Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Configure the correct Transit Gateway route-table association and propagation addresses a separate condition: a spoke VPC cannot reach another because the Transit Gateway attachment lacks route propagation. TGW route tables govern interattachment forwarding. The actual requirement is two VPCs share the same CIDR and cannot use ordinary peering routes. Recommended corrective action: Prefer PrivateLink for supported service-specific access or renumber CIDRs. Overlapping CIDRs prevent straightforward peering route resolution.

For the alternative failure a service producer wants consumers to reach one private service without full VPC routing, the control Publish the service through a PrivateLink endpoint service and Network Load Balancer is relevant: privateLink exposes selected services rather than routing entire VPC CIDRs. Here the evidence instead is two VPCs share the same CIDR and cannot use ordinary peering routes. The selected technical mechanism is Prefer PrivateLink for supported service-specific access or renumber CIDRs: overlapping CIDRs prevent straightforward peering route resolution.

Establish VPC peering and reciprocal routes for nonoverlapping CIDRs solves a different operational problem where two VPCs need direct, nontransitive private peering. VPC peering offers point-to-point routing without transitivity. It does not directly address two VPCs share the same CIDR and cannot use ordinary peering routes. The case calls for Prefer PrivateLink for supported service-specific access or renumber CIDRs, since overlapping CIDRs prevent straightforward peering route resolution.

Provision AWS Direct Connect with suitable capacity and virtual interfaces would help if a trading application requires a dedicated consistent network connection from a data center. Direct Connect provides dedicated connectivity separate from public VPN routing. That is not the symptom described here: a branch office requires encrypted internet-based connectivity into a VPC. The matching response is Establish an AWS Site-to-Site VPN with appropriate customer gateway routing, because iPsec tunnels protect traffic over untrusted links.

Validate BGP configuration and allowed route propagation between customer and AWS gateways solves a different operational problem where a branch VPN tunnel is healthy but route advertisements are missing. Hybrid routing control plane must advertise reachable prefixes. It does not directly address a branch office requires encrypted internet-based connectivity into a VPC. The case calls for Establish an AWS Site-to-Site VPN with appropriate customer gateway routing, since iPsec tunnels protect traffic over untrusted links.

The competing option Layer IPsec VPN or application TLS over the dedicated connection would be useful when a private Direct Connect connection must also encrypt sensitive application traffic. A private circuit by itself does not guarantee encryption. The present issue is a branch office requires encrypted internet-based connectivity into a VPC; it is more directly addressed by Establish an AWS Site-to-Site VPN with appropriate customer gateway routing. IPsec tunnels protect traffic over untrusted links.

For the alternative failure a branch office requires encrypted internet-based connectivity into a VPC, the control Establish an AWS Site-to-Site VPN with appropriate customer gateway routing is relevant: iPsec tunnels protect traffic over untrusted links. Here the evidence instead is a trading application requires a dedicated consistent network connection from a data center. The selected technical mechanism is Provision AWS Direct Connect with suitable capacity and virtual interfaces: direct Connect provides dedicated connectivity separate from public VPN routing.

The competing option Layer IPsec VPN or application TLS over the dedicated connection would be useful when a private Direct Connect connection must also encrypt sensitive application traffic. A private circuit by itself does not guarantee encryption. The present issue is a trading application requires a dedicated consistent network connection from a data center; it is more directly addressed by Provision AWS Direct Connect with suitable capacity and virtual interfaces. Direct Connect provides dedicated connectivity separate from public VPN routing.

The option Validate BGP configuration and allowed route propagation between customer and AWS gateways addresses a separate condition: a branch VPN tunnel is healthy but route advertisements are missing. Hybrid routing control plane must advertise reachable prefixes. The actual requirement is a trading application requires a dedicated consistent network connection from a data center. Recommended corrective action: Provision AWS Direct Connect with suitable capacity and virtual interfaces. Direct Connect provides dedicated connectivity separate from public VPN routing.

The competing option Layer IPsec VPN or application TLS over the dedicated connection would be useful when a private Direct Connect connection must also encrypt sensitive application traffic. A private circuit by itself does not guarantee encryption. The present issue is direct Connect must remain available through circuit failures; it is more directly addressed by Add redundant Direct Connect connections at independent locations when required. Separate links reduce single-location physical dependencies.

The option Provision AWS Direct Connect with suitable capacity and virtual interfaces addresses a separate condition: a trading application requires a dedicated consistent network connection from a data center. Direct Connect provides dedicated connectivity separate from public VPN routing. The actual requirement is direct Connect must remain available through circuit failures. Recommended corrective action: Add redundant Direct Connect connections at independent locations when required. Separate links reduce single-location physical dependencies.

Validate BGP configuration and allowed route propagation between customer and AWS gateways would help if a branch VPN tunnel is healthy but route advertisements are missing. Hybrid routing control plane must advertise reachable prefixes. That is not the symptom described here: direct Connect must remain available through circuit failures. The matching response is Add redundant Direct Connect connections at independent locations when required, because separate links reduce single-location physical dependencies.

The competing option Layer IPsec VPN or application TLS over the dedicated connection would be useful when a private Direct Connect connection must also encrypt sensitive application traffic. A private circuit by itself does not guarantee encryption. The present issue is a branch VPN tunnel is healthy but route advertisements are missing; it is more directly addressed by Validate BGP configuration and allowed route propagation between customer and AWS gateways. Hybrid routing control plane must advertise reachable prefixes.

Establish an AWS Site-to-Site VPN with appropriate customer gateway routing would help if a branch office requires encrypted internet-based connectivity into a VPC. IPsec tunnels protect traffic over untrusted links. That is not the symptom described here: a branch VPN tunnel is healthy but route advertisements are missing. The matching response is Validate BGP configuration and allowed route propagation between customer and AWS gateways, because hybrid routing control plane must advertise reachable prefixes.

For the alternative failure a trading application requires a dedicated consistent network connection from a data center, the control Provision AWS Direct Connect with suitable capacity and virtual interfaces is relevant: direct Connect provides dedicated connectivity separate from public VPN routing. Here the evidence instead is a branch VPN tunnel is healthy but route advertisements are missing. The selected technical mechanism is Validate BGP configuration and allowed route propagation between customer and AWS gateways: hybrid routing control plane must advertise reachable prefixes.

The option Add redundant Direct Connect connections at independent locations when required addresses a separate condition: direct Connect must remain available through circuit failures. Separate links reduce single-location physical dependencies. The actual requirement is a private Direct Connect connection must also encrypt sensitive application traffic. Recommended corrective action: Layer IPsec VPN or application TLS over the dedicated connection. A private circuit by itself does not guarantee encryption.

Validate BGP configuration and allowed route propagation between customer and AWS gateways would help if a branch VPN tunnel is healthy but route advertisements are missing. Hybrid routing control plane must advertise reachable prefixes. That is not the symptom described here: a private Direct Connect connection must also encrypt sensitive application traffic. The matching response is Layer IPsec VPN or application TLS over the dedicated connection, because a private circuit by itself does not guarantee encryption.

For the alternative failure a trading application requires a dedicated consistent network connection from a data center, the control Provision AWS Direct Connect with suitable capacity and virtual interfaces is relevant: direct Connect provides dedicated connectivity separate from public VPN routing. Here the evidence instead is a private Direct Connect connection must also encrypt sensitive application traffic. The selected technical mechanism is Layer IPsec VPN or application TLS over the dedicated connection: a private circuit by itself does not guarantee encryption.

Attach the correct ACM certificate and verify SNI hostname mapping would help if an ALB listener uses a certificate for the wrong hostname. TLS hostname validation compares requested hostname with certificate names. That is not the symptom described here: users need HTTPS certificates without exporting private keys onto web instances. The matching response is Terminate supported TLS at an ALB using AWS Certificate Manager, because aCM-managed certificates enable managed TLS termination.

For the alternative failure a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy, the control Configure a dedicated health path returning allowed success codes is relevant: target health checks need a reachable healthy response. Here the evidence instead is users need HTTPS certificates without exporting private keys onto web instances. The selected technical mechanism is Terminate supported TLS at an ALB using AWS Certificate Manager: aCM-managed certificates enable managed TLS termination.

Deploy an internal-facing load balancer and restrict its security groups solves a different operational problem where a private internal application is accidentally exposed through an internet-facing ALB. Internal ALBs use private addressing instead of public ingress. It does not directly address users need HTTPS certificates without exporting private keys onto web instances. The case calls for Terminate supported TLS at an ALB using AWS Certificate Manager, since aCM-managed certificates enable managed TLS termination.

For the alternative failure a private internal application is accidentally exposed through an internet-facing ALB, the control Deploy an internal-facing load balancer and restrict its security groups is relevant: internal ALBs use private addressing instead of public ingress. Here the evidence instead is an ALB listener uses a certificate for the wrong hostname. The selected technical mechanism is Attach the correct ACM certificate and verify SNI hostname mapping: TLS hostname validation compares requested hostname with certificate names.

Configure an ALB port-80 listener redirect to HTTPS solves a different operational problem where a web application must redirect all HTTP requests to HTTPS. Listener actions can enforce HTTPS canonical entry. It does not directly address an ALB listener uses a certificate for the wrong hostname. The case calls for Attach the correct ACM certificate and verify SNI hostname mapping, since TLS hostname validation compares requested hostname with certificate names.

The option Configure a dedicated health path returning allowed success codes addresses a separate condition: a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy. Target health checks need a reachable healthy response. The actual requirement is an ALB listener uses a certificate for the wrong hostname. Recommended corrective action: Attach the correct ACM certificate and verify SNI hostname mapping. TLS hostname validation compares requested hostname with certificate names.

The competing option Terminate supported TLS at an ALB using AWS Certificate Manager would be useful when users need HTTPS certificates without exporting private keys onto web instances. ACM-managed certificates enable managed TLS termination. The present issue is a web application must redirect all HTTP requests to HTTPS; it is more directly addressed by Configure an ALB port-80 listener redirect to HTTPS. Listener actions can enforce HTTPS canonical entry.

The option Attach the correct ACM certificate and verify SNI hostname mapping addresses a separate condition: an ALB listener uses a certificate for the wrong hostname. TLS hostname validation compares requested hostname with certificate names. The actual requirement is a web application must redirect all HTTP requests to HTTPS. Recommended corrective action: Configure an ALB port-80 listener redirect to HTTPS. Listener actions can enforce HTTPS canonical entry.

Configure a dedicated health path returning allowed success codes would help if a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy. Target health checks need a reachable healthy response. That is not the symptom described here: a web application must redirect all HTTP requests to HTTPS. The matching response is Configure an ALB port-80 listener redirect to HTTPS, because listener actions can enforce HTTPS canonical entry.

The competing option Deploy an internal-facing load balancer and restrict its security groups would be useful when a private internal application is accidentally exposed through an internet-facing ALB. Internal ALBs use private addressing instead of public ingress. The present issue is a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy; it is more directly addressed by Configure a dedicated health path returning allowed success codes. Target health checks need a reachable healthy response.

The option Configure an ALB port-80 listener redirect to HTTPS addresses a separate condition: a web application must redirect all HTTP requests to HTTPS. Listener actions can enforce HTTPS canonical entry. The actual requirement is a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy. Recommended corrective action: Configure a dedicated health path returning allowed success codes. Target health checks need a reachable healthy response.

For the alternative failure users need HTTPS certificates without exporting private keys onto web instances, the control Terminate supported TLS at an ALB using AWS Certificate Manager is relevant: aCM-managed certificates enable managed TLS termination. Here the evidence instead is a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy. The selected technical mechanism is Configure a dedicated health path returning allowed success codes: target health checks need a reachable healthy response.

Terminate supported TLS at an ALB using AWS Certificate Manager would help if users need HTTPS certificates without exporting private keys onto web instances. ACM-managed certificates enable managed TLS termination. That is not the symptom described here: a private internal application is accidentally exposed through an internet-facing ALB. The matching response is Deploy an internal-facing load balancer and restrict its security groups, because internal ALBs use private addressing instead of public ingress.

For the alternative failure a web application must redirect all HTTP requests to HTTPS, the control Configure an ALB port-80 listener redirect to HTTPS is relevant: listener actions can enforce HTTPS canonical entry. Here the evidence instead is a private internal application is accidentally exposed through an internet-facing ALB. The selected technical mechanism is Deploy an internal-facing load balancer and restrict its security groups: internal ALBs use private addressing instead of public ingress.

Configure a dedicated health path returning allowed success codes solves a different operational problem where a health endpoint returns 403 for unauthenticated probes and marks every target unhealthy. Target health checks need a reachable healthy response. It does not directly address a private internal application is accidentally exposed through an internet-facing ALB. The case calls for Deploy an internal-facing load balancer and restrict its security groups, since internal ALBs use private addressing instead of public ingress.