Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 58

Question 570

A global multiplayer game must use TCP and UDP endpoints with stable global entry IP addresses, and must rapidly route clients around unhealthy Regional endpoints. Which front door fits?

Use CloudFront as a raw UDP proxy with two static anycast IP addresses and expect it to route arbitrary datagrams.
Use an Application Load Balancer HTTPS listener as the only global entry IP and assume it directly accepts arbitrary UDP game traffic.
Publish one Regional NLB address through DNS and assume it automatically provides globally stable anycast IPs and health-based routing across Regions.
Use AWS Global Accelerator with static anycast IP addresses and appropriately configured Regional endpoints.

Explanation

Correct Answer

Global Accelerator uses the AWS global network for supported transport traffic and endpoint health-driven traffic steering.

Incorrect Answers

CloudFront distributes supported HTTP(S) web content; Global Accelerator is the AWS global IP-based accelerator for general TCP/UDP endpoints.

An ALB targets HTTP/HTTPS application requests and is not a general UDP global anycast endpoint; Global Accelerator supports static anycast and TCP/UDP use cases.

A Regional load balancer cannot on its own deliver Global Accelerator’s global anycast ingress and cross-Region endpoint-group health routing.

Question 571

A global service has endpoint records in three AWS Regions and wants DNS-based low-latency selection, plus avoidance of unhealthy targets. Select THREE elements that make the solution operational.

Create Region-appropriate Route 53 latency records for the eligible service endpoints.
Use geolocation routing alone and claim it always selects the region with the lowest current end-to-end user latency.
Configure one static A record to a single Region and assume it will automatically select lower-latency Regions.
Use Route 53 weighted routing with no endpoint health checks and assume equal DNS weights continually select the lowest-latency healthy Region.
Associate suitable Route 53 health checks or supported target health evaluation so unhealthy endpoints can be excluded.
Define healthy fallback behavior and validate resolution from representative user resolver locations.

Explanation

Correct Answer

Latency records allow the DNS policy to choose among Regions based on AWS-measured latency for the requester/resolver context.

Without health evaluation a latency-preferred Region can still be selected despite a failed application.

Resolvers may be geographically displaced and caches can affect observed DNS choices; testing verifies the actual policy behavior.

Incorrect Answers

Geolocation rules bind request locations to configured endpoints, while latency routing uses measured AWS network latency to choose among regions.

A static record does not compare Regions or implement a health-aware latency policy.

Weighted DNS routing allocates answers according to configured ratios; it does not compare AWS latency metrics or exclude an unhealthy service without separately configured health evaluation.

Question 572

A platform serves /api/orders and /api/payments on distinct container target groups behind a single HTTPS hostname. Which load balancer supports HTTP path routing?

Place both HTTP applications behind a TCP Network Load Balancer and configure URL /api/orders and /api/payments path rules on that TCP listener.
Create one ALB HTTPS listener forwarding to a default target group but omit the required path-condition rules, assuming target-group names matching URL paths trigger routing.
Use an Application Load Balancer HTTPS listener with path-based rules forwarding to distinct target groups.
Create Route 53 DNS records for both URL paths and assume DNS resolution can choose a backend using the path portion of a single HTTPS request.

Explanation

Correct Answer

ALB operates at the HTTP application layer and matches paths/hosts for supported Layer 7 routing.

Incorrect Answers

An NLB works at transport level and cannot evaluate HTTP URL paths as ALB listener rules do.

An ALB can inspect URL paths, but only configured listener path rules direct each matched request to the intended target group. Target-group names do not automatically become routing conditions.

DNS answers by host name, not the HTTP URL path. Listener path rules are evaluated after the HTTPS request reaches the ALB.

Question 573

A financial TCP protocol needs stable IP addresses for customer firewall allowlists and TLS pass-through to application servers. What load-balancer type fits best?

Use an Application Load Balancer DNS name as a contractual fixed IPv4 allowlist address without providing any stable-ingress design.
Place an ALB behind a Route 53 alias and tell customer firewalls to permanently allow the address returned by the alias during setup.
Terminate the protocol as HTTP on an ALB even though the application is non-HTTP TCP and requires TLS pass-through.
Use a Network Load Balancer with supported static IP/EIP configuration and TLS/TCP listener behavior.

Explanation

Correct Answer

NLB offers Layer 4 forwarding with static addresses per enabled AZ, appropriate for protocol pass-through.

Incorrect Answers

ALB DNS targets and underlying node IP addresses can change; NLB supports documented static IP and Elastic IP assignment patterns.

A Route 53 alias follows an ALB target, whose node addresses can change. DNS indirection does not convert its currently resolved addresses into a static client-side allowlist contract.

ALB requires compatible Layer 7 protocols, while NLB supports raw TCP/TLS transport behavior and more suitable static IP options.

Question 574

Security appliances must inspect all traffic between application VPCs while automatically scaling without manually inserting each appliance instance into every route. What managed integration fits?

Send only outbound packets through the stateful inspection appliance and allow replies to bypass it, relying on matching security group rules.
Insert a single fixed inspection appliance by manually changing every VPC route and assume all return flows will always choose the same appliance after scale-out.
Deploy Gateway Load Balancer with a compatible inspection appliance fleet and symmetric traffic routing.
Use a standard Application Load Balancer to intercept arbitrary VPC-to-VPC IP traffic and transparently insert stateful appliances without service routing.

Explanation

Correct Answer

GWLB encapsulates traffic to inline appliances and supports scaling/availability for inspection services.

Incorrect Answers

Stateful appliances must observe both directions of a flow; asymmetric paths break state tracking even when the security group allows packets.

Stateful inspection needs symmetrical routing and managed appliance scale/failover. Gateway Load Balancer supports transparent appliance fleets and suitable flow stickiness.

An ALB routes HTTP/HTTPS application requests; it is not a transparent Layer 3/4 appliance insertion service for general network packets.

Question 575

A provider hosts a privately reachable HTTPS API in its VPC and wants 30 customer accounts to connect without transitive VPC networks or publicly exposed ingress. Which service model?

Use one VPC peering connection to provide a privately published provider service to 30 untrusted consumers with automatic transitive routing.
Offer the service with AWS PrivateLink endpoint service and customer interface endpoints.
Attach the customer VPCs to a Transit Gateway shared with the provider and assume route segmentation alone confines every consumer to only the published HTTPS API.
Expose the provider API through a public Internet gateway and assume a customer interface endpoint privately connects to it with no endpoint service configuration.

Explanation

Correct Answer

PrivateLink exposes one specific service privately over endpoint ENIs and avoids full network peering.

Incorrect Answers

Peering is not transitive and creates broader network-connectivity relationships than the endpoint-service access boundary requested.

Transit Gateway provides IP routing across attachments and requires separate isolation policies. It does not inherently limit reachability to the one service interface the provider intends to expose.

PrivateLink requires a supported provider endpoint service and consumer endpoint; public Internet routing does not supply the desired private service exposure.

Question 576

A company has 60 application VPCs and multiple on-premises locations that require controlled inter-VPC connectivity without building a full mesh of peering links. Which architecture?

Attach the networks to a centrally governed AWS Transit Gateway with segmented route tables.
Build a full mesh of direct VPC peering links and assume the resulting peerings allow transitive traffic between every other VPC.
Deploy an AWS PrivateLink endpoint service in each of the 60 VPCs and expect those service endpoints to route any arbitrary private CIDR between all the company networks.
Assume VPC peering connections are automatically transitive, so a single peered transit VPC can securely route every other VPC through it.

Explanation

Correct Answer

Transit Gateway supports scalable hub-and-spoke routing and central segmentation through associations and propagation.

Incorrect Answers

VPC peering is non-transitive; a large hub-and-spoke topology with route segmentation fits many-VPC connectivity better.

PrivateLink exposes supported services and resources through specific endpoints; it is not a general transit-routing plane for many VPC CIDRs and multiple on-premises networks.

VPC peering is nontransitive. A centrally managed Transit Gateway with explicit tables is the suitable hub for this network scale.

Question 577

Two VPCs are intended to use private VPC peering, but VPC A has IPv4 CIDR 10.20.0.0/16 and VPC B has 10.20.8.0/24. The peering request enters Failed even though the intended application subnets do not use overlapping addresses. Why?

VPC peering always supports overlapping IPv4 CIDR blocks when administrators configure a route table containing only the nonoverlapping application subnets.
A VPC peering connection cannot be created when the VPC IPv4 CIDR ranges overlap; redesign the address plans or choose a separately supported translated-traffic architecture.
The request fails only because the requester and accepter are in different AWS accounts; direct peering is prohibited across account boundaries.
An AWS Transit Gateway attached to both VPCs automatically makes every overlapping address unambiguous without an explicit translation or routing design.

Explanation

Correct Answer

A VPC peering connection fails if any declared IPv4 CIDR block overlaps a peer VPC block. Re-address the overlapping space for ordinary peering or use an explicitly designed translation alternative if suitable.

Incorrect Answers

The peering control plane checks the CIDR blocks of both VPCs, not just subnets that the application plans to use. Overlap blocks direct peering despite any intended narrow route entries.

Cross-account and inter-Region VPC peering are supported with proper requester and accepter authorization. Account boundaries do not explain the reported failed state with overlapping CIDRs.

A transit gateway is a routing hub but does not magically resolve ambiguous destinations when both attached VPCs advertise overlapping IPv4 CIDRs. Overlap requires dedicated address/translation planning.

Question 578

A factory requires a dedicated high-throughput hybrid connection and encryption for confidential file transfers. Select TWO complementary controls needed to satisfy both network and confidentiality requirements.

Apply supported end-to-end TLS or other appropriate encryption, including a VPN over Direct Connect if required by the transport design.
Use AWS Site-to-Site VPN over a best-effort Internet link as the sole physical path while promising deterministic private-circuit bandwidth.
Replace the application link with S3 Transfer Acceleration as the only private hybrid circuit.
Provision appropriately sized AWS Direct Connect connectivity and supported virtual interface/routing to the target VPCs.
Encrypt only the branch router logging output while leaving confidential application payloads plaintext.

Explanation

Correct Answer

A Direct Connect private VIF is not intrinsically an end-to-end encryption mechanism; encryption must be enforced independently.

Direct Connect supplies the private dedicated transport and bandwidth characteristics when capacity and paths are correctly provisioned.

Incorrect Answers

VPN encrypts traffic over Internet links but does not provide the dedicated link capacity and routing properties of Direct Connect.

Transfer Acceleration is an S3 upload path, not a dedicated on-premises hybrid private-network connection.

Router logging protection does not encrypt the actual file-transfer data in transit.

Question 579

A branch must securely connect to a VPC next week and its ISP link is already available. Dedicated fiber cannot be installed quickly. Which hybrid option is practical?

Use Direct Connect as the only deployment method for next-week branch connectivity despite the lack of available carrier provisioning.
Choose Site-to-Site VPN but configure only one of the two managed tunnel endpoints, assuming the single tunnel also provides a tested high-availability failover path.
Configure AWS Site-to-Site VPN with appropriate gateways, tunnels and route exchange over the existing Internet.
Use a single unencrypted public subnet route from the branch and assume that meets the stated site-to-site protected connectivity requirement.

Explanation

Correct Answer

Site-to-Site VPN provides encrypted IPsec connectivity without requiring new dedicated physical circuits.

Incorrect Answers

Direct Connect circuit provisioning can require carrier lead time; VPN can use the existing Internet and supported AWS gateways quickly.

The existing ISP can support a rapid VPN deployment, but using just one working tunnel introduces a maintenance and path-failure dependency; configure and test both where required for resiliency.

The branch needs encrypted transport over its existing ISP. Managed Site-to-Site VPN supplies IPsec tunnels and routing controls.

Question 580

A company has an existing Direct Connect link and needs a supported private network design reaching VPCs in multiple AWS Regions through the enterprise connection. What gateway capability fits?

Use a Direct Connect gateway with appropriate private virtual interfaces and associated transit or virtual private gateways.
Rely on a Direct Connect gateway alone as the transitive router between all attached VPCs without configuring a Transit Gateway.
Attach a transit virtual interface to a Direct Connect gateway, but omit the appropriate Transit Gateway associations and route advertisements while assuming all remote VPC CIDRs become reachable by default.
Build arbitrary private virtual interfaces without Direct Connect gateway association or compatible gateway routes and assume every Region is reachable.

Explanation

Correct Answer

A Direct Connect gateway extends supported DX virtual interfaces to VPC gateway associations across Regions according to documented constraints.

Incorrect Answers

Direct Connect gateway connectivity to AWS resources is scoped to DX association and its routing behavior, not arbitrary east-west transit.

A transit virtual interface alone does not establish destination route associations or satisfy allowed-prefix and TGW route-table requirements. Cross-Region reachability must be explicitly designed.

Cross-Region private connectivity needs supported gateway associations, routes and policy; merely having an active DX port is insufficient.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 570

Explanation

Correct Answer

Incorrect Answers

Question 571

Explanation

Correct Answer

Incorrect Answers

Question 572

Explanation

Correct Answer

Incorrect Answers

Question 573

Explanation

Correct Answer

Incorrect Answers

Question 574

Explanation

Correct Answer

Incorrect Answers

Question 575

Explanation

Correct Answer

Incorrect Answers

Question 576

Explanation

Correct Answer

Incorrect Answers

Question 577

Explanation

Correct Answer

Incorrect Answers

Question 578

Explanation

Correct Answer

Incorrect Answers

Question 579

Explanation

Correct Answer

Incorrect Answers

Question 580

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests