Amazon AWS SAA-C03 High-Performance Networking, Load Balancing, CloudFront, Global Accelerator, and Private Connectivity Practice Test 2

 

Topic 15 Practice Test 2 covers High-Performance Networking, Load Balancing, CloudFront, Global Accelerator, and Private Connectivity for AWS SAA-C03. For broader exam preparation, review the AWS SAA-C03 Exam Dumps. Every option includes focused technical reasoning explaining both the AWS architecture concept and its fit to the scenario.

Question 1

A company hosts shop.example.com and admin.example.com on separate target groups but wants both names to use the same HTTPS load balancer. Which configuration best meets the requirement?

1. Use an NLB TCP listener and expect it to inspect HTTP Host headers
2. Use Global Accelerator endpoint weights for the two hostnames
3. Use an Application Load Balancer with host-based listener rules
4. Use Transit Gateway route tables keyed by DNS name

Correct Answer(s)

 

C

Rationale

4. Network Load Balancers are optimized for Layer 4 connection handling, including non-HTTP protocols and workloads that benefit from static IP addresses or very high throughput. Here, NLB does not perform HTTP host-header rule evaluation at Layer 4. This does not meet the full requirement.
5. AWS Global Accelerator provides static anycast entry addresses and carries client traffic across the AWS global network to healthy regional endpoints based on policy and health. Here, Global Accelerator endpoint weights steer transport traffic among endpoints and do not route by HTTP hostname. This does not meet the full requirement.
6. An ALB understands web requests rather than only transport flows, so one listener can direct different hosts or URL paths to separate target groups. Here, ALB host conditions can select a target group from the HTTP Host header on the shared listener. This is the supported architecture.
7. For multi-VPC connectivity at scale, a Transit Gateway acts as a managed routing hub and supports segmented route tables rather than requiring every VPC pair to be peered. Here, Transit Gateway route tables select network prefixes, not application host headers. This does not meet the full requirement.

 

Question 2

An online market-data service maintains very large numbers of long-lived TCP connections and needs low-overhead Layer 4 balancing. The service also requires fixed addresses for upstream allowlists. Which option is best?

1. Deploy a Network Load Balancer
2. Use CloudFront as the raw TCP connection broker
3. Use a Resolver inbound endpoint as the service front end
4. Deploy only an Application Load Balancer and pin its resolved node IPs

Correct Answer(s)

 

A

Rationale

1. An NLB distributes TCP, UDP, and TLS traffic without needing HTTP-aware routing, making it suitable for high-volume transport services and fixed network endpoints. Here, NLB is designed for high-scale transport flows and provides fixed per-zone addresses suited to allowlist requirements. This is the supported architecture.
2. CloudFront reduces viewer latency for cacheable web content by placing copies at edge locations and using the AWS edge network to reach configured origins. Here, CloudFront proxies HTTP-family requests rather than arbitrary long-lived raw TCP services. This does not meet the full requirement.
3. Inbound Resolver endpoints place IP addresses in VPC subnets so on-premises DNS servers can forward selected queries into Route 53 Resolver over hybrid connectivity. Here, Resolver endpoints receive DNS queries; they do not load balance application TCP sessions. This does not meet the full requirement.
4. An Application Load Balancer operates at the HTTP application layer and can route requests by host, path, header, method, or other request attributes. Here, ALB is HTTP-aware and its dynamically resolved infrastructure addresses are not intended as a pinned fixed-IP contract. This does not meet the full requirement.

 

Question 3

A company is moving a non-cacheable TCP service from one Region to another. Clients are hard-coded to the application’s existing accelerator IPs, and the team wants to shift traffic gradually without changing those clients. What should it use?

1. Peer the two regional VPCs and ask clients to connect to private addresses
2. Replace the accelerator addresses with latency DNS records on every client
3. Migrate the custom TCP service behind CloudFront cache behaviors
4. Use Global Accelerator endpoint-group traffic dials or endpoint weights during the migration

Correct Answer(s)

 

D

Rationale

1. VPC peering provides direct private IP connectivity between two VPCs without a Transit Gateway, but the relationship is point-to-point and does not provide transitive routing. Here, Inter-Region peering connects the VPCs privately but does not preserve a public global client endpoint. This does not meet the full requirement.
2. Amazon Route 53 can use latency records to choose among regional endpoints when DNS-based selection is acceptable and clients can follow the returned record. Here, Changing clients to DNS contradicts the fixed existing-address requirement and gives up the accelerator entry points. This does not meet the full requirement.
3. A CloudFront distribution is appropriate when HTTP content can benefit from edge caching, optimized delivery, compression, or viewer-access controls close to users. Here, CloudFront is not a generic proxy for the custom TCP protocol and does not preserve these accelerator IPs. This does not meet the full requirement.
4. Global Accelerator accepts traffic at globally advertised static IP addresses, then steers flows over the AWS backbone toward healthy ALB, NLB, EC2, or Elastic IP endpoints. Here, Global Accelerator preserves its static entry addresses while policy controls can shift new flows among regional endpoint groups. This is the supported architecture.

 

Question 4

A public documentation site distributes large text, CSS, and JavaScript files globally. Most objects are reusable, and the team wants fewer bytes transferred to browsers as well as lower latency. Which design is most appropriate?

1. Use Global Accelerator without a CDN
2. Use CloudFront with caching and automatic compression where supported
3. Create Direct Connect links to each reader
4. Route public viewers through Transit Gateway

Correct Answer(s)

 

B

Rationale

1. For latency-sensitive non-cacheable applications, Global Accelerator can shorten public-internet exposure and rapidly redirect new connections among healthy regional endpoints. Here, Global Accelerator can optimize network paths but does not provide the requested object cache and compression behavior. This does not meet the full requirement.
2. Amazon CloudFront is a global content delivery network that serves cached objects from edge locations close to viewers and can proxy dynamic HTTP traffic to an origin. Here, CloudFront combines edge caching with compression options for supported web objects, reducing both distance and bytes sent to viewers. This is the supported architecture.
3. Direct Connect provides a dedicated physical connectivity path to AWS, useful when workloads require more consistent network characteristics than an internet-based VPN alone. Here, Direct Connect is for customer-network connectivity to AWS, not individual public internet readers around the world. This does not meet the full requirement.
4. AWS Transit Gateway provides a regional hub for connecting many VPCs and hybrid attachments, with transit gateway route tables controlling how attachments can communicate. Here, Transit Gateway is a private routing hub and is not a global viewer content-delivery layer. This does not meet the full requirement.

 

Question 5

Subscribers stream HLS video through CloudFront. One login should authorize access to many protected segment files under a path, and the company does not want to generate a different signed URL for every segment. Which control should be used?

1. Use OAC alone as viewer authentication
2. Use CloudFront signed cookies with an appropriate policy
3. Create an S3 gateway endpoint in each subscriber network
4. Generate one signed URL and assume it automatically authorizes every other object

Correct Answer(s)

 

B

Rationale

1. With an S3 origin, OAC lets the bucket policy trust CloudFront while direct unauthenticated S3 object access remains blocked. Here, OAC secures CloudFront-to-S3 origin access but does not authenticate viewers to private content by itself. This does not meet the full requirement.
2. Signed cookies let CloudFront enforce viewer authorization across groups of private files while clients continue using ordinary object URLs within the permitted path or policy. Here, Signed cookies are intended for granting a viewer access to multiple protected CloudFront objects without rewriting every URL. This is the supported architecture.
3. For S3 or DynamoDB traffic originating in a VPC, a gateway endpoint installs service routes in selected route tables and avoids sending those requests through NAT. Here, Gateway endpoints affect VPC routing to S3 and are not usable as authorization controls for internet subscribers. This does not meet the full requirement.
4. Signed URLs are well suited to individual protected downloads because the authorization travels with that particular CloudFront object request. Here, A signed URL authorizes its scoped object request and does not automatically cover an unrelated set of segment URLs. This does not meet the full requirement.

 

Question 6

A media company is creating a new CloudFront distribution for a private S3 origin. It wants modern signed origin requests and no public-read bucket policy. Which origin configuration is preferred?

1. Use Global Accelerator to sign requests to S3
2. Create an S3 gateway endpoint and make the bucket public
3. Place ALB targets in front of the S3 bucket
4. Create a CloudFront Origin Access Control and restrict the bucket policy accordingly

Correct Answer(s)

 

D

Rationale

1. AWS Global Accelerator provides static anycast entry addresses and carries client traffic across the AWS global network to healthy regional endpoints based on policy and health. Here, Global Accelerator does not perform CloudFront-to-S3 request signing or manage S3 bucket authorization. This does not meet the full requirement.
2. A gateway endpoint is the simple no-additional-charge VPC endpoint type for private S3 or DynamoDB access from resources that can use the associated VPC route tables. Here, A gateway endpoint changes VPC routing and does not authorize CloudFront origin requests; public access is unnecessary. This does not meet the full requirement.
3. Application Load Balancers are designed for HTTP and HTTPS workloads, including content-based routing, WebSockets, and HTTP/2 or gRPC listener and target patterns. Here, ALB target groups do not turn an S3 bucket into an ALB-served origin for this purpose. This does not meet the full requirement.
4. CloudFront Origin Access Control signs origin requests to Amazon S3 so the bucket can remain private while CloudFront is authorized to retrieve objects for viewers. Here, OAC is the current CloudFront mechanism for signing requests to S3 while a restrictive bucket policy blocks direct public access. This is the supported architecture.

 

Question 7

Private-subnet instances call AWS Secrets Manager frequently. Security requires the traffic to stay on private addressing and the instances must not depend on a NAT gateway. Which networking option best fits?

1. Create the appropriate interface VPC endpoint and enable suitable private DNS
2. Create a DynamoDB gateway endpoint and use it for Secrets Manager
3. Send Secrets Manager API calls through CloudFront
4. Put Global Accelerator in front of the Secrets Manager public endpoint

Correct Answer(s)

 

A

Rationale

1. PrivateLink interface endpoints expose a supported service through private addresses inside the consumer VPC, avoiding public internet routing and full network peering. Here, A service-specific interface endpoint exposes Secrets Manager through PrivateLink ENIs inside the VPC and can remove the NAT dependency. This is the supported architecture.
2. Gateway VPC endpoints provide route-table-based private access to Amazon S3 and DynamoDB without requiring an internet gateway or NAT device, and they do not use PrivateLink. Here, Gateway endpoints are service-specific for S3 and DynamoDB and cannot be repurposed for Secrets Manager. This does not meet the full requirement.
3. CloudFront reduces viewer latency for cacheable web content by placing copies at edge locations and using the AWS edge network to reach configured origins. Here, CloudFront is not the private VPC endpoint mechanism for Secrets Manager API traffic. This does not meet the full requirement.
4. Global Accelerator accepts traffic at globally advertised static IP addresses, then steers flows over the AWS backbone toward healthy ALB, NLB, EC2, or Elastic IP endpoints. Here, Global Accelerator does not create private endpoint ENIs for a regional AWS service API. This does not meet the full requirement.

 

Question 8

A high-throughput application in private subnets makes constant Amazon DynamoDB calls. The team wants the traffic to avoid NAT and also wants no endpoint hourly charge. Which option should it choose?

