing answers DNS queries with a resource from the AWS Region that provides the lowest measured network latency for the requester among configured records. Here, DNS can choose an address but does not itself distribute UDP flows across healthy targets. This does not meet the full requirement.
4. Network Load Balancers are optimized for Layer 4 connection handling, including non-HTTP protocols and workloads that benefit from static IP addresses or very high throughput. Here, NLB supports UDP and exposes fixed addresses per enabled Availability Zone. This is the supported architecture.

 

Question 3

A real-time TCP application is deployed behind load balancers in three AWS Regions. Clients worldwide require two fixed entry IP addresses and faster regional failover than DNS cache expiration. Which service should be added?

1. Use an AWS Global Accelerator standard accelerator
2. Use Route 53 simple routing with a low TTL
3. Attach all VPCs to one Transit Gateway
4. Use a CloudFront distribution

Correct Answer(s)

 

A

Rationale

1. Global Accelerator accepts traffic at globally advertised static IP addresses, then steers flows over the AWS backbone toward healthy ALB, NLB, EC2, or Elastic IP endpoints. Here, Global Accelerator supplies anycast static addresses and can steer new connections to healthy regional endpoints. This is the supported architecture.
2. Latency routing is a DNS policy for steering users toward regional endpoints according to Route 53 latency measurements rather than supplying fixed application anycast addresses. Here, DNS TTL reduction still leaves resolver and client caching behavior in the failover path. This does not meet the full requirement.
3. Transit Gateway replaces large meshes of point-to-point VPC connections with centralized routing among many VPC, VPN, and Direct Connect-connected networks. Here, Transit Gateway connects networks but does not provide a global public client entry service. This does not meet the full requirement.
4. CloudFront reduces viewer latency for cacheable web content by placing copies at edge locations and using the AWS edge network to reach configured origins. Here, CloudFront is optimized for HTTP delivery and caching, not arbitrary TCP ports with fixed accelerator IPs. This does not meet the full requirement.

 

Question 4

A news site serves the same large images and JavaScript files to readers worldwide. Origin servers are healthy but distant users report high download latency. Which change provides the largest direct improvement?

1. Create interface VPC endpoints in the origin VPC
2. Put the origin behind Global Accelerator only
3. Create a CloudFront distribution for the static assets
4. Provision Direct Connect from the corporate office

Correct Answer(s)

 

C

Rationale

1. An interface VPC endpoint uses AWS PrivateLink and creates endpoint network interfaces with private IP addresses in selected subnets for private service access. Here, Interface endpoints provide private service access inside networks and do not create a global content cache. This does not meet the full requirement.
2. For latency-sensitive non-cacheable applications, Global Accelerator can shorten public-internet exposure and rapidly redirect new connections among healthy regional endpoints. Here, Global Accelerator improves network paths but does not provide object caching for repeated static downloads. This does not meet the full requirement.
3. A CloudFront distribution is appropriate when HTTP content can benefit from edge caching, optimized delivery, compression, or viewer-access controls close to users. Here, CloudFront can serve repeat requests from edge caches near readers instead of repeatedly crossing to the origin. This is the supported architecture.
4. AWS Direct Connect establishes dedicated network connectivity from an organization to AWS and can carry private VPC traffic through appropriate virtual interfaces and gateways. Here, Direct Connect changes corporate-to-AWS connectivity rather than the public viewer-to-origin path. This does not meet the full requirement.

 

Question 5

A CloudFront distribution uses an Amazon S3 bucket as its origin. The bucket must remain private, and users must not be able to bypass CloudFront with direct S3 object URLs. Which configuration should be used?

1. Make every S3 object public and use CloudFront signed URLs
2. Add an S3 gateway endpoint to the VPC
3. Configure CloudFront Origin Access Control and a matching S3 bucket policy
4. Place an Application Load Balancer in front of the bucket

Correct Answer(s)

 

C

Rationale

1. A CloudFront signed URL grants time-limited access to a specific private object and can include expiration and optional source-address restrictions in its policy. Here, Viewer signing does not justify making the S3 origin public because direct S3 URLs would bypass CloudFront. This does not meet the full requirement.
2. Gateway VPC endpoints provide route-table-based private access to Amazon S3 and DynamoDB without requiring an internet gateway or NAT device, and they do not use PrivateLink. Here, A gateway endpoint controls VPC-to-S3 routing and does not authorize CloudFront origin fetches. This does not meet the full requirement.
3. CloudFront Origin Access Control signs origin requests to Amazon S3 so the bucket can remain private while CloudFront is authorized to retrieve objects for viewers. Here, OAC lets CloudFront sign origin requests and the bucket policy can limit retrieval to the distribution. This is the supported architecture.
4. An ALB understands web requests rather than only transport flows, so one listener can direct different hosts or URL paths to separate target groups. Here, ALB cannot use an S3 bucket as an ordinary target to solve CloudFront origin authorization. This does not meet the full requirement.

 

Question 6

A product catalog is cached in CloudFront. The application forwards an analytics cookie that does not change the response, but the cookie is included in the cache key and the hit ratio is poor. What should the architect change?

1. Use a cache policy that excludes the analytics cookie from the cache key
2. Replace the analytics cookie with CloudFront signed cookies
3. Route viewers through Global Accelerator
4. Enable Origin Shield and keep the cookie in every cache key

Correct Answer(s)

 

A

Rationale

1. A CloudFront cache policy defines which request values participate in the cache key, so forwarding unnecessary cookies, headers, or query strings can reduce cache efficiency. Here, Removing a non-varying cookie lets requests for the same object reuse one cached variant. This is the supported architecture.
2. CloudFront signed cookies authorize access to multiple restricted objects without changing each object URL, which suits collections such as subscriber video segments or protected site sections. Here, Signed cookies are an authorization mechanism and do not solve an irrelevant analytics value in the cache key. This does not meet the full requirement.
3. AWS Global Accelerator provides static anycast entry addresses and carries client traffic across the AWS global network to healthy regional endpoints based on policy and health. Here, Global Accelerator does not control CloudFront cache-key composition or combine fragmented object variants. This does not meet the full requirement.
4. CloudFront Origin Shield adds a centralized regional caching layer in front of an origin, increasing the chance that misses from multiple edge locations are consolidated before reaching it. Here, Origin Shield can reduce origin requests but cannot recover edge-hit efficiency lost to unnecessary cache variants. This does not meet the full requirement.

 

Question 7

A globally popular software download causes simultaneous cache misses in many CloudFront edge locations after each release. The origin is overwhelmed even though subsequent edge hits are fast. Which feature best reduces the burst of origin requests?

1. Put a Network Load Balancer in front of the origin
2. Forward every viewer header in the CloudFront cache key
3. Replace CloudFront with Global Accelerator
4. Enable CloudFront Origin Shield in an appropriate Region

Correct Answer(s)

 

D

Rationale

1. An NLB distributes TCP, UDP, and TLS traffic without needing HTTP-aware routing, making it suitable for high-volume transport services and fixed network endpoints. Here, NLB can distribute connections but cannot turn repeated object requests into cache hits. This does not meet the full requirement.
2. CloudFront cache-key design directly affects hit ratio: values that do not change the object should generally be excluded from the cache key even if selected data must reach the origin. Here, Forwarding more headers would create more cache variants and generally reduce rather than improve reuse. This does not meet the full requirement.
3. Global Accelerator accepts traffic at globally advertised static IP addresses, then steers flows over the AWS backbone toward healthy ALB, NLB, EC2, or Elastic IP endpoints. Here, Global Accelerator does not add an object cache that collapses duplicate HTTP origin fetches. This does not meet the full requirement.
4. Origin Shield provides an additional CloudFront cache tier that can collapse duplicate origin fetches and reduce request load on origins receiving traffic from many edge locations. Here, Origin Shield provides a common cache tier that can satisfy multiple downstream misses before they reach the origin. This is the supported architecture.

 

Question 8

A web application has identical deployments in us-east-1 and eu-west-1. The company is comfortable with DNS-based steering and wants users normally sent to the Region with the lowest network latency. Which routing policy is appropriate?

1. Create a Global Accelerator only because DNS cannot perform latency routing
2. Configure Route 53 latency-based routing records
3. Use Transit Gateway inter-Region peering as the public entry point
4. Use CloudFront with an S3 origin

Correct Answer(s)

 

B

Rationale

1. For latency-sensitive non-cacheable applications, Global Accelerator can shorten public-internet exposure and rapidly redirect new connections among healthy regional endpoints. Here, Global Accelerator is valid for different requirements such as fixed anycast IPs, but DNS latency routing already matches this stated constraint. This does not meet the full requirement.
2. Amazon Route 53 can use latency records to choose among regional endpoints when DNS-based selection is acceptable and clients can follow the returned record. Here, Latency records are designed to return the regional resource with the best measured latency for the requester. This is the supported architecture.
3. For multi-VPC connectivity at scale, a Transit Gateway acts as a managed routing hub and supports segmented route tables rather than requiring every VPC pair to be peered. Here, Transit Gateway inter-Region routing is private network connectivity and does not answer public DNS by user latency. This does not meet the full requirement.
4. Amazon CloudFront is a global content delivery network that serves cached objects from edge locations close to viewers and can proxy dynamic HTTP traffic to an origin. Here, CloudFront with S3 is unrelated to choosing between two identical regional web deployments by DNS latency. This does not meet the full requirement.

 

Question 9

Private-subnet EC2 instances upload large backups to Amazon S3. They currently traverse a NAT gateway, but the company wants a private AWS-network path to S3 without NAT charges. Which change is best?

1. Create an S3 gateway VPC endpoint and associate the required route tables
2. Provision Direct Connect solely for traffic from the VPC to S3
3. Send S3 traffic through a Transit Gateway and then a NAT gateway
4. Create an interface endpoint for an unrelated SaaS endpoint service

Correct Answer(s)

 

A

Rationale

1. For S3 or DynamoDB traffic originating in a VPC, a gateway endpoint installs service routes in selected route tables and avoids sending those requests through NAT. Here, An S3 gateway endpoint adds service routes to selected VPC route tables and removes the NAT requirement for that traffic. This is the supported architecture.
2. Direct Connect provides a dedicated physical connectivity path to AWS, useful when workloads require more consistent network characteristics than an internet-based VPN alone. Here, Direct Connect addresses hybrid connectivity and is unnecessary for VPC-local access to S3. This does not meet the full requirement.
3. AWS Transit Gateway provides a regional hub for connecting many VPCs and hybrid attachments, with transit gateway route tables controlling how attachments can communicate. Here, Adding Transit Gateway before NAT preserves the unwanted NAT path rather than replacing it. This does not meet the full requirement.
4. PrivateLink interface endpoints expose a supported service through private addresses inside the consumer VPC, avoiding public internet routing and full network peering. Here, A PrivateLink endpoint for another service would not provide the required S3 route. This does not meet the full requirement.

 

Question 10

A software vendor exposes a TCP API through an endpoint service. A customer VPC must consume the API using private IP addresses without establishing VPC peering. Which client-side resource is required?

1. Create a CloudFront distribution for the TCP API
2. Create an S3 gateway endpoint
3. Create an interface VPC endpoint for the vendor endpoint service
4. Create full-mesh VPC peering to every vendor VPC

Correct Answer(s)

 

C

Rationale

1. CloudFront reduces viewer latency for cacheable web content by placing copies at edge locations and using the AWS edge network to reach configured origins. Here, CloudFront is an HTTP content delivery service, not a PrivateLink consumer for a generic TCP API. This does not meet the full requirement.
2. A gateway endpoint is the simple no-additional-charge VPC endpoint type for private S3 or DynamoDB access from resources that can use the associated VPC route tables. Here, Gateway endpoints are specifically for S3 and DynamoDB rather than arbitrary endpoint services. This does not meet the full requirement.
3. Interface endpoints are ENI-based PrivateLink entry points that can privately reach supported AWS services or endpoint services and can support hybrid access with proper routing and DNS. Here, An interface endpoint creates private endpoint ENIs that connect the consumer to the published PrivateLink service. This is the supported architecture.
4. VPC peering provides direct private IP connectivity between two VPCs without a Transit Gateway, but the relationship is point-to-point and does not provide transitive routing. Here, Peering is explicitly unnecessary for PrivateLink service consumption and broadens network-level connectivity beyond the requirement. This does not meet the full requirement.

 

Question 11

A financial company transfers large data sets continuously between its data center and VPCs. It needs a dedicated connectivity path with more consistent network performance than internet VPN alone. Which service should be the primary connection?

1. Use only a Site-to-Site VPN over the internet
2. Use AWS Direct Connect with appropriate private connectivity
3. Use Global Accelerator between the data center and VPC CIDRs
4. Use CloudFront as the hybrid network transport

Correct Answer(s)

 

B

Rationale

1. AWS Site-to-Site VPN creates encrypted IPsec tunnels over internet connectivity, making it fast to deploy but dependent on public-network transport characteristics. Here, VPN supplies encrypted tunnels quickly but still depends on internet path characteristics rather than a dedicated circuit. This does not meet the full requirement.
2. With Direct Connect, private or transit virtual interfaces can connect on-premises routing to VPC or Transit Gateway architectures without relying on the public internet as the transport. Here, Direct Connect is the AWS service intended to provide dedicated connectivity from customer networks to AWS. This is the supported architecture.
3. AWS Global Accelerator provides static anycast entry addresses and carries client traffic across the AWS global network to healthy regional endpoints based on policy and health. Here, Global Accelerator serves application clients through global entry points and is not a private hybrid circuit replacement. This does not meet the full requirement.
4. A CloudFront distribution is appropriate when HTTP content can benefit from edge caching, optimized delivery, compression, or viewer-access controls close to users. Here, CloudFront accelerates HTTP content delivery to viewers and does not extend private data-center routing into VPCs. This does not meet the full requirement.

 

Question 12

An enterprise has 70 VPCs and several VPN attachments. The network team wants centralized routing and segmentation instead of maintaining hundreds of pairwise peering connections. Which architecture is most scalable?

1. Place one Network Load Balancer in each VPC
2. Enable CloudFront Origin Shield in each Region
3. Create a peering connection between every possible VPC pair
4. Attach the networks to AWS Transit Gateway and use transit gateway route tables

Correct Answer(s)

 

D

Rationale

1. A Network Load Balancer handles transport-layer flows at very high scale and supports TCP, UDP, TLS, and related protocols while providing fixed per-zone addresses. Here, NLB distributes application transport traffic and does not create routed connectivity among independent VPCs. This does not meet the full requirement.
2. When edge caches produce geographically distributed misses, Origin Shield can improve cache efficiency by giving those requests a common intermediate caching point. Here, Origin Shield is a CDN cache tier and has no role in VPC routing topology. This does not meet the full requirement.
3. A VPC peering connection is a direct private routing relationship between two VPCs; it works well for limited pairwise connectivity but does not scale as a transit hub. Here, Pairwise peering works for small topologies but connection count and route administration expand rapidly in a large mesh. This does not meet the full requirement.
4. Transit Gateway replaces large meshes of point-to-point VPC connections with centralized routing among many VPC, VPN, and Direct Connect-connected networks. Here, Transit Gateway is designed as a hub for many VPC and hybrid attachments with controllable route-table segmentation. This is the supported architecture.

 

Question 13

A gRPC service needs HTTP/2-aware load balancing and routing to different target groups according to application request attributes. Which load balancer is the best fit?

1. Use Transit Gateway appliance mode
2. Use only a Network Load Balancer TCP listener
3. Use Global Accelerator with EC2 endpoints and no load balancer
4. Use an Application Load Balancer configured for the required protocol version

Correct Answer(s)

 

D

Rationale

1. For multi-VPC connectivity at scale, a Transit Gateway acts as a managed routing hub and supports segmented route tables rather than requiring every VPC pair to be peered. Here, Transit Gateway routes VPC network traffic and cannot interpret or dispatch gRPC requests to target groups. This does not meet the full requirement.
2. Network Load Balancers are optimized for Layer 4 connection handling, including non-HTTP protocols and workloads that benefit from static IP addresses or very high throughput. Here, NLB can forward transport connections but does not provide the requested HTTP-aware routing semantics. This does not meet the full requirement.
3. Global Accelerator accepts traffic at globally advertised static IP addresses, then steers flows over the AWS backbone toward healthy ALB, NLB, EC2, or Elastic IP endpoints. Here, Global Accelerator improves global network paths but does not replace the application-layer routing function inside the Region. This does not meet the full requirement.
4. An Application Load Balancer operates at the HTTP application layer and can route requests by host, path, header, method, or other request attributes. Here, ALB supports HTTP/2 and gRPC target protocol patterns while retaining application-aware listener routing. This is the supported architecture.

 

Question 14

A partner firewall permits outbound connections only to a small allowlist of destination IP addresses. A public TCP service runs on autoscaled EC2 targets and still needs load balancing. Which front end should be used?

1. Allowlist the current IP addresses resolved from an Application Load Balancer DNS name
2. Use a Network Load Balancer and allowlist its static addresses
3. Use CloudFront for arbitrary TCP connections
4. Create VPC peering to every external partner

Correct Answer(s)

 

B

Rationale

1. Application Load Balancers are designed for HTTP and HTTPS workloads, including content-based routing, WebSockets, and HTTP/2 or gRPC listener and target patterns. Here, ALB clients are expected to use its DNS name rather than treating resolved node addresses as a fixed allowlist contract. This does not meet the full requirement.
2. An NLB distributes TCP, UDP, and TLS traffic without needing HTTP-aware routing, making it suitable for high-volume transport services and fixed network endpoints. Here, NLB provides stable per-zone network addresses while continuing to distribute connections to changing healthy targets. This is the supported architecture.
3. Amazon CloudFront is a global content delivery network that serves cached objects from edge locations close to viewers and can proxy dynamic HTTP traffic to an origin. Here, CloudFront is for HTTP-family content delivery and is not a generic public TCP load balancer. This does not meet the full requirement.
4. For two non-overlapping VPCs that need direct private reachability, peering can avoid a central routing hop, although every additional relationship must be designed separately. Here, VPC peering connects VPC networks and does not solve internet partner access from external firewalls. This does not meet the full requirement.

 

Question 15

A SaaS provider wants thousands of customer VPCs to reach one internal service privately. Customers can have overlapping CIDR ranges, and the provider does not want to manage routes for full network connectivity. Which design is best?

1. Attach every customer VPC to the provider Transit Gateway
2. Ask customers to create DynamoDB gateway endpoints
3. Publish a PrivateLink endpoint service and have customers create interface endpoints
4. Peer the provider VPC separately with every customer VPC

Correct Answer(s)

 

C

Rationale

1. AWS Transit Gateway provides a regional hub for connecting many VPCs and hybrid attachments, with transit gateway route tables controlling how attachments can communicate. Here, Transit Gateway would require attachment and routing participation from customer networks rather than service-scoped consumption. This does not meet the full requirement.
2. Gateway VPC endpoints provide route-table-based private access to Amazon S3 and DynamoDB without requiring an internet gateway or NAT device, and they do not use PrivateLink. Here, Gateway endpoints are limited to supported AWS services such as S3 and DynamoDB, not a vendor endpoint service. This does not meet the full requirement.
3. An interface VPC endpoint uses AWS PrivateLink and creates endpoint network interfaces with private IP addresses in selected subnets for private service access. Here, PrivateLink exposes a service through consumer endpoint ENIs without requiring transitive or full VPC routing between provider and customer networks. This is the supported architecture.
4. VPC peering provides direct private IP connectivity between two VPCs without a Transit Gateway, but the relationship is point-to-point and does not provide transitive routing. Here, Peering creates broad pairwise routing relationships and overlapping CIDRs prevent the intended many-customer design. This does not meet the full requirement.

 

Question 16

On-premises clients connected by Direct Connect can reach a VPC, but they cannot resolve records in a Route 53 private hosted zone. The company wants to keep using its on-premises DNS servers. What should be added?

1. Create a Route 53 Resolver inbound endpoint and forward the private domain to it
2. Put a Network Load Balancer in front of the Route 53 authoritative service
3. Create an S3 gateway endpoint
4. Enable CloudFront Origin Shield

Correct Answer(s)

 

A

Rationale

1. A Route 53 Resolver inbound endpoint accepts DNS queries from connected on-premises networks and resolves names using the VPC resolver and associated private hosted zones. Here, The inbound Resolver endpoint gives on-premises DNS servers reachable IPs for forwarding queries into Route 53 Resolver. This is the supported architecture.
2. A Network Load Balancer handles transport-layer flows at very high scale and supports TCP, UDP, TLS, and related protocols while providing fixed per-zone addresses. Here, A customer NLB cannot be inserted in front of the managed Route 53 Resolver service to create hybrid DNS forwarding. This does not meet the full requirement.
3. For S3 or DynamoDB traffic originating in a VPC, a gateway endpoint installs service routes in selected route tables and avoids sending those requests through NAT. Here, An S3 gateway endpoint affects S3 data routing and has no DNS-forwarding role. This does not meet the full requirement.
4. CloudFront Origin Shield adds a centralized regional caching layer in front of an origin, increasing the chance that misses from multiple edge locations are consolidated before reaching it. Here, Origin Shield changes CloudFront cache behavior and cannot expose private hosted-zone resolution to on-premises clients. This does not meet the full requirement.

 

Question 17

A tightly coupled MPI workload runs across many EC2 instances and spends significant time exchanging small latency-sensitive messages between workers. Which networking feature should the architect evaluate first?

1. Front the workers with CloudFront
2. Use supported EC2 instances with Elastic Fabric Adapter
3. Create an S3 gateway endpoint for every subnet
4. Use Route 53 latency records between workers

Correct Answer(s)

 

B

Rationale

1. CloudFront reduces viewer latency for cacheable web content by placing copies at edge locations and using the AWS edge network to reach configured origins. Here, CloudFront accelerates viewer HTTP content and does not provide MPI-style node-to-node networking inside an EC2 cluster. This does not meet the full requirement.
2. Elastic Fabric Adapter is a network interface designed for tightly coupled high-performance computing and machine-learning workloads that need low-latency, high-throughput communication between instances. Here, EFA is specifically intended to improve communication behavior for distributed HPC and similar tightly coupled workloads. This is the supported architecture.
3. A gateway endpoint is the simple no-additional-charge VPC endpoint type for private S3 or DynamoDB access from resources that can use the associated VPC route tables. Here, An S3 endpoint improves private access to object storage, not latency between compute workers. This does not meet the full requirement.
4. Route 53 latency-based routing answers DNS queries with a resource from the AWS Region that provides the lowest measured network latency for the requester among configured records. Here, DNS-based regional routing is unrelated to message transport among instances participating in one parallel job. This does not meet the full requirement.

 

Question 18

Four EC2 instances in the same Availability Zone perform synchronous distributed calculations and need the lowest practical inter-instance network latency. Fault-domain separation is less important than performance. Which placement choice is appropriate?

1. Place the instances in a cluster placement group
2. Use CloudFront between the nodes
3. Create a VPC peering connection from the VPC to itself
4. Route traffic between the instances through Transit Gateway

Correct Answer(s)

 

A

Rationale

1. An EC2 cluster placement group packs supported instances close together within one Availability Zone to provide low-latency, high-throughput networking between group members. Here, A cluster placement group is the EC2 placement strategy intended to improve low-latency, high-throughput communication among nearby instances. This is the supported architecture.
2. A CloudFront distribution is appropriate when HTTP content can benefit from edge caching, optimized delivery, compression, or viewer-access controls close to users. Here, CloudFront is an edge content-delivery service and does not accelerate private instance-to-instance compute traffic. This does not meet the full requirement.
3. A VPC peering connection is a direct private routing relationship between two VPCs; it works well for limited pairwise connectivity but does not scale as a transit hub. Here, VPC peering connects different VPCs; it cannot be used as a placement or acceleration mechanism inside one VPC. This does not meet the full requirement.
4. Transit Gateway replaces large meshes of point-to-point VPC connections with centralized routing among many VPC, VPN, and Direct Connect-connected networks. Here, Transit Gateway adds a routing hub for network attachments and is unnecessary for same-VPC same-AZ worker communication. This does not meet the full requirement.

 

Question 19

A company already has a Direct Connect connection. It is adopting Transit Gateway as the hub for dozens of VPCs and wants on-premises routes carried over Direct Connect into that hub. Which virtual interface is required?

1. Peer the on-premises router directly with every VPC
2. Create a public virtual interface for private VPC CIDRs
3. Create an S3 gateway endpoint in each VPC
4. Create a transit virtual interface to a Direct Connect gateway associated with the Transit Gateway

Correct Answer(s)

 

D

Rationale

1. For two non-overlapping VPCs that need direct private reachability, peering can avoid a central routing hop, although every additional relationship must be designed separately. Here, VPC peering exists between VPCs and cannot directly peer an on-premises router with each VPC. This does not meet the full requirement.
2. AWS Direct Connect establishes dedicated network connectivity from an organization to AWS and can carry private VPC traffic through appropriate virtual interfaces and gateways. Here, A public VIF reaches AWS public services and is not the private routing attachment requested for Transit Gateway. This does not meet the full requirement.
3. Gateway VPC endpoints provide route-table-based private access to Amazon S3 and DynamoDB without requiring an internet gateway or NAT device, and they do not use PrivateLink. Here, S3 gateway endpoints solve VPC-to-S3 paths and do not connect on-premises BGP routes to Transit Gateway. This does not meet the full requirement.
4. A Direct Connect transit virtual interface connects a Direct Connect connection to a Direct Connect gateway that is associated with one or more Transit Gateways. Here, A transit VIF is the Direct Connect interface type designed to reach Transit Gateway associations through a Direct Connect gateway. This is the supported architecture.

 

Question 20

A multiplayer game uses a custom UDP protocol from players worldwide. The servers run behind Network Load Balancers in two Regions, and the company wants traffic to enter the AWS network close to players and fail over on endpoint health. What should be added?

1. Place CloudFront in front of the UDP listeners
2. Use only a long-TTL simple Route 53 record
3. Place AWS Global Accelerator in front of the regional Network Load Balancers
4. Configure CloudFront Origin Access Control

Correct Answer(s)

 

C

Rationale

1. Amazon CloudFront is a global content delivery network that serves cached objects from edge locations close to viewers and can proxy dynamic HTTP traffic to an origin. Here, CloudFront does not act as a generic UDP proxy for custom game transport. This does not meet the full requirement.
2. Latency routing is a DNS policy for steering users toward regional endpoints according to Route 53 latency measurements rather than supplying fixed application anycast addresses. Here, Simple DNS with a long TTL lacks the requested accelerator ingress and can delay endpoint changes through caching. This does not meet the full requirement.
3. For latency-sensitive non-cacheable applications, Global Accelerator can shorten public-internet exposure and rapidly redirect new connections among healthy regional endpoints. Here, Global Accelerator supports UDP listeners and can send traffic over the AWS global network to healthy regional NLB endpoints. This is the supported architecture.
4. Origin Access Control is the current CloudFront mechanism for restricting an S3 origin to approved distribution access instead of exposing the bucket publicly. Here, OAC authorizes CloudFront to private origins such as S3 and has no role in UDP acceleration. This does not meet the full requirement.

• < Amazon AWS SAA-C03 Database Performance, Access Patterns, Read Scaling, Proxies, and Caching Practice Test 2
• Amazon AWS SAA-C03 High-Performance Networking, Load Balancing, CloudFront, Global Accelerator, and Private Connectivity Practice Test 2 >