Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 59

Question 580

A company has an existing Direct Connect link and needs a supported private network design reaching VPCs in multiple AWS Regions through the enterprise connection. What gateway capability fits?

Use a Direct Connect gateway with appropriate private virtual interfaces and associated transit or virtual private gateways.
Rely on a Direct Connect gateway alone as the transitive router between all attached VPCs without configuring a Transit Gateway.
Attach a transit virtual interface to a Direct Connect gateway, but omit the appropriate Transit Gateway associations and route advertisements while assuming all remote VPC CIDRs become reachable by default.
Build arbitrary private virtual interfaces without Direct Connect gateway association or compatible gateway routes and assume every Region is reachable.

Explanation

Correct Answer

A Direct Connect gateway extends supported DX virtual interfaces to VPC gateway associations across Regions according to documented constraints.

Incorrect Answers

Direct Connect gateway connectivity to AWS resources is scoped to DX association and its routing behavior, not arbitrary east-west transit.

A transit virtual interface alone does not establish destination route associations or satisfy allowed-prefix and TGW route-table requirements. Cross-Region reachability must be explicitly designed.

Cross-Region private connectivity needs supported gateway associations, routes and policy; merely having an active DX port is insufficient.

Question 581

An IPv6-only private EC2 subnet must make HTTPS requests to an IPv4-only third-party API hostname. Its ordinary ::/0 route goes to an egress-only Internet gateway, but the IPv4-only service is unreachable. Which additional networking design is needed?

Attach a second egress-only internet gateway and assume it transparently converts IPv6 addresses into public IPv4 addresses for every destination.
Enable DNS64 for the subnet and route synthesized 64:ff9b::/96 destinations to a supported NAT gateway configured for NAT64 toward IPv4 services.
Remove IPv6 from the subnet and assume the EC2 instances automatically receive routable public IPv4 addresses without a new configuration.
Route 0.0.0.0/0 from the IPv6-only subnet to an egress-only Internet gateway because an IPv6 route target also supports native IPv4 translation.

Explanation

Correct Answer

DNS64 produces synthesized IPv6 records for IPv4-only names, and the 64:ff9b::/96 route steers that traffic through a NAT gateway that translates it to IPv4. Native IPv6 can continue using its own ::/0 egress-only route.

Incorrect Answers

An egress-only Internet gateway supports outbound native IPv6, not protocol translation to IPv4-only endpoints. Adding another egress-only gateway does not create NAT64 connectivity.

Disabling IPv6 would defeat the IPv6-only subnet design. Public IPv4 assignment, routing, and DNS would still require explicit supported changes; it is not an automatic NAT64 substitute.

The egress-only Internet gateway processes outbound IPv6 connections only and is not a target for IPv4 default routes or IPv6-to-IPv4 address translation.

Question 582

A VPC application must connect to an on-premises inventory service through AWS Transit Gateway, and the partner requires requests to appear from one approved PRIVATE IPv4 address. No part of this path may use public Internet egress. Which managed NAT design should be considered?

Use a public NAT gateway Elastic IP as the translated source address through the Transit Gateway and assume an EIP is always visible across private routing.
Use a private NAT gateway with suitable Transit Gateway routes so the on-premises service sees its private translated source address; do not route that gateway to an Internet gateway.
Use an egress-only Internet gateway for all IPv4 requests to the on-premises service, relying on it to perform private IPv4 source NAT.
Attach one public Internet gateway and use its public IPv4 address as a stable translated private RFC1918 source visible to the inventory service.

Explanation

Correct Answer

A private NAT gateway can translate source addresses for flows sent through Transit Gateway or a virtual private gateway toward private networks. The translated private gateway address can be approved by the partner while no Internet gateway path is used.

Incorrect Answers

When a public NAT gateway routes through a transit gateway or virtual private gateway, remote destinations see the NAT gateway private IP address rather than the Elastic IP. EIP translation happens at the Internet gateway, which this private path does not use.

An egress-only Internet gateway supports outbound-only native IPv6 and does not perform source NAT on the required IPv4 connection to a private on-premises network.

An Internet gateway is used for public Internet routing and does not provide a stable private RFC1918 NAT source for a Transit Gateway-connected partner network. The required translation and routing are private.

Question 583

Instances in private subnets must call a supported AWS API through an interface VPC endpoint using its usual hostname, with access restricted to an approved security group. Select TWO configuration items directly required.

Enable and verify private DNS for the supported interface endpoint so the normal AWS service hostname resolves to private endpoint addresses.
Create an interface endpoint but leave its private DNS disabled and require applications to use unchanged public service hostnames.
Turn off all VPC DNS resolution and expect the normal service hostname to keep resolving privately.
Add a public IP to every instance and force the API request through an Internet gateway.
Apply appropriate interface-endpoint security group rules and endpoint/IAM policy authorization to the calling application.

