Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Use AWS Transit Gateway with route-table association/propagation would help if a dozen VPCs require centralized transitive routing. Transit Gateway supports hub-and-spoke routing. That is not the symptom described here: a service consumer requires an interface endpoint in each application AZ. The matching response is Create interface endpoint subnets across the relevant AZs and validate security groups, because endpoint placement affects network latency and AZ availability.

For the alternative failure only two nonoverlapping VPCs need private point-to-point connectivity, the control Use VPC peering with reciprocal route entries is relevant: peering connects two VPC networks without a transit gateway. Here the evidence instead is a service consumer requires an interface endpoint in each application AZ. The selected technical mechanism is Create interface endpoint subnets across the relevant AZs and validate security groups: endpoint placement affects network latency and AZ availability.

Add a DynamoDB gateway VPC endpoint in relevant route tables solves a different operational problem where a private EC2 fleet must call DynamoDB without NAT. Gateway endpoint routes avoid public egress for DynamoDB. It does not directly address a service consumer requires an interface endpoint in each application AZ. The case calls for Create interface endpoint subnets across the relevant AZs and validate security groups, since endpoint placement affects network latency and AZ availability.

Use Route 53 Resolver inbound endpoints and forwarding rules would help if on-prem DNS cannot resolve private hosted-zone names in AWS. Hybrid DNS resolves private VPC records through resolver integration. That is not the symptom described here: a data center requires a dedicated high-throughput private path to AWS. The matching response is Deploy Direct Connect connections with appropriate virtual interfaces, because direct Connect provides managed dedicated connectivity.

For the alternative failure a Direct Connect circuit must fail over if the provider loses power, the control Add a redundant independent Direct Connect or VPN backup path is relevant: hybrid resilience needs alternate paths. Here the evidence instead is a data center requires a dedicated high-throughput private path to AWS. The selected technical mechanism is Deploy Direct Connect connections with appropriate virtual interfaces: direct Connect provides managed dedicated connectivity.

The competing option Use Transit Gateway with appropriate VPN attachments and TGW routes would be useful when a business has 50 branch connections and needs central routing management. Transit Gateway centralizes many hybrid attachments. The present issue is a data center requires a dedicated high-throughput private path to AWS; it is more directly addressed by Deploy Direct Connect connections with appropriate virtual interfaces. Direct Connect provides managed dedicated connectivity.

For the alternative failure a data center requires a dedicated high-throughput private path to AWS, the control Deploy Direct Connect connections with appropriate virtual interfaces is relevant: direct Connect provides managed dedicated connectivity. Here the evidence instead is a branch requires encrypted connectivity over the public internet. The selected technical mechanism is Use an AWS Site-to-Site VPN tunnel: iPsec VPN secures communication over public routes.

The competing option Use Route 53 Resolver inbound endpoints and forwarding rules would be useful when on-prem DNS cannot resolve private hosted-zone names in AWS. Hybrid DNS resolves private VPC records through resolver integration. The present issue is a branch requires encrypted connectivity over the public internet; it is more directly addressed by Use an AWS Site-to-Site VPN tunnel. IPsec VPN secures communication over public routes.

The option Use Transit Gateway with appropriate VPN attachments and TGW routes addresses a separate condition: a business has 50 branch connections and needs central routing management. Transit Gateway centralizes many hybrid attachments. The actual requirement is a branch requires encrypted connectivity over the public internet. Recommended corrective action: Use an AWS Site-to-Site VPN tunnel. IPsec VPN secures communication over public routes.

Use Transit Gateway with appropriate VPN attachments and TGW routes solves a different operational problem where a business has 50 branch connections and needs central routing management. Transit Gateway centralizes many hybrid attachments. It does not directly address a Direct Connect circuit must fail over if the provider loses power. The case calls for Add a redundant independent Direct Connect or VPN backup path, since hybrid resilience needs alternate paths.

The option Deploy Direct Connect connections with appropriate virtual interfaces addresses a separate condition: a data center requires a dedicated high-throughput private path to AWS. Direct Connect provides managed dedicated connectivity. The actual requirement is a Direct Connect circuit must fail over if the provider loses power. Recommended corrective action: Add a redundant independent Direct Connect or VPN backup path. Hybrid resilience needs alternate paths.

Use an AWS Site-to-Site VPN tunnel would help if a branch requires encrypted connectivity over the public internet. IPsec VPN secures communication over public routes. That is not the symptom described here: a Direct Connect circuit must fail over if the provider loses power. The matching response is Add a redundant independent Direct Connect or VPN backup path, because hybrid resilience needs alternate paths.

The option Deploy Direct Connect connections with appropriate virtual interfaces addresses a separate condition: a data center requires a dedicated high-throughput private path to AWS. Direct Connect provides managed dedicated connectivity. The actual requirement is a business has 50 branch connections and needs central routing management. Recommended corrective action: Use Transit Gateway with appropriate VPN attachments and TGW routes. Transit Gateway centralizes many hybrid attachments.

Add a redundant independent Direct Connect or VPN backup path would help if a Direct Connect circuit must fail over if the provider loses power. Hybrid resilience needs alternate paths. That is not the symptom described here: a business has 50 branch connections and needs central routing management. The matching response is Use Transit Gateway with appropriate VPN attachments and TGW routes, because transit Gateway centralizes many hybrid attachments.

For the alternative failure a branch requires encrypted connectivity over the public internet, the control Use an AWS Site-to-Site VPN tunnel is relevant: iPsec VPN secures communication over public routes. Here the evidence instead is a business has 50 branch connections and needs central routing management. The selected technical mechanism is Use Transit Gateway with appropriate VPN attachments and TGW routes: transit Gateway centralizes many hybrid attachments.

The option Use an AWS Site-to-Site VPN tunnel addresses a separate condition: a branch requires encrypted connectivity over the public internet. IPsec VPN secures communication over public routes. The actual requirement is on-prem DNS cannot resolve private hosted-zone names in AWS. Recommended corrective action: Use Route 53 Resolver inbound endpoints and forwarding rules. Hybrid DNS resolves private VPC records through resolver integration.

Deploy Direct Connect connections with appropriate virtual interfaces would help if a data center requires a dedicated high-throughput private path to AWS. Direct Connect provides managed dedicated connectivity. That is not the symptom described here: on-prem DNS cannot resolve private hosted-zone names in AWS. The matching response is Use Route 53 Resolver inbound endpoints and forwarding rules, because hybrid DNS resolves private VPC records through resolver integration.

Add a redundant independent Direct Connect or VPN backup path solves a different operational problem where a Direct Connect circuit must fail over if the provider loses power. Hybrid resilience needs alternate paths. It does not directly address on-prem DNS cannot resolve private hosted-zone names in AWS. The case calls for Use Route 53 Resolver inbound endpoints and forwarding rules, since hybrid DNS resolves private VPC records through resolver integration.

Expose HTTP-aware targets through ALB rather than NLB routing rules would help if API workloads require path-based routing but target groups are TCP-only. NLB cannot route by HTTP path. That is not the symptom described here: the backend receives HTTP requests requiring host-header routing. The matching response is Use ALB host-based listener rules, because hTTP layer rules match hostnames.

For the alternative failure a connection-sensitive service needs load balancing over TLS without terminating application TLS, the control Use NLB TCP listener for TLS pass-through where suitable is relevant: tCP pass-through leaves application TLS at targets. Here the evidence instead is the backend receives HTTP requests requiring host-header routing. The selected technical mechanism is Use ALB host-based listener rules: hTTP layer rules match hostnames.

Use NLB static addresses or suitable Global Accelerator entry solves a different operational problem where clients need fixed IP ingress for TLS/TCP connectivity. Layer-4 endpoints provide predictable addresses. It does not directly address the backend receives HTTP requests requiring host-header routing. The case calls for Use ALB host-based listener rules, since hTTP layer rules match hostnames.

Use ALB host-based listener rules solves a different operational problem where the backend receives HTTP requests requiring host-header routing. HTTP layer rules match hostnames. It does not directly address clients need fixed IP ingress for TLS/TCP connectivity. The case calls for Use NLB static addresses or suitable Global Accelerator entry, since layer-4 endpoints provide predictable addresses.

The competing option Use NLB TCP listener for TLS pass-through where suitable would be useful when a connection-sensitive service needs load balancing over TLS without terminating application TLS. TCP pass-through leaves application TLS at targets. The present issue is clients need fixed IP ingress for TLS/TCP connectivity; it is more directly addressed by Use NLB static addresses or suitable Global Accelerator entry. Layer-4 endpoints provide predictable addresses.

The option Expose HTTP-aware targets through ALB rather than NLB routing rules addresses a separate condition: API workloads require path-based routing but target groups are TCP-only. NLB cannot route by HTTP path. The actual requirement is clients need fixed IP ingress for TLS/TCP connectivity. Recommended corrective action: Use NLB static addresses or suitable Global Accelerator entry. Layer-4 endpoints provide predictable addresses.

The competing option Expose HTTP-aware targets through ALB rather than NLB routing rules would be useful when API workloads require path-based routing but target groups are TCP-only. NLB cannot route by HTTP path. The present issue is network security appliances must intercept all east-west traffic; it is more directly addressed by Use Gateway Load Balancer with appliance endpoints and symmetric routing. GWLB provides transparent inline inspection.

The option Use NLB TCP listener for TLS pass-through where suitable addresses a separate condition: a connection-sensitive service needs load balancing over TLS without terminating application TLS. TCP pass-through leaves application TLS at targets. The actual requirement is network security appliances must intercept all east-west traffic. Recommended corrective action: Use Gateway Load Balancer with appliance endpoints and symmetric routing. GWLB provides transparent inline inspection.

Use ALB host-based listener rules would help if the backend receives HTTP requests requiring host-header routing. HTTP layer rules match hostnames. That is not the symptom described here: network security appliances must intercept all east-west traffic. The matching response is Use Gateway Load Balancer with appliance endpoints and symmetric routing, because gWLB provides transparent inline inspection.

The competing option Use Gateway Load Balancer with appliance endpoints and symmetric routing would be useful when network security appliances must intercept all east-west traffic. GWLB provides transparent inline inspection. The present issue is API workloads require path-based routing but target groups are TCP-only; it is more directly addressed by Expose HTTP-aware targets through ALB rather than NLB routing rules. NLB cannot route by HTTP path.

The option Use NLB TCP listener for TLS pass-through where suitable addresses a separate condition: a connection-sensitive service needs load balancing over TLS without terminating application TLS. TCP pass-through leaves application TLS at targets. The actual requirement is API workloads require path-based routing but target groups are TCP-only. Recommended corrective action: Expose HTTP-aware targets through ALB rather than NLB routing rules. NLB cannot route by HTTP path.

Use ALB host-based listener rules would help if the backend receives HTTP requests requiring host-header routing. HTTP layer rules match hostnames. That is not the symptom described here: API workloads require path-based routing but target groups are TCP-only. The matching response is Expose HTTP-aware targets through ALB rather than NLB routing rules, because nLB cannot route by HTTP path.

Use ALB host-based listener rules would help if the backend receives HTTP requests requiring host-header routing. HTTP layer rules match hostnames. That is not the symptom described here: a connection-sensitive service needs load balancing over TLS without terminating application TLS. The matching response is Use NLB TCP listener for TLS pass-through where suitable, because tCP pass-through leaves application TLS at targets.

For the alternative failure clients need fixed IP ingress for TLS/TCP connectivity, the control Use NLB static addresses or suitable Global Accelerator entry is relevant: layer-4 endpoints provide predictable addresses. Here the evidence instead is a connection-sensitive service needs load balancing over TLS without terminating application TLS. The selected technical mechanism is Use NLB TCP listener for TLS pass-through where suitable: tCP pass-through leaves application TLS at targets.

Expose HTTP-aware targets through ALB rather than NLB routing rules solves a different operational problem where API workloads require path-based routing but target groups are TCP-only. NLB cannot route by HTTP path. It does not directly address a connection-sensitive service needs load balancing over TLS without terminating application TLS. The case calls for Use NLB TCP listener for TLS pass-through where suitable, since tCP pass-through leaves application TLS at targets.