Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 1

Question 1

A regulated company has 36 VPCs in a single AWS Region and one data center connected through AWS Direct Connect. Its architects need centrally managed, transitive connectivity among selected VPCs and the data center, with segmentation controlled through route tables. Which design best meets those requirements without building a full mesh?

Attach the VPCs to AWS Transit Gateway, connect the on-premises network through a Direct Connect gateway association, and control reachability using transit gateway routing.
Attach the VPCs in a full peering mesh, then advertise the data-center routes from one peered VPC to all its peers as transit routes.
Use a Transit Gateway for all VPCs but connect the Direct Connect private virtual interface only to an unrelated virtual private gateway, assuming the VPC attachment provides a route between them.
Create only AWS PrivateLink endpoint services for selected applications and assume this also supplies generic transitive routing for every VPC CIDR and the data-center network.

Explanation

Correct Answer

Transit Gateway provides a regional hub with transitive VPC routing; its route-table associations and propagations can implement controlled segmentation, while the Direct Connect gateway path supports hybrid access.

Incorrect Answers

VPC peering is nontransitive; a VPC cannot route another peered VPC through itself as a transit hub, and full-mesh peering is not the centrally segmented solution.

A private VIF to an unrelated VGW does not provide the required DX-gateway-to-TGW attachment path for all the selected VPCs; configure a transit VIF and appropriate DX gateway association.

PrivateLink can offer private service-specific access, but not the general transitive, segmented VPC-to-VPC and hybrid IP routing required of Transit Gateway.

Question 2

A hybrid network uses a transit VIF, a Direct Connect gateway, and an associated Transit Gateway. VPC subnet routes are correct, but on-premises routers learn no advertised AWS prefixes. The association was created with an empty allowed-prefix list. Which change directly restores the intended BGP advertisements?

Enable VPC route propagation in each Transit Gateway route table while leaving the Direct Connect gateway allowed-prefix list empty.
Populate the Direct Connect gateway association with the intended permitted aggregate prefixes and verify the transit VIF BGP routes.
Change the allowed prefixes on an unrelated virtual-private-gateway association, leaving the actual Transit Gateway association empty.
Increase the number of BGP sessions on the transit VIF without setting permitted prefixes in the Direct Connect gateway association.

Explanation

Correct Answer

With a Transit Gateway association, the Direct Connect gateway advertises the configured allowed prefixes to on-premises over BGP; an empty list produces no such routes.

Incorrect Answers

Transit Gateway route propagation among attachments is distinct from the DX gateway allowed-prefix list that determines what it advertises toward on-premises BGP.

The prefixes must be set for the association used by the transit VIF and the Transit Gateway; another VGW association does not advertise the missing routes on this path.

Additional BGP peers cannot advertise CIDRs that remain absent from the association allowed-prefix list.

Question 3

A company runs third-party stateful firewall appliances behind a Gateway Load Balancer in a centralized inspection VPC. Its Transit Gateway inspection VPC attachment already has appliance mode enabled and the forward and return VPC routes are symmetric. A proposal would change the Gateway Load Balancer target group from its default 5-tuple flow stickiness to 2-tuple or 3-tuple because the team expects the same TGW appliance-mode support. Which setting should the architect enforce to keep this combination supported?

Keep the Gateway Load Balancer target group on 5-tuple flow stickiness while Transit Gateway appliance mode is enabled.
Change to 2-tuple source/destination IP stickiness because it is the required compatibility mode for Transit Gateway appliance mode.
Change to 3-tuple source/destination IP and protocol stickiness because it supports Transit Gateway appliance mode better than 5-tuple.
Turn off Gateway Load Balancer flow affinity entirely and assume the upstream Transit Gateway will maintain firewall-appliance instance state across arbitrary targets.

Explanation

Correct Answer

AWS states Gateway Load Balancer 2-tuple and 3-tuple flow stickiness types are unsupported with Transit Gateway appliance mode. Keep the target groups default supported 5-tuple hashing for per-flow appliance affinity.

Incorrect Answers

2-tuple stickiness is not supported in conjunction with Transit Gateway appliance mode; changing to it violates the documented compatibility requirement.

3-tuple stickiness is likewise not supported when Transit Gateway appliance mode is enabled, despite its transport-protocol field.

The Transit Gateway may preserve AZ flow affinity but cannot make independent stateful target appliances share individual connection state; supported GWLB 5-tuple affinity remains necessary.

Question 4

A private data center needs to resolve internal hostnames that exist only in a private Route 53 hosted zone associated with an AWS application VPC. The data center DNS servers already have connectivity to the VPC. Which DNS architecture should receive forwarded queries from on-premises?

Create a Route 53 Resolver outbound endpoint, then point on-premises conditional forwarders at that outbound endpoint IP.
Associate the private hosted zone with the networking VPC and point on-premises DNS at the AWS VPC-provided Resolver base address without creating an inbound endpoint.
Associate the private hosted zone with more VPCs but do not configure any reachable inbound Resolver endpoint for the on-premises DNS servers.
Deploy Route 53 Resolver inbound endpoints in the VPC and configure on-premises conditional forwarders for the private domain to their IP addresses.

Explanation

Correct Answer

Inbound Resolver endpoint addresses provide a DNS target for on-premises resolvers to query VPC-associated private hosted-zone records across hybrid connectivity.

Incorrect Answers

Outbound endpoints send AWS-originating queries toward external resolvers; on-premises resolvers need reachable inbound endpoint IPs to access the VPC private zone.

The VPC Resolver base address is not a direct inbound hybrid forwarding endpoint reachable from on premises; a Route 53 inbound endpoint is required.

Private hosted-zone associations govern VPC resolver scope; they do not create the inbound DNS listener and forwarding path for a separate on-premises network.

Question 5

A workload VPC and a supplier VPC use overlapping IPv4 ranges. The supplier must expose only a private HTTPS product lookup API; no general network reachability is required. What is the simplest AWS connectivity design that avoids address-space renumbering?

Associate both overlapping CIDR VPCs with the same Transit Gateway route table and advertise the equal prefixes as though they were uniquely routable.
Add a VPC peering connection and publish only the partner API DNS record, assuming DNS solves the overlapping-CIDR peering restriction.
Publish the API behind an endpoint service and consume it through an interface VPC endpoint using AWS PrivateLink.
Create an overlapping-CIDR VPC peering connection and expose only the API hostname, expecting DNS specificity to permit the overlapping networks.

Explanation

Correct Answer

PrivateLink connects to a specific service through endpoint ENIs without requiring transitive IP routing or nonoverlapping VPC CIDR space.

Incorrect Answers

Overlapping destination CIDRs are ambiguous for ordinary transitive IP routing; PrivateLink avoids the need to route the suppliers overlapping network address space.

A DNS alias does not remove the CIDR overlap that prevents ordinary VPC peering. A service-specific endpoint avoids full VPC peering.

VPC peering requires nonoverlapping VPC CIDRs; using a narrower DNS name does not change the peer acceptance restriction.

Question 6

An enterprise has Transit Gateways in two Regions with an active inter-Region peering attachment. Each workload subnet has a route to its local gateway, but VPC-to-VPC cross-Region traffic still fails. The team assumed peering attachment routes propagate automatically. Which routing change is required?

Enable VPC attachment route propagation on both transit gateways and assume remote routes will automatically cross the peering attachment.
Create explicit static routes for the remote VPC CIDRs pointing to the peering attachment in the appropriate transit gateway route tables on both sides.
Add routes for remote CIDRs only on the originating TGW but omit the return routes from the remote TGW route tables.
Create static peer routes at both TGWs but point them at each Regions local VPC attachment rather than the actual TGW peering attachment.

Explanation

Correct Answer

Transit Gateway peering does not automatically propagate routes across the peering attachment; both gateways need correct static routing to the peer.

Incorrect Answers

TGW peering does not automatically exchange routes across the peer: each transit gateway requires the appropriate static peer CIDR routes.

Bidirectional cross-Region reachability requires correct static peer routes in the relevant tables at both ends, not just a forward path.

The routes must target the peering attachment to reach the remote TGW; local VPC attachments cannot substitute for a peer destination.

Question 7

A bank uses one Direct Connect connection at a single facility for production traffic. A facility outage recently cut off its data center from all application VPCs. The recovery requirement is physically independent private connectivity, not merely a second virtual interface on the same circuit. What should the architect deploy?

Create two private virtual interfaces over the same physical Direct Connect circuit and call the path facility resilient.
Configure additional BGP peers only on the same customer router attached to the failed facility.
Add a Site-to-Site VPN that terminates on the same physical router and facility as the sole Direct Connect circuit, then assume the site outage is covered.
Add a second Direct Connect connection at a separate Direct Connect location, with redundant customer devices and tested routing failover.

Explanation

Correct Answer

Separate locations and circuits eliminate the documented facility single point of failure; independent customer equipment and failover testing are also required.

Incorrect Answers

Additional virtual interfaces share the same physical connection and location, so a site or circuit failure takes out both.

Multiple BGP sessions over one site do not create an independent physical path when the router or location is unavailable.

The VPN backup still depends on the same customer router and failed physical site, so it does not deliver facility-independent connectivity.

Question 8

A company has a primary Direct Connect path and a Site-to-Site VPN backup to its transit architecture. During a simulated circuit failure, traffic remains pinned to a degraded path because on-premises BGP selection was not reviewed. What should the network architect validate?

Adjust only AWS-to-on-premises route preference on the primary Direct Connect circuit while leaving customer route selection and failover behavior untested.
Disable VPN BGP so both paths remain physically attached but the backup cannot announce prefixes.
Increase the BGP hold timer on the backup VPN but leave primary and backup prefix priorities and return routes unspecified.
Configure and test BGP route preference and withdrawal across the Direct Connect and VPN paths, with return-path routing examined.

Explanation

Correct Answer

BGP attributes, advertised routes and failover convergence determine which hybrid path carries traffic, so both directions must be tested.

Incorrect Answers

AWS return-path preference does not establish how customer routers choose the surviving VPN route after the primary Direct Connect withdrawal.

Suppressing the backup route prevents automatic alternative-path selection when the primary connection fails.

Longer timers do not verify correct BGP route withdrawal, path preference and end-to-end convergence after circuit failure.

Question 9

A latency-sensitive hybrid application uses Site-to-Site VPN from a distant branch to an AWS Region. Routing over the public internet has unpredictable delay before reaching the AWS global network, and Direct Connect is not justified. Which AWS VPN feature should be evaluated?

Deploy an additional ordinary Site-to-Site VPN tunnel over the same long public-internet path, without enabling the accelerated-VPN feature.
Use Direct Connect from the branch even though the design explicitly excludes a justified dedicated private circuit.
Use an accelerated Site-to-Site VPN attachment that leverages AWS Global Accelerator when the architecture supports that mode.
Switch the customer gateway to static VPN routes while keeping the same public-internet transit path and expect lower network congestion.

Explanation

Correct Answer

Accelerated VPN can move suitable traffic onto the AWS global network nearer the branch and reduce variability associated with the public route.

Incorrect Answers

An extra standard VPN path may help availability but does not specifically move traffic onto an earlier AWS global-network ingress for latency stability.

Direct Connect can offer dedicated connectivity but conflicts with the stated constraint that a private circuit is not economically justified.

Static routing does not move packets onto AWS edge ingress sooner or solve internet-path variability.

Question 10

A new IPv6-only outbound worker tier must call external IPv6 HTTPS services but must never accept unsolicited inbound connections from the internet. The VPC has IPv6 addressing, and the route table currently points at a normal internet gateway. Which routing component best enforces outbound-only initiation?

Use an ordinary internet gateway alone and assume IPv6 addresses cannot accept connections initiated externally.
Route ::/0 through a NAT gateway and rely on IPv4-only NAT translation for arbitrary native IPv6 egress.
Retain the standard internet gateway and change only instance security-group ingress rules, leaving the IPv6 default route bidirectional through that gateway.
Route the outbound IPv6 default path through an egress-only internet gateway and keep inbound security controls restrictive.

Explanation

Correct Answer

An egress-only internet gateway allows instances to initiate IPv6 connections while blocking unsolicited incoming IPv6 connections.

Incorrect Answers

An internet gateway supports bidirectional IPv6 routing and does not intrinsically enforce outbound-only connection initiation.

NAT gateways are not a generic substitute for the egress-only IPv6 internet gateway in the stated native-IPv6 design.

Security groups can limit traffic, but the required outbound-only IPv6 routing component is an egress-only internet gateway rather than an ordinary IGW.