Explanation

Correct Answer

Private DNS maps the usual service endpoint name to the interface endpoint when the VPC DNS prerequisites hold.

Private resolution alone does not allow flows through endpoint ENIs or establish the AWS API permissions.

Incorrect Answers

Without private DNS or explicit endpoint DNS usage, a normal public hostname can continue resolving to public endpoints instead of the interface VPCE.

Private DNS requires usable VPC DNS features; disabling resolution prevents the intended hostname mapping.

Public egress defeats the requirement to use the private interface endpoint.

Question 584

A global video portal has CloudFront caches in several regions, but the origin receives duplicate simultaneous requests for a new popular object from many regional edge caches. Which additional cache layer helps?

Enable Origin Shield but set every HTML and image response to no-store, expecting shield to cache the entire uncachable workload.
Increase each Regional CloudFront edge cache TTL only and assume origin request collapse among multiple edge regions happens automatically for every simultaneous miss.
Enable CloudFront Origin Shield in a suitable Region between regional caches and the origin.
Add a second CloudFront distribution pointing at the same origin, but configure no shared Origin Shield cache and assume distinct distributions automatically collapse simultaneous misses into one origin fetch.

Explanation

Correct Answer

Origin Shield consolidates eligible origin fetches and raises cache reuse across regional edge-cache populations.

Incorrect Answers

Origin Shield helps consolidate cacheable requests; responses explicitly not eligible for caching still require origin fetches.

Longer TTL can improve later hits but may not consolidate simultaneous cache misses across separate edge caches. Origin Shield supplies an additional centralized caching layer.

Separate distributions do not inherently create one shared shield layer across their regional caches. Origin Shield supplies the centralized extra cache and eligible concurrent-request consolidation.

Question 585

An enterprise must route visitors from approved countries to legally designated sites even when latency would be lower elsewhere. Which Route 53 policy should be considered?

Use latency-based DNS routing to guarantee that visitors from each named country always reach the legally designated regional endpoint.
Use Route 53 geolocation routing with the required country/continent rules and a deliberate default response.
Use Route 53 geoproximity bias toward the nearest infrastructure Region and assume it enforces a fixed country-to-legal-site mapping for every visitor regardless of geographic boundary.
Use Route 53 weighted routing with equal weights and assume it deterministically selects a legally required destination for each visitor country.

Explanation

Correct Answer

Geolocation rules encode geographic policy; latency routing optimizes estimated Region response times instead.

Incorrect Answers

Latency routing optimizes network response and can choose a different Region; explicit geolocation/geoproximity policy and legal controls are needed.

Geoproximity selects endpoints based on resource and user location with optional bias; its proximity decisions do not directly encode every required country-specific legal mapping as explicit geolocation records do.

Weighted routing distributes DNS answers by weight, not the visitor’s required geographic jurisdiction. Geolocation mapping and policy are needed.

Question 586

A new EKS cluster needs hundreds of pod IPs across private subnets. The subnet CIDRs have only a dozen unassigned IPv4 addresses each. What must be planned?

Only raise the maximum EKS node group desired count while leaving each subnet with too few free IPv4 addresses for pod ENIs.
Expand the available VPC subnet IP address capacity and CNI/prefix allocation plan before scaling the pod fleet.
Increase only EKS node CPU and memory capacity while leaving the exhausted subnet CIDR address pools and VPC CNI allocation unchanged.
Raise the Kubernetes deployment replica count and assume the Amazon VPC CNI can create unlimited private IPv4 addresses in a nearly full subnet.

Explanation

Correct Answer

IPv4 addresses consumed by node and pod ENIs can prevent scheduling when subnet address space is exhausted.

Incorrect Answers

The worker count cannot create missing routable pod IPs; CNI prefix delegation and subnet capacity must be planned independently.

Pod IP allocation depends on VPC subnet/ENI/prefix addresses, not just compute. Nodes with free CPU can still have Pending pods when addresses run out.

EKS pod networking is constrained by subnet addresses and instance/ENI allocation limits; scaling deployments does not manufacture routable IP space.

Question 587

An analytics service continuously transfers terabytes between application nodes in AZ-a and a database in AZ-b; latency is acceptable but network transfer spend is high. What is a suitable tradeoff analysis?

Move both application and database permanently into the same AZ and disable all replicated storage and failover capacity.
Double application server CPU in AZ-a and assume that stops bills for packets it still sends to a database in AZ-b.
Enable a cross-zone load-balancing setting between the existing application instances but leave the continuous database query path crossing from AZ-a to AZ-b.
Evaluate same-AZ placement for high-volume paths while retaining an appropriate multi-AZ availability strategy.

Explanation

Correct Answer

Cross-AZ data transfer can be billed; locality reduces needless steady traffic at the cost of failure-domain placement tradeoffs.

Incorrect Answers

Although locality can reduce transfer costs, removing multi-AZ resilience violates the stated availability requirement.

Compute resizing does not change the network path. Recurring large cross-AZ reads/writes can drive transfer costs even when latency is acceptable.

Cross-zone load balancing can distribute frontend requests but does not automatically move the database or reduce bytes exchanged over the still-cross-AZ application-to-database path.

Question 588

A hybrid VPN connection uses only one working IPsec tunnel; maintenance on that tunnel interrupts branch operations. What design supports a resilient link?

Configure both supported Site-to-Site VPN tunnels with suitable BGP/route failover and on-premises redundancy.
Configure one VPN tunnel with a very long idle timeout and assume it provides redundancy when its underlying path fails.
Leave all on-premises routes pinned to one VPN tunnel and assume the mere presence of the second configured tunnel ensures traffic moves after a failure.
Use only one working Site-to-Site VPN tunnel because AWS automatically guarantees zero packet loss during all single-tunnel maintenance.

Explanation

Correct Answer

Two tunnels with tested failover reduce dependence on a single VPN tunnel or provider path.

Incorrect Answers

A single working path cannot provide resilient failover; configure both tunnels, routing and on-premises redundancy.

Both tunnels need on-premises routing/health failover configured. A backup tunnel that is never selected does not provide operational redundancy.

VPN maintenance can interrupt a sole active tunnel. Configure two supported tunnels and BGP/health routing on both ends as appropriate.

Question 589

CloudFront uses a cache policy with Minimum TTL = 0 for an image path. Every image response from the S3 origin includes Cache-Control: no-store, and repeated nonconcurrent viewer requests still cause nearly the same number of origin GETs. Why?

CloudFront automatically caches responses with Cache-Control: private,no-store if its distribution has many edge locations.
Configure an edge cache policy that includes only the image extension, but leave the origin no-store directive and the cache policy minimum TTL at zero.
Enable Origin Shield alone and assume it overrides no-store while the minimum TTL remains zero.
The origin response forbids caching, so edge locations repeatedly fetch the same objects rather than serving hits.

Explanation

Correct Answer

Correct cache eligibility, behavior and TTL strategy; a CDN domain alone cannot cache responses forbidden by origin headers.

Incorrect Answers

The origin response controls caching eligibility; a no-store/private policy can prevent the intended shared edge cache hits.

Changing the cache key without making the object cacheable cannot overcome the effective zero TTL plus origin no-store directive.

Origin Shield adds a caching layer and can consolidate eligible misses, but it does not inherently override noncacheability imposed by the origin and an effective zero minimum TTL.

Question 590

A team deploys CloudFront in front of a custom UDP voice-chat service and UDP packets never reach the origin. What service boundary did it miss?

CloudFront HTTP/3 support means it can accelerate every custom UDP game protocol without using a CloudFront distribution or HTTP semantics.
Attach an ALB HTTPS listener that forwards HTTP requests to the voice server and assume raw voice UDP packets are treated as HTTP/3 requests.
CloudFront is a content delivery service for supported HTTP(S) and related protocols, not an arbitrary UDP transport accelerator.
Add CloudFront Functions to rewrite the origin host header and expect the function to convert arbitrary UDP payloads into HTTP requests.

Explanation

Correct Answer

Use Global Accelerator or a fit-for-purpose transport endpoint for custom UDP rather than expecting CloudFront to forward it.

Incorrect Answers

HTTP/3 carries HTTP over QUIC, but it does not make CloudFront a generic arbitrary UDP listener for an application protocol.

ALB HTTP/HTTPS processing does not transform a custom UDP voice datagram protocol into valid HTTP/3 application requests.

CloudFront Functions run on supported CloudFront viewer events and do not provide a generic UDP ingress or protocol translation engine.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 580

Explanation

Correct Answer

Incorrect Answers

Question 581

Explanation

Correct Answer

Incorrect Answers

Question 582

Explanation

Correct Answer

Incorrect Answers

Question 583

Explanation

Correct Answer

Incorrect Answers

Question 584

Explanation

Correct Answer

Incorrect Answers

Question 585

Explanation

Correct Answer

Incorrect Answers

Question 586

Explanation

Correct Answer

Incorrect Answers

Question 587

Explanation

Correct Answer

Incorrect Answers

Question 588

Explanation

Correct Answer

Incorrect Answers

Question 589

Explanation

Correct Answer

Incorrect Answers

Question 590

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests