Amazon AWS Certified Solutions Architect - Associate SAA-C03 Practice Test 60

Question 590

A team deploys CloudFront in front of a custom UDP voice-chat service and UDP packets never reach the origin. What service boundary did it miss?

CloudFront HTTP/3 support means it can accelerate every custom UDP game protocol without using a CloudFront distribution or HTTP semantics.
Attach an ALB HTTPS listener that forwards HTTP requests to the voice server and assume raw voice UDP packets are treated as HTTP/3 requests.
CloudFront is a content delivery service for supported HTTP(S) and related protocols, not an arbitrary UDP transport accelerator.
Add CloudFront Functions to rewrite the origin host header and expect the function to convert arbitrary UDP payloads into HTTP requests.

Explanation

Correct Answer

Use Global Accelerator or a fit-for-purpose transport endpoint for custom UDP rather than expecting CloudFront to forward it.

Incorrect Answers

HTTP/3 carries HTTP over QUIC, but it does not make CloudFront a generic arbitrary UDP listener for an application protocol.

ALB HTTP/HTTPS processing does not transform a custom UDP voice datagram protocol into valid HTTP/3 application requests.

CloudFront Functions run on supported CloudFront viewer events and do not provide a generic UDP ingress or protocol translation engine.

Question 591

A remote employee’s DNS resolver is located in another country, and Route 53 latency routing returns a different Region than the employee expected. Why?

Route 53 latency records use only the visitor’s browser GPS coordinates and ignore the recursive resolver performing DNS lookup.
Latency routing decisions depend partly on the resolver’s location and AWS latency data, not only the physical end-user geography.
Change the latency records to geolocation routing but expect the resulting DNS answer still to track lowest measured application RTT.
Create only health checks for all Regions and assume Route 53 will use the caller’s browser location to calculate latency without resolver context.

Explanation

Correct Answer

Inspect resolver/eDNS behavior and measured latency; geolocation rules serve a different policy requirement.

Incorrect Answers

DNS routing uses resolver/request location behavior and AWS latency measurements; user geographic IP and DNS resolver paths can differ.

Geolocation DNS applies a geographic policy, not the latency objective; it does not ensure the site with minimum observed AWS latency is chosen.

Health checks remove unhealthy records but do not replace the resolver/EDNS-client-subnet-dependent location used in latency selection.

Question 592

An engineer configured one Network Load Balancer TCP listener and expects /api/orders to route to a separate target group by URL path. Why does it not work?

A Network Load Balancer reads HTTP request paths, but it cannot forward two different protocols through the same target group.
Move the listener to TLS on the NLB and assume TLS termination exposes HTTP request paths for NLB path rules.
Assign each target group a different path prefix but keep one NLB TCP listener with only transport-level forwarding.
NLB performs transport-level balancing and does not parse HTTP paths into listener rules.

Explanation

Correct Answer

Select ALB for path/host routing or implement application routing behind the NLB.

Incorrect Answers

The failure is not a target-group protocol mix: NLB does not implement HTTP-layer URL path decisions on its TCP listener.

TLS termination on an NLB does not add HTTP Layer 7 path-based listener-rule support; ALB supports that function.

Target groups do not grant Layer 7 path inspection to a Network Load Balancer TCP listener.

Question 593

A client firewall permits only fixed destination IPs, but the team uses an ALB DNS name and hardcodes its current resolved IPs. Connections break after scaling. Why?

ALB always publishes exactly the same fixed A records for its lifetime, so IP allowlisting those records is a permanent contract.
ALB IP addresses can change and are not a guaranteed static allowlist target; an NLB or other supported static ingress is needed.
Configure the ALB listener with host-based routing rules and assume this pins its service node addresses to static IPs.
Use a Route 53 alias record to the ALB and expect the DNS alias to reserve the ALB’s previously resolved IP addresses permanently.

Explanation

Correct Answer

Do not treat the current IPs returned from an ALB hostname as a permanent network contract.

Incorrect Answers

ALB node IPs can change during scaling or maintenance; a static IP requirement calls for an NLB or other supported fixed ingress.

HTTP host rules determine application target selection, not the lifecycle or stability of ALB node IP addresses.

Aliases follow the load balancer DNS target, whose underlying node addresses can change; the alias is not a fixed-IP reservation.

Question 594

A packet inspection path sends outbound traffic through a firewall appliance but return traffic bypasses it, causing stateful drops. What is the defect?

Enable sticky target selection for flows entering the inspection load balancer while leaving the reverse-path subnet routing outside the same appliance fleet.
Adjust only the Gateway Load Balancer appliance health checks without restoring symmetric forwarding of return traffic.
Asymmetric routing prevents the stateful inspection appliance from observing both directions of a flow.
Increase the firewall appliance target group size without correcting the return-path route table.

Explanation

Correct Answer

Use symmetric routes and GWLB endpoint integration as required instead of tuning only appliance CPU.

Incorrect Answers

Flow stickiness on the forward path cannot restore stateful inspection when reply packets bypass the appliance entirely. Both directions must traverse the intended symmetric inspection path.

Health checks measure appliance availability, but stateful inspection still fails when the reverse direction bypasses its flow state.

Additional inspection capacity cannot establish state for flows whose reply packets never traverse the same stateful inspection path.

Question 595

A consumer creates an INTERFACE VPC endpoint for one provider endpoint service hosted behind a Network Load Balancer. It then expects that interface endpoint to act as a normal routed network connection to every CIDR in the provider VPC. Those unrelated CIDRs remain unreachable. Why?

PrivateLink automatically advertises every consumer subnet and route to all provider VPCs, so its endpoint should behave like a mesh router.
Change the interface endpoint security group to allow all outbound ports and assume it will install routes to every provider VPC subnet.
PrivateLink provides private access to the published endpoint service, not broad or transitive VPC routing.
Add every provider CIDR to a client subnet route table with the interface endpoint ID as target, assuming arbitrary service endpoint routing is supported.

Explanation

Correct Answer

Choose TGW or suitable routing if whole-network reachability is explicitly needed.

Incorrect Answers

PrivateLink exposes a service endpoint through interface endpoints; it does not grant general VPC-to-VPC transitive network connectivity.

Security group rules permit traffic to reachable endpoint interfaces but do not turn a service-specific interface endpoint into a routed VPC-to-VPC network path.

An interface endpoint is an endpoint-service access mechanism, not a general route-table transit attachment to arbitrary provider subnets; AWS now offers distinct tunnel endpoints for authorized network segments.

Question 596

Two Transit Gateway attachments exist but packets between their VPCs drop; each is associated with a TGW route table lacking the destination propagated/static route. What is missing?

TGW attachment presence alone does not create a valid route in the associated TGW route tables.
An attached VPC automatically has routes to every other Transit Gateway attachment even when its TGW route-table associations are empty.
Add routes only to the individual VPC subnet route tables, leaving the associated Transit Gateway route tables without destination routes.
Enable an unrelated VPC peering connection and assume peering propagates missing CIDR routes into all TGW route tables.

Explanation

Correct Answer

Check route propagation, table association and each VPC subnet route table before declaring the hub network connected.

Incorrect Answers

Transit Gateway routing requires correct attachment association and propagation/static routes; attachment existence alone cannot create a forwarding path.

VPC routes can direct packets toward the TGW, but TGW forwarding still needs a viable route in the table associated with the ingress attachment.

VPC peering does not automatically populate TGW attachment associations or propagated/static destinations.

Question 597

A traceroute from VPC A toward VPC C stops at the B boundary even after adding routes in A and B. Why?

An additional route in the intermediate peered VPC can override AWS non-transitive peering behavior for any destination CIDR.
VPC peering does not permit transitive routing through an intermediate peered VPC.
Enable DNS resolution for the A-to-B and B-to-C peering connections and assume it grants transitive forwarding between peer connections.
Add a security-group rule in B allowing A’s CIDR and assume the group grants B router-transit permissions to C.

Explanation

Correct Answer

More static entries cannot override peering nontransitivity; redesign the connectivity topology.

Incorrect Answers

Peering nontransitivity is a network capability constraint, not a routing table entry missing from B.

Peering DNS resolution may affect name lookup but cannot remove AWS VPC peering nontransitivity.

Security groups authorize instance-level flows; they do not make a peered VPC act as a transit router for another peering.

Question 598

A Direct Connect circuit is in place but auditors require encrypted traffic in transit; the team assumes every private VIF encrypts automatically. What is wrong?

Because Direct Connect is a dedicated circuit, its private VIF automatically encrypts each application packet end-to-end with TLS.
Use a private virtual interface and assume BGP route authentication encrypts application payload bytes across the link.
Attach the Direct Connect gateway to a virtual private gateway and claim the gateway association automatically applies TLS to all packets.
A private Direct Connect virtual interface does not by itself provide end-to-end application encryption; add TLS or supported VPN/MACsec options where appropriate.

Explanation

Correct Answer

Dedicated transport differs from cryptographic confidentiality and must be designed separately.

Incorrect Answers

Dedicated private connectivity does not automatically supply application-layer encryption; use TLS or supported overlay encryption when required.

BGP session controls and route authentication are not end-to-end encryption of the carried application traffic.

The association enables private network reachability but is not a general application-traffic encryption mechanism.

Question 599

A branch team expects predictable dedicated line performance solely because its Site-to-Site VPN tunnel reports UP. Packet performance still varies. Why?

An IPSec VPN tunnel uses the public Internet as transport, so every application automatically receives dedicated 10-Gbps bandwidth.
Increase the VPN tunnel IKE/IPsec encryption strength and assume that alone creates a dedicated fixed-bandwidth transport circuit.
The VPN traverses public Internet links and cannot guarantee dedicated bandwidth or the stability of a private circuit.
Enable equal-cost BGP paths across the VPN tunnels and assume public ISP congestion can no longer affect throughput or latency.

Explanation

Correct Answer

For a firm bandwidth/latency contract, evaluate Direct Connect and additional resiliency rather than tunnel-up status alone.

Incorrect Answers

VPN encrypts on shared Internet transport; it does not guarantee dedicated physical bandwidth or fixed Internet path characteristics.

Cryptographic strength protects confidentiality and integrity but does not reserve bandwidth on the Internet path carrying the IPsec tunnel.

Redundant routing can improve availability and distribute traffic in supported cases but cannot guarantee dedicated carrier capacity on Internet transport.

Question 600

An engineer attaches a Direct Connect gateway and assumes it provides transitive VPC-to-VPC routing for every associated VPC. Why is the assumption wrong?

Associating multiple VPCs to the same DX gateway implicitly installs full-mesh VPC-to-VPC routes with no other routing constructs.
A Direct Connect gateway is not a general transit router between associated VPCs; its forwarding scope is for DX-related traffic.
Advertise the same on-premises prefixes to each associated virtual private gateway and assume the DX gateway forwards directly between two attached VPCs.
Enable BGP route propagation from the Direct Connect connection and assume this bypasses the documented VPC-to-VPC forwarding restrictions.

Explanation

Correct Answer

Use Transit Gateway/appropriate topology for VPC-to-VPC routing; DX gateway association alone is not mesh connectivity.

Incorrect Answers

DX gateway is not a general inter-VPC transit plane; an appropriate TGW design is needed for those paths.

A Direct Connect gateway facilitates on-premises reachability via supported associations, not transitive east-west routing between its associated VPCs.

Learning prefixes over BGP does not turn Direct Connect gateway into a generalized VPC transit router.

Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

Question 590

Explanation

Correct Answer

Incorrect Answers

Question 591

Explanation

Correct Answer

Incorrect Answers

Question 592

Explanation

Correct Answer

Incorrect Answers

Question 593

Explanation

Correct Answer

Incorrect Answers

Question 594

Explanation

Correct Answer

Incorrect Answers

Question 595

Explanation

Correct Answer

Incorrect Answers

Question 596

Explanation

Correct Answer

Incorrect Answers

Question 597

Explanation

Correct Answer

Incorrect Answers

Question 598

Explanation

Correct Answer

Incorrect Answers

Question 599

Explanation

Correct Answer

Incorrect Answers

Question 600

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Associate SAA-C03 Practice Tests