Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Use ALB host-based listener rules would help if the backend receives HTTP requests requiring host-header routing. HTTP layer rules match hostnames. That is not the symptom described here: a connection-sensitive service needs load balancing over TLS without terminating application TLS. The matching response is Use NLB TCP listener for TLS pass-through where suitable, because tCP pass-through leaves application TLS at targets.

For the alternative failure clients need fixed IP ingress for TLS/TCP connectivity, the control Use NLB static addresses or suitable Global Accelerator entry is relevant: layer-4 endpoints provide predictable addresses. Here the evidence instead is a connection-sensitive service needs load balancing over TLS without terminating application TLS. The selected technical mechanism is Use NLB TCP listener for TLS pass-through where suitable: tCP pass-through leaves application TLS at targets.

Expose HTTP-aware targets through ALB rather than NLB routing rules solves a different operational problem where API workloads require path-based routing but target groups are TCP-only. NLB cannot route by HTTP path. It does not directly address a connection-sensitive service needs load balancing over TLS without terminating application TLS. The case calls for Use NLB TCP listener for TLS pass-through where suitable, since tCP pass-through leaves application TLS at targets.

Use S3 gateway endpoints for supported same-region S3 access would help if private workload calls to S3 generate large NAT data processing charges. Gateway routes bypass NAT data-processing charges. That is not the symptom described here: private EC2 hosts need outbound IPv4 connections without public IPs. The matching response is Add per-AZ public NAT gateways and private-subnet default routes, because nAT gateways provide outbound-only initiated IPv4 internet access.

For the alternative failure nAT gateway traffic frequently crosses AZ boundaries from private workloads, the control Use AZ-local routing and NAT placement where reliability/cost warrants is relevant: local AZ egress avoids extra inter-AZ paths. Here the evidence instead is private EC2 hosts need outbound IPv4 connections without public IPs. The selected technical mechanism is Add per-AZ public NAT gateways and private-subnet default routes: nAT gateways provide outbound-only initiated IPv4 internet access.

Add an IPv6 ::/0 route to the egress-only internet gateway for the private subnet solves a different operational problem where iPv6 hosts are configured with egress-only internet gateway but their subnet has no IPv6 default route. IPv6 egress depends on a matching route through the outbound-only gateway. It does not directly address private EC2 hosts need outbound IPv4 connections without public IPs. The case calls for Add per-AZ public NAT gateways and private-subnet default routes, since nAT gateways provide outbound-only initiated IPv4 internet access.

For the alternative failure an internet-facing ALB is placed in subnets without appropriate internet-gateway routes, the control Place ALB in public subnets with internet connectivity and security groups is relevant: public load balancers need valid internet-facing subnet routing. Here the evidence instead is iPv6 hosts are configured with egress-only internet gateway but their subnet has no IPv6 default route. The selected technical mechanism is Add an IPv6 ::/0 route to the egress-only internet gateway for the private subnet: iPv6 egress depends on a matching route through the outbound-only gateway.

The competing option Add per-AZ public NAT gateways and private-subnet default routes would be useful when private EC2 hosts need outbound IPv4 connections without public IPs. NAT gateways provide outbound-only initiated IPv4 internet access. The present issue is iPv6 hosts are configured with egress-only internet gateway but their subnet has no IPv6 default route; it is more directly addressed by Add an IPv6 ::/0 route to the egress-only internet gateway for the private subnet. IPv6 egress depends on a matching route through the outbound-only gateway.

The option Use S3 gateway endpoints for supported same-region S3 access addresses a separate condition: private workload calls to S3 generate large NAT data processing charges. Gateway routes bypass NAT data-processing charges. The actual requirement is iPv6 hosts are configured with egress-only internet gateway but their subnet has no IPv6 default route. Recommended corrective action: Add an IPv6 ::/0 route to the egress-only internet gateway for the private subnet. IPv6 egress depends on a matching route through the outbound-only gateway.

The competing option Add an IPv6 ::/0 route to the egress-only internet gateway for the private subnet would be useful when iPv6 hosts are configured with egress-only internet gateway but their subnet has no IPv6 default route. IPv6 egress depends on a matching route through the outbound-only gateway. The present issue is private workload calls to S3 generate large NAT data processing charges; it is more directly addressed by Use S3 gateway endpoints for supported same-region S3 access. Gateway routes bypass NAT data-processing charges.

The option Place ALB in public subnets with internet connectivity and security groups addresses a separate condition: an internet-facing ALB is placed in subnets without appropriate internet-gateway routes. Public load balancers need valid internet-facing subnet routing. The actual requirement is private workload calls to S3 generate large NAT data processing charges. Recommended corrective action: Use S3 gateway endpoints for supported same-region S3 access. Gateway routes bypass NAT data-processing charges.

Use AZ-local routing and NAT placement where reliability/cost warrants would help if nAT gateway traffic frequently crosses AZ boundaries from private workloads. Local AZ egress avoids extra inter-AZ paths. That is not the symptom described here: private workload calls to S3 generate large NAT data processing charges. The matching response is Use S3 gateway endpoints for supported same-region S3 access, because gateway routes bypass NAT data-processing charges.

The competing option Add an IPv6 ::/0 route to the egress-only internet gateway for the private subnet would be useful when iPv6 hosts are configured with egress-only internet gateway but their subnet has no IPv6 default route. IPv6 egress depends on a matching route through the outbound-only gateway. The present issue is an internet-facing ALB is placed in subnets without appropriate internet-gateway routes; it is more directly addressed by Place ALB in public subnets with internet connectivity and security groups. Public load balancers need valid internet-facing subnet routing.

The option Use AZ-local routing and NAT placement where reliability/cost warrants addresses a separate condition: nAT gateway traffic frequently crosses AZ boundaries from private workloads. Local AZ egress avoids extra inter-AZ paths. The actual requirement is an internet-facing ALB is placed in subnets without appropriate internet-gateway routes. Recommended corrective action: Place ALB in public subnets with internet connectivity and security groups. Public load balancers need valid internet-facing subnet routing.

Add per-AZ public NAT gateways and private-subnet default routes would help if private EC2 hosts need outbound IPv4 connections without public IPs. NAT gateways provide outbound-only initiated IPv4 internet access. That is not the symptom described here: an internet-facing ALB is placed in subnets without appropriate internet-gateway routes. The matching response is Place ALB in public subnets with internet connectivity and security groups, because public load balancers need valid internet-facing subnet routing.

The option Add per-AZ public NAT gateways and private-subnet default routes addresses a separate condition: private EC2 hosts need outbound IPv4 connections without public IPs. NAT gateways provide outbound-only initiated IPv4 internet access. The actual requirement is nAT gateway traffic frequently crosses AZ boundaries from private workloads. Recommended corrective action: Use AZ-local routing and NAT placement where reliability/cost warrants. Local AZ egress avoids extra inter-AZ paths.

For the alternative failure an internet-facing ALB is placed in subnets without appropriate internet-gateway routes, the control Place ALB in public subnets with internet connectivity and security groups is relevant: public load balancers need valid internet-facing subnet routing. Here the evidence instead is nAT gateway traffic frequently crosses AZ boundaries from private workloads. The selected technical mechanism is Use AZ-local routing and NAT placement where reliability/cost warrants: local AZ egress avoids extra inter-AZ paths.

Use S3 gateway endpoints for supported same-region S3 access solves a different operational problem where private workload calls to S3 generate large NAT data processing charges. Gateway routes bypass NAT data-processing charges. It does not directly address nAT gateway traffic frequently crosses AZ boundaries from private workloads. The case calls for Use AZ-local routing and NAT placement where reliability/cost warrants, since local AZ egress avoids extra inter-AZ paths.

For the alternative failure cloudFront edge requests still use an origin that is located far from customers despite caching disabled, the control Configure proper cache key/TTL for cacheable responses is relevant: cache policies determine edge hit ratio. Here the evidence instead is a customer wants all VPC routes transitive through peering connections. The selected technical mechanism is Replace transitive-peering assumptions with AWS Transit Gateway: vPC peering is not transitive.

Assign public address only to approved public hosts or route through NAT for private hosts solves a different operational problem where an EC2 instance has a default route to the IGW but lacks a public IP. Internet gateway egress requires a routable public address on the source. It does not directly address a customer wants all VPC routes transitive through peering connections. The case calls for Replace transitive-peering assumptions with AWS Transit Gateway, since vPC peering is not transitive.

The competing option Correct address planning or use appropriate private service translation would be useful when hybrid on-prem announces a route that conflicts with a VPC CIDR. Overlapping networks complicate straightforward routing. The present issue is a customer wants all VPC routes transitive through peering connections; it is more directly addressed by Replace transitive-peering assumptions with AWS Transit Gateway. VPC peering is not transitive.

Assign public address only to approved public hosts or route through NAT for private hosts solves a different operational problem where an EC2 instance has a default route to the IGW but lacks a public IP. Internet gateway egress requires a routable public address on the source. It does not directly address a private API must remain reachable to another account without sharing all VPC CIDRs. The case calls for Use PrivateLink service/consumer endpoints, since privateLink exposes a bounded service privately.

The competing option Configure proper cache key/TTL for cacheable responses would be useful when cloudFront edge requests still use an origin that is located far from customers despite caching disabled. Cache policies determine edge hit ratio. The present issue is a private API must remain reachable to another account without sharing all VPC CIDRs; it is more directly addressed by Use PrivateLink service/consumer endpoints. PrivateLink exposes a bounded service privately.

The option Correct address planning or use appropriate private service translation addresses a separate condition: hybrid on-prem announces a route that conflicts with a VPC CIDR. Overlapping networks complicate straightforward routing. The actual requirement is a private API must remain reachable to another account without sharing all VPC CIDRs. Recommended corrective action: Use PrivateLink service/consumer endpoints. PrivateLink exposes a bounded service privately.

Correct address planning or use appropriate private service translation solves a different operational problem where hybrid on-prem announces a route that conflicts with a VPC CIDR. Overlapping networks complicate straightforward routing. It does not directly address an EC2 instance has a default route to the IGW but lacks a public IP. The case calls for Assign public address only to approved public hosts or route through NAT for private hosts, since internet gateway egress requires a routable public address on the source.

The competing option Use PrivateLink service/consumer endpoints would be useful when a private API must remain reachable to another account without sharing all VPC CIDRs. PrivateLink exposes a bounded service privately. The present issue is an EC2 instance has a default route to the IGW but lacks a public IP; it is more directly addressed by Assign public address only to approved public hosts or route through NAT for private hosts. Internet gateway egress requires a routable public address on the source.

The option Configure proper cache key/TTL for cacheable responses addresses a separate condition: cloudFront edge requests still use an origin that is located far from customers despite caching disabled. Cache policies determine edge hit ratio. The actual requirement is an EC2 instance has a default route to the IGW but lacks a public IP. Recommended corrective action: Assign public address only to approved public hosts or route through NAT for private hosts. Internet gateway egress requires a routable public address on the source.

The option Replace transitive-peering assumptions with AWS Transit Gateway addresses a separate condition: a customer wants all VPC routes transitive through peering connections. VPC peering is not transitive. The actual requirement is hybrid on-prem announces a route that conflicts with a VPC CIDR. Recommended corrective action: Correct address planning or use appropriate private service translation. Overlapping networks complicate straightforward routing.

Use PrivateLink service/consumer endpoints would help if a private API must remain reachable to another account without sharing all VPC CIDRs. PrivateLink exposes a bounded service privately. That is not the symptom described here: hybrid on-prem announces a route that conflicts with a VPC CIDR. The matching response is Correct address planning or use appropriate private service translation, because overlapping networks complicate straightforward routing.

For the alternative failure an EC2 instance has a default route to the IGW but lacks a public IP, the control Assign public address only to approved public hosts or route through NAT for private hosts is relevant: internet gateway egress requires a routable public address on the source. Here the evidence instead is hybrid on-prem announces a route that conflicts with a VPC CIDR. The selected technical mechanism is Correct address planning or use appropriate private service translation: overlapping networks complicate straightforward routing.

Correct address planning or use appropriate private service translation would help if hybrid on-prem announces a route that conflicts with a VPC CIDR. Overlapping networks complicate straightforward routing. That is not the symptom described here: cloudFront edge requests still use an origin that is located far from customers despite caching disabled. The matching response is Configure proper cache key/TTL for cacheable responses, because cache policies determine edge hit ratio.

For the alternative failure a private API must remain reachable to another account without sharing all VPC CIDRs, the control Use PrivateLink service/consumer endpoints is relevant: privateLink exposes a bounded service privately. Here the evidence instead is cloudFront edge requests still use an origin that is located far from customers despite caching disabled. The selected technical mechanism is Configure proper cache key/TTL for cacheable responses: cache policies determine edge hit ratio.

Assign public address only to approved public hosts or route through NAT for private hosts solves a different operational problem where an EC2 instance has a default route to the IGW but lacks a public IP. Internet gateway egress requires a routable public address on the source. It does not directly address cloudFront edge requests still use an origin that is located far from customers despite caching disabled. The case calls for Configure proper cache key/TTL for cacheable responses, since cache policies determine edge hit ratio.