1. Provision Direct Connect between the VPC and DynamoDB
2. Put an NLB in front of DynamoDB
3. Create a DynamoDB gateway VPC endpoint
4. Use only a billed DynamoDB interface endpoint

Correct Answer(s)

 

C

Rationale

1. With Direct Connect, private or transit virtual interfaces can connect on-premises routing to VPC or Transit Gateway architectures without relying on the public internet as the transport. Here, Direct Connect is a hybrid connectivity service and is not required for traffic originating inside the VPC to DynamoDB. This does not meet the full requirement.
2. A Network Load Balancer handles transport-layer flows at very high scale and supports TCP, UDP, TLS, and related protocols while providing fixed per-zone addresses. Here, DynamoDB is a managed service and is not placed behind a customer-owned NLB target group. This does not meet the full requirement.
3. For S3 or DynamoDB traffic originating in a VPC, a gateway endpoint installs service routes in selected route tables and avoids sending those requests through NAT. Here, The DynamoDB gateway endpoint provides route-table-based private service access and has no additional endpoint charge. This is the supported architecture.
4. Interface endpoints are ENI-based PrivateLink entry points that can privately reach supported AWS services or endpoint services and can support hybrid access with proper routing and DNS. Here, A DynamoDB interface endpoint can provide private IP access, but it adds PrivateLink endpoint charges unnecessary for this stated VPC-local requirement. This does not meet the full requirement.

 

Question 9

An on-premises analytics cluster connects to AWS through Direct Connect and must access Amazon S3 using private IP addresses. The solution must support access originating outside the VPC. Which endpoint type should be evaluated?

1. Use Origin Shield as a private S3 endpoint
2. Use only an S3 gateway endpoint and expect on-premises routes to consume it
3. Use a public CloudFront URL because private IPs are required
4. Use an S3 interface endpoint with appropriate hybrid routing and DNS

Correct Answer(s)

 

D

Rationale

3. Origin Shield provides an additional CloudFront cache tier that can collapse duplicate origin fetches and reduce request load on origins receiving traffic from many edge locations. Here, Origin Shield is a caching layer for CloudFront origins, not a hybrid PrivateLink endpoint for S3. This does not meet the full requirement.
4. A gateway endpoint is the simple no-additional-charge VPC endpoint type for private S3 or DynamoDB access from resources that can use the associated VPC route tables. Here, Gateway endpoints are consumed through VPC route tables and do not provide endpoint addresses that on-premises networks can directly use. This does not meet the full requirement.
5. A CloudFront distribution is appropriate when HTTP content can benefit from edge caching, optimized delivery, compression, or viewer-access controls close to users. Here, A public CloudFront viewer endpoint does not meet the requirement for private-IP access from the analytics network. This does not meet the full requirement.
6. An interface VPC endpoint uses AWS PrivateLink and creates endpoint network interfaces with private IP addresses in selected subnets for private service access. Here, An S3 interface endpoint uses private ENI addresses and can be reached from on-premises networks with proper Direct Connect or VPN routing and DNS. This is the supported architecture.

 

Question 10

Two VPCs in the same Region have non-overlapping CIDR ranges and exchange latency-sensitive private application traffic. No other VPC needs transit through the connection. Which simple connectivity option avoids a central routing service?

1. Deploy Transit Gateway solely for this one pair even though no transit hub is needed
2. Create a VPC peering connection and route the required CIDRs
3. Publish every application port separately through PrivateLink even though bidirectional VPC reachability is required
4. Use CloudFront for private east-west VPC traffic

Correct Answer(s)

 

B

Rationale

1. Transit Gateway replaces large meshes of point-to-point VPC connections with centralized routing among many VPC, VPN, and Direct Connect-connected networks. Here, Transit Gateway is valuable for many attachments, but it adds a hub that this two-VPC requirement explicitly does not need. This does not meet the full requirement.
2. A VPC peering connection is a direct private routing relationship between two VPCs; it works well for limited pairwise connectivity but does not scale as a transit hub. Here, Peering gives the two VPCs direct private routing without adding a Transit Gateway when no transitive topology is required. This is the supported architecture.
3. PrivateLink interface endpoints expose a supported service through private addresses inside the consumer VPC, avoiding public internet routing and full network peering. Here, PrivateLink is service-scoped and one-way from consumers; it does not replace general bidirectional routed connectivity here. This does not meet the full requirement.
4. Amazon CloudFront is a global content delivery network that serves cached objects from edge locations close to viewers and can proxy dynamic HTTP traffic to an origin. Here, CloudFront handles viewer HTTP delivery and is unrelated to arbitrary private east-west VPC routing. This does not meet the full requirement.

 

Question 11

A company operates dozens of VPCs across teams and needs separate routing domains for production, development, and shared services while maintaining one central hybrid hub. Which service provides this model?

1. Use separate Network Load Balancers as routing domains
2. Use separate CloudFront cache behaviors as network route tables
3. Use AWS Transit Gateway with multiple transit gateway route tables
4. Build one unrestricted full mesh of VPC peering connections

Correct Answer(s)

 

C

Rationale

1. Network Load Balancers are optimized for Layer 4 connection handling, including non-HTTP protocols and workloads that benefit from static IP addresses or very high throughput. Here, NLB is an application transport load balancer and cannot serve as a multi-VPC routing domain controller. This does not meet the full requirement.
2. CloudFront reduces viewer latency for cacheable web content by placing copies at edge locations and using the AWS edge network to reach configured origins. Here, CloudFront cache behaviors route web requests to origins, not private network prefixes among VPCs. This does not meet the full requirement.
3. For multi-VPC connectivity at scale, a Transit Gateway acts as a managed routing hub and supports segmented route tables rather than requiring every VPC pair to be peered. Here, Transit Gateway route-table associations and propagations can create segmented routing domains around one central attachment hub. This is the supported architecture.
4. For two non-overlapping VPCs that need direct private reachability, peering can avoid a central routing hop, although every additional relationship must be designed separately. Here, A full peering mesh increases point-to-point administration and does not provide one central segmented routing plane. This does not meet the full requirement.

 

Question 12

A retailer already has Direct Connect at two offices. The offices exchange large replication streams, and the company wants the path between Direct Connect locations to use the AWS network without hairpinning through a VPC in an AWS Region. Which feature is designed for this?

1. Enable Direct Connect SiteLink on the supported virtual interfaces
2. Use CloudFront Origin Shield for the replication stream
3. Force all site-to-site traffic through an application Transit Gateway in one Region
4. Use Global Accelerator between private office routers

Correct Answer(s)

 

A

Rationale

1. Direct Connect SiteLink can connect networks attached at Direct Connect points of presence using the shortest available path across the AWS network without first routing traffic through a Region. Here, SiteLink is specifically designed to carry traffic between Direct Connect points of presence over the AWS backbone without requiring a regional VPC transit path. This is the supported architecture.
2. A CloudFront distribution is appropriate when HTTP content can benefit from edge caching, optimized delivery, compression, or viewer-access controls close to users. Here, Origin Shield handles CloudFront cache misses and has no function in private office replication routing. This does not meet the full requirement.
3. AWS Transit Gateway provides a regional hub for connecting many VPCs and hybrid attachments, with transit gateway route tables controlling how attachments can communicate. Here, A regional Transit Gateway can connect hybrid networks but does not satisfy the stated desire to avoid a Region hairpin. This does not meet the full requirement.
4. For latency-sensitive non-cacheable applications, Global Accelerator can shorten public-internet exposure and rapidly redirect new connections among healthy regional endpoints. Here, Global Accelerator is an application ingress service and is not a private router-to-router Direct Connect SiteLink replacement. This does not meet the full requirement.

 

Question 13

A startup needs encrypted connectivity from its office to a VPC within hours and cannot wait for a dedicated circuit to be provisioned. Moderate internet variability is acceptable. Which solution is the best initial choice?

