Pass Your Amazon AWS Certified Solutions Architect - Associate SAA-C03 Exam Easy!

DX gateway is not a general inter-VPC transit plane; an appropriate TGW design is needed for those paths.

A Direct Connect gateway facilitates on-premises reachability via supported associations, not transitive east-west routing between its associated VPCs.

Learning prefixes over BGP does not turn Direct Connect gateway into a generalized VPC transit router.

NAT64 translates IPv6-to-IPv4 for eligible destinations; it is not the general IPv6 outbound-only connectivity service.

The egress-only Internet gateway enables stateful outbound IPv6 connectivity while preventing unsolicited IPv6 initiation from the Internet; it is not an IPv4 NAT device.

An ordinary Internet gateway can facilitate bidirectional routing; an egress-only Internet gateway enforces the required egress initiation boundary.

Zonal gateways have an AZ failure boundary; sharing one across private subnets creates egress dependency on that AZ.

Additional Elastic IP addresses can expand simultaneous-connection capacity for a public NAT gateway, but they do not relocate its zonal processing or change the subnet route-table target. The AZ-a failure remains a shared dependency.

A newly created NAT gateway is not an automatic route-table replacement for a failed zonal gateway. Subnets whose default routes still target AZ-a remain dependent on AZ-a until the routing is changed to an AZ-local gateway or an applicable regional NAT design.

Private DNS is generally what maps supported public service hostnames to endpoint-local private addresses; disabling it can break this mapping.

Security groups affect connectivity to endpoint interfaces, but do not redirect public hostname resolution to interface endpoint private addresses.

IAM permission changes do not populate the private hosted-zone DNS mappings needed to select the interface endpoint by its normal service hostname.

Origin Shield adds another caching layer but does not disable caching at edges or require one shield per user; it is subject to the same distinct cache keys.

An explicit cache policy controls which cookie dimensions enter the cache key. Origin Shield does not silently override that policy.

S3 storage-class changes do not fix differing CloudFront cache-key identities and archiving an actively served image can hurt availability.

Latency-based selection does not enforce a legal country boundary and may vary with resolver location and measured latency.

Weighted records control relative shares, not country eligibility; responses can still direct a user to a disallowed location.

Health checks can suppress unhealthy endpoints, but a healthy endpoint outside the legal geography remains eligible under pure latency routing.

Pod scheduling can fail from IP exhaustion even if instances have CPU and RAM headroom; VPC CNI address capacity is distinct.

Scheduler CPU headroom does not create unused subnet addresses or raise ENI/prefix allocation limits for the VPC CNI.

A higher max-pods setting does not create VPC subnet IP addresses or increase EC2 instance ENI/address-slot quotas. The CNI still needs sufficient free addresses or prefixes in its configured subnets, so pod IP assignment remains blocked when that resource is exhausted.

Network transfer charges follow actual routed bytes and their AZ crossings, not the host CPU percentage by itself.

Enhanced networking may change performance but billing for inter-AZ transfer still reflects actual cross-AZ bytes in the unchanged topology.

Storage IOPS changes a disk bottleneck, not the amount of inter-AZ application traffic or its transfer charge.

Two tunnels alone do not prove routing failover; validate BGP/static route policy, health detection and recovery behavior.

A longer security association lifetime is not a route-health or route-selection rule for the preferred tunnel.

Tuning throughput cannot ensure failover; routing and liveness detection must select the alternate tunnel when the primary path disappears.

A producer function’s CPU or memory does not raise the write bytes-per-second or records-per-second capacity of a provisioned Kinesis shard.

Retention governs how long ingested records remain replayable, not the producer write limit.

Immediate retries amplify throttling and cannot rebalance hot hash-key traffic.

Enhanced fan-out consumers get their own throughput allocation; ordinary GetRecords consumers share the per-shard read throughput budget.

Longer retention widens replay time, but cannot allocate dedicated per-consumer read capacity when applications still share GetRecords shard throughput.

IAM identity isolation does not produce the dedicated per-consumer Kinesis read lane and HTTP/2 push behavior supplied by enhanced fan-out.