1. Create an AWS Site-to-Site VPN
2. Wait for a new dedicated Direct Connect circuit before allowing any traffic
3. Use CloudFront as an IPsec concentrator
4. Create one interface endpoint and treat it as office-to-VPC routing

Correct Answer(s)

 

A

Rationale

1. Site-to-Site VPN provides managed IPsec connectivity between on-premises networks and AWS through redundant tunnels, without requiring a dedicated circuit. Here, Site-to-Site VPN provides managed IPsec tunnels over internet connectivity and can be established without provisioning a dedicated physical circuit. This is the supported architecture.
2. AWS Direct Connect establishes dedicated network connectivity from an organization to AWS and can carry private VPC traffic through appropriate virtual interfaces and gateways. Here, Direct Connect may be appropriate later for dedicated connectivity, but waiting for circuit delivery conflicts with the immediate requirement. This does not meet the full requirement.
3. Amazon CloudFront is a global content delivery network that serves cached objects from edge locations close to viewers and can proxy dynamic HTTP traffic to an origin. Here, CloudFront serves HTTP content and does not terminate managed site-to-site IPsec tunnels into a VPC. This does not meet the full requirement.
4. Interface endpoints are ENI-based PrivateLink entry points that can privately reach supported AWS services or endpoint services and can support hybrid access with proper routing and DNS. Here, An interface endpoint exposes a specific service privately and does not create general routed connectivity from the office network. This does not meet the full requirement.

 

Question 14

A customer buys one large private report file at a time from a CloudFront distribution. Each download should expire after 15 minutes, and the client does not support cookies. Which viewer-access mechanism is most appropriate?

1. Use OAC as the customer-facing authorization token
2. Create an S3 gateway endpoint for the customer
3. Generate a CloudFront signed URL for the purchased object
4. Require signed cookies even though the client cannot use cookies

Correct Answer(s)

 

C

Rationale

1. Origin Access Control is the current CloudFront mechanism for restricting an S3 origin to approved distribution access instead of exposing the bucket publicly. Here, OAC controls CloudFront access to the S3 origin and is not a viewer credential for the customer. This does not meet the full requirement.
2. Gateway VPC endpoints provide route-table-based private access to Amazon S3 and DynamoDB without requiring an internet gateway or NAT device, and they do not use PrivateLink. Here, A gateway endpoint applies to routing inside a VPC and cannot authorize an internet customer download. This does not meet the full requirement.
3. For one private file or a client that cannot use cookies, a CloudFront signed URL provides scoped viewer authorization without exposing the origin directly. Here, A signed URL carries an expiring policy for an individual CloudFront object and works with clients that do not support cookies. This is the supported architecture.
4. When one authenticated session needs many protected CloudFront objects, signed cookies avoid generating a different signed URL for every file. Here, Signed cookies are better for groups of files but fail the explicit client capability constraint here. This does not meet the full requirement.

 

Question 15

A company uses multiple CDN and regional cache layers in front of one CloudFront origin. Cache misses arrive from many paths and create duplicate origin fetches. Which CloudFront capability can provide a common upstream cache?

1. Create Direct Connect from every edge location to the origin
2. Enable CloudFront Origin Shield for the origin
3. Add a unique random query string to every cache key
4. Replace the cache hierarchy with a Network Load Balancer

Correct Answer(s)

 

B

Rationale

1. Direct Connect provides a dedicated physical connectivity path to AWS, useful when workloads require more consistent network characteristics than an internet-based VPN alone. Here, Customers do not provision Direct Connect circuits from CloudFront edge locations to build an origin cache hierarchy. This does not meet the full requirement.
2. When edge caches produce geographically distributed misses, Origin Shield can improve cache efficiency by giving those requests a common intermediate caching point. Here, Origin Shield gives CloudFront requests a shared regional cache tier before the origin and can collapse repeated misses from downstream caches. This is the supported architecture.
3. Cache policies control the viewer attributes used to distinguish cached variants, and smaller meaningful cache keys normally improve reuse across equivalent requests. Here, Random cache-key values prevent reuse and would increase, not consolidate, origin requests. This does not meet the full requirement.
4. An NLB distributes TCP, UDP, and TLS traffic without needing HTTP-aware routing, making it suitable for high-volume transport services and fixed network endpoints. Here, NLB distributes transport connections but does not cache HTTP objects or combine repeated fetches. This does not meet the full requirement.

 

Question 16

A trading application uses custom TCP and runs in two Regions. If the primary load balancer becomes unhealthy, new client connections must be redirected quickly and the client endpoint must stay unchanged. Which service best provides this behavior?

1. Rely only on a long-lived DNS cache at each client
2. Use CloudFront cache behaviors for the custom protocol
3. Use Transit Gateway as a public anycast service
4. Use Global Accelerator with both regional load balancers as endpoints

Correct Answer(s)

 

D

Rationale

1. Route 53 latency-based routing answers DNS queries with a resource from the AWS Region that provides the lowest measured network latency for the requester among configured records. Here, DNS-only failover can be delayed by cached answers and does not preserve a pair of accelerator anycast IPs. This does not meet the full requirement.
2. CloudFront reduces viewer latency for cacheable web content by placing copies at edge locations and using the AWS edge network to reach configured origins. Here, CloudFront is not a general custom-TCP proxy for this workload. This does not meet the full requirement.
3. Transit Gateway replaces large meshes of point-to-point VPC connections with centralized routing among many VPC, VPN, and Direct Connect-connected networks. Here, Transit Gateway provides private routing among attachments and does not expose a global public anycast application endpoint. This does not meet the full requirement.
4. AWS Global Accelerator provides static anycast entry addresses and carries client traffic across the AWS global network to healthy regional endpoints based on policy and health. Here, Global Accelerator monitors endpoints and keeps its anycast entry addresses while selecting healthy regional destinations for incoming flows. This is the supported architecture.

 

Question 17

A browser application keeps long-lived bidirectional WebSocket sessions to a web tier and also needs HTTPS host-based routing before the upgrade. Which load balancer should be selected?

1. Use a gateway VPC endpoint
2. Use a Route 53 Resolver inbound endpoint
3. Use an Application Load Balancer with HTTPS listener rules
4. Use an NLB only because application routing is unnecessary

Correct Answer(s)

 

C

Rationale

1. For S3 or DynamoDB traffic originating in a VPC, a gateway endpoint installs service routes in selected route tables and avoids sending those requests through NAT. Here, Gateway endpoints provide private S3 or DynamoDB access and do not load balance browser WebSocket sessions. This does not meet the full requirement.
2. Hybrid DNS that needs on-premises clients to resolve AWS private names uses a Route 53 Resolver inbound endpoint plus forwarding rules on the on-premises DNS side. Here, Resolver inbound endpoints process DNS queries and are not application traffic load balancers. This does not meet the full requirement.
3. An ALB understands web requests rather than only transport flows, so one listener can direct different hosts or URL paths to separate target groups. Here, ALB can apply HTTP listener rules and supports WebSocket upgrades, matching both the routing and persistent-session requirements. This is the supported architecture.
4. A Network Load Balancer handles transport-layer flows at very high scale and supports TCP, UDP, TLS, and related protocols while providing fixed per-zone addresses. Here, NLB supports long-lived transport flows but does not perform the required host-based HTTP routing before the upgrade. This does not meet the full requirement.

 

Question 18

A provider VPC and a consumer VPC use overlapping CIDR ranges. The consumer needs private access to one provider API, but neither side should gain general routed access to the other’s network. Which approach fits?

1. Provision Direct Connect between the two VPCs
2. Create VPC peering despite overlapping address ranges
3. Attach both VPCs and route the identical CIDR ranges to each other
4. Expose the API through AWS PrivateLink and use an interface endpoint in the consumer VPC

Correct Answer(s)

 

D

Rationale

1. With Direct Connect, private or transit virtual interfaces can connect on-premises routing to VPC or Transit Gateway architectures without relying on the public internet as the transport. Here, Direct Connect links customer networks to AWS; it is not a service-scoped VPC-to-VPC mechanism for overlapping CIDRs. This does not meet the full requirement.
2. VPC peering provides direct private IP connectivity between two VPCs without a Transit Gateway, but the relationship is point-to-point and does not provide transitive routing. Here, VPC peering requires non-overlapping address spaces and would provide broader routed connectivity than requested. This does not meet the full requirement.
3. For multi-VPC connectivity at scale, a Transit Gateway acts as a managed routing hub and supports segmented route tables rather than requiring every VPC pair to be peered. Here, Transit routing cannot unambiguously route the same overlapping prefixes between these VPCs as though they were unique. This does not meet the full requirement.
4. An interface VPC endpoint uses AWS PrivateLink and creates endpoint network interfaces with private IP addresses in selected subnets for private service access. Here, PrivateLink is service-oriented rather than full-network peering, so consumers use endpoint ENIs without needing direct routing to the provider VPC CIDR. This is the supported architecture.

 

Question 19

An application is active in two Regions. Users may follow DNS answers normally, and the company wants Route 53 to prefer the lower-latency Region but stop returning an endpoint whose health check fails. Which design is appropriate?

1. Use Route 53 latency alias records with health evaluation configured appropriately
2. Use Global Accelerator because Route 53 cannot use latency routing with health checks
3. Advertise the public endpoints through Transit Gateway
4. Use Origin Shield as the DNS health checker

Correct Answer(s)

 

A

Rationale

1. Latency routing is a DNS policy for steering users toward regional endpoints according to Route 53 latency measurements rather than supplying fixed application anycast addresses. Here, Route 53 latency routing can steer users by measured regional latency and health evaluation can keep unhealthy records from normal selection. This is the supported architecture.
2. Global Accelerator accepts traffic at globally advertised static IP addresses, then steers flows over the AWS backbone toward healthy ALB, NLB, EC2, or Elastic IP endpoints. Here, Global Accelerator is another valid architecture but is not required when the stated design specifically accepts DNS-based latency and health routing. This does not meet the full requirement.
3. AWS Transit Gateway provides a regional hub for connecting many VPCs and hybrid attachments, with transit gateway route tables controlling how attachments can communicate. Here, Transit Gateway is a private route hub and does not answer internet DNS according to client latency. This does not meet the full requirement.
4. CloudFront Origin Shield adds a centralized regional caching layer in front of an origin, increasing the chance that misses from multiple edge locations are consolidated before reaching it. Here, Origin Shield is a CloudFront cache tier and does not provide Route 53 record selection or health policy. This does not meet the full requirement.

 

Question 20

A custom TCP application must be reachable worldwide through a small fixed IP allowlist. The workload is not cacheable and uses ports that are not HTTP or HTTPS. Which global service should front the regional endpoints?

1. Use CloudFront signed URLs as the transport endpoint
2. Use AWS Global Accelerator
3. Publish a Resolver inbound endpoint to internet clients
4. Use CloudFront because every global service caches custom TCP

Correct Answer(s)

 

B

Rationale

1. A CloudFront signed URL grants time-limited access to a specific private object and can include expiration and optional source-address restrictions in its policy. Here, Signed URLs authorize CloudFront object requests and cannot create transport support for a non-HTTP protocol. This does not meet the full requirement.
2. For latency-sensitive non-cacheable applications, Global Accelerator can shorten public-internet exposure and rapidly redirect new connections among healthy regional endpoints. Here, Global Accelerator supplies static anycast entry addresses and supports TCP application flows to healthy AWS regional endpoints without requiring object caching. This is the supported architecture.
3. A Route 53 Resolver inbound endpoint accepts DNS queries from connected on-premises networks and resolves names using the VPC resolver and associated private hosted zones. Here, Resolver inbound endpoints are for private DNS forwarding from connected networks, not public application traffic. This does not meet the full requirement.
4. A CloudFront distribution is appropriate when HTTP content can benefit from edge caching, optimized delivery, compression, or viewer-access controls close to users. Here, CloudFront is an HTTP content delivery network and does not proxy arbitrary custom TCP ports. This does not meet the full requirement.

• < Amazon AWS SAA-C03 High-Performance Networking, Load Balancing, CloudFront, Global Accelerator, and Private Connectivity Practice Test 1
• Amazon AWS SAA-C03 Data Ingestion, Streaming, Transfer, Transformation, Analytics, and Data Lakes Practice Test 1 >