Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Correct address planning or use appropriate private service translation would help if hybrid on-prem announces a route that conflicts with a VPC CIDR. Overlapping networks complicate straightforward routing. That is not the symptom described here: cloudFront edge requests still use an origin that is located far from customers despite caching disabled. The matching response is Configure proper cache key/TTL for cacheable responses, because cache policies determine edge hit ratio.

For the alternative failure a private API must remain reachable to another account without sharing all VPC CIDRs, the control Use PrivateLink service/consumer endpoints is relevant: privateLink exposes a bounded service privately. Here the evidence instead is cloudFront edge requests still use an origin that is located far from customers despite caching disabled. The selected technical mechanism is Configure proper cache key/TTL for cacheable responses: cache policies determine edge hit ratio.

Assign public address only to approved public hosts or route through NAT for private hosts solves a different operational problem where an EC2 instance has a default route to the IGW but lacks a public IP. Internet gateway egress requires a routable public address on the source. It does not directly address cloudFront edge requests still use an origin that is located far from customers despite caching disabled. The case calls for Configure proper cache key/TTL for cacheable responses, since cache policies determine edge hit ratio.

For the alternative failure a large video catalogue is served repeatedly from regional origins, the control Use CloudFront cache behaviors with suitable TTL is relevant: cDN caches reduce repeat origin load. Here the evidence instead is many EC2 targets need TCP load balancing with high connection rates. The selected technical mechanism is Use Network Load Balancer and health-checked target groups: nLB handles Layer-4 traffic at scale.

Configure explicit ALB host-header listener rules for each target group solves a different operational problem where one public ALB must direct different customer hostnames to independently deployed API groups. Host-header matching routes requests by the requested HTTP hostname. It does not directly address many EC2 targets need TCP load balancing with high connection rates. The case calls for Use Network Load Balancer and health-checked target groups, since nLB handles Layer-4 traffic at scale.

The competing option Use AWS Global Accelerator would be useful when external users need a static anycast IP for globally distributed endpoints. Global Accelerator offers static anycast entry points. The present issue is many EC2 targets need TCP load balancing with high connection rates; it is more directly addressed by Use Network Load Balancer and health-checked target groups. NLB handles Layer-4 traffic at scale.

For the alternative failure external users need a static anycast IP for globally distributed endpoints, the control Use AWS Global Accelerator is relevant: global Accelerator offers static anycast entry points. Here the evidence instead is one public ALB must direct different customer hostnames to independently deployed API groups. The selected technical mechanism is Configure explicit ALB host-header listener rules for each target group: host-header matching routes requests by the requested HTTP hostname.

Use CloudFront cache behaviors with suitable TTL solves a different operational problem where a large video catalogue is served repeatedly from regional origins. CDN caches reduce repeat origin load. It does not directly address one public ALB must direct different customer hostnames to independently deployed API groups. The case calls for Configure explicit ALB host-header listener rules for each target group, since host-header matching routes requests by the requested HTTP hostname.

The competing option Fix load-balancer health-check port/path/protocol would be useful when a service is inaccessible because its target health checks run on the wrong port. Healthy target selection depends on successful probes. The present issue is one public ALB must direct different customer hostnames to independently deployed API groups; it is more directly addressed by Configure explicit ALB host-header listener rules for each target group. Host-header matching routes requests by the requested HTTP hostname.

Use Network Load Balancer and health-checked target groups solves a different operational problem where many EC2 targets need TCP load balancing with high connection rates. NLB handles Layer-4 traffic at scale. It does not directly address external users need a static anycast IP for globally distributed endpoints. The case calls for Use AWS Global Accelerator, since global Accelerator offers static anycast entry points.

The competing option Configure explicit ALB host-header listener rules for each target group would be useful when one public ALB must direct different customer hostnames to independently deployed API groups. Host-header matching routes requests by the requested HTTP hostname. The present issue is external users need a static anycast IP for globally distributed endpoints; it is more directly addressed by Use AWS Global Accelerator. Global Accelerator offers static anycast entry points.

The option Use CloudFront cache behaviors with suitable TTL addresses a separate condition: a large video catalogue is served repeatedly from regional origins. CDN caches reduce repeat origin load. The actual requirement is external users need a static anycast IP for globally distributed endpoints. Recommended corrective action: Use AWS Global Accelerator. Global Accelerator offers static anycast entry points.

The competing option Use AWS Global Accelerator would be useful when external users need a static anycast IP for globally distributed endpoints. Global Accelerator offers static anycast entry points. The present issue is a large video catalogue is served repeatedly from regional origins; it is more directly addressed by Use CloudFront cache behaviors with suitable TTL. CDN caches reduce repeat origin load.

The option Configure explicit ALB host-header listener rules for each target group addresses a separate condition: one public ALB must direct different customer hostnames to independently deployed API groups. Host-header matching routes requests by the requested HTTP hostname. The actual requirement is a large video catalogue is served repeatedly from regional origins. Recommended corrective action: Use CloudFront cache behaviors with suitable TTL. CDN caches reduce repeat origin load.

For the alternative failure a service is inaccessible because its target health checks run on the wrong port, the control Fix load-balancer health-check port/path/protocol is relevant: healthy target selection depends on successful probes. Here the evidence instead is a large video catalogue is served repeatedly from regional origins. The selected technical mechanism is Use CloudFront cache behaviors with suitable TTL: cDN caches reduce repeat origin load.

The option Use AWS Global Accelerator addresses a separate condition: external users need a static anycast IP for globally distributed endpoints. Global Accelerator offers static anycast entry points. The actual requirement is a service is inaccessible because its target health checks run on the wrong port. Recommended corrective action: Fix load-balancer health-check port/path/protocol. Healthy target selection depends on successful probes.

Use CloudFront cache behaviors with suitable TTL would help if a large video catalogue is served repeatedly from regional origins. CDN caches reduce repeat origin load. That is not the symptom described here: a service is inaccessible because its target health checks run on the wrong port. The matching response is Fix load-balancer health-check port/path/protocol, because healthy target selection depends on successful probes.

Use Network Load Balancer and health-checked target groups solves a different operational problem where many EC2 targets need TCP load balancing with high connection rates. NLB handles Layer-4 traffic at scale. It does not directly address a service is inaccessible because its target health checks run on the wrong port. The case calls for Fix load-balancer health-check port/path/protocol, since healthy target selection depends on successful probes.

Use Route 53 Resolver outbound endpoints with forwarding rules would help if vPC hosts require on-prem DNS zones not available in public DNS. Outbound resolvers forward specific DNS domains to external DNS. That is not the symptom described here: a public service uses an ALB but clients need a friendly custom DNS name. The matching response is Set Route 53 alias record to the ALB, because route 53 alias records target supported AWS resources.

For the alternative failure internal services need name resolution only inside authorized VPCs, the control Use Route 53 private hosted zones associated with intended VPCs is relevant: private zone records are scoped to associated VPC resolvers. Here the evidence instead is a public service uses an ALB but clients need a friendly custom DNS name. The selected technical mechanism is Set Route 53 alias record to the ALB: route 53 alias records target supported AWS resources.

Permit the approved DNS ports and sources in Resolver inbound endpoint security groups solves a different operational problem where on-premises DNS resolvers reach the VPC but their queries time out at Resolver endpoint IPs. Inbound Resolver ENIs require network permission for hybrid DNS queries. It does not directly address a public service uses an ALB but clients need a friendly custom DNS name. The case calls for Set Route 53 alias record to the ALB, since route 53 alias records target supported AWS resources.

For the alternative failure on-premises DNS resolvers reach the VPC but their queries time out at Resolver endpoint IPs, the control Permit the approved DNS ports and sources in Resolver inbound endpoint security groups is relevant: inbound Resolver ENIs require network permission for hybrid DNS queries. Here the evidence instead is internal services need name resolution only inside authorized VPCs. The selected technical mechanism is Use Route 53 private hosted zones associated with intended VPCs: private zone records are scoped to associated VPC resolvers.

The competing option Use Route 53 Resolver outbound endpoints with forwarding rules would be useful when vPC hosts require on-prem DNS zones not available in public DNS. Outbound resolvers forward specific DNS domains to external DNS. The present issue is internal services need name resolution only inside authorized VPCs; it is more directly addressed by Use Route 53 private hosted zones associated with intended VPCs. Private zone records are scoped to associated VPC resolvers.

The option Set Route 53 alias record to the ALB addresses a separate condition: a public service uses an ALB but clients need a friendly custom DNS name. Route 53 alias records target supported AWS resources. The actual requirement is internal services need name resolution only inside authorized VPCs. Recommended corrective action: Use Route 53 private hosted zones associated with intended VPCs. Private zone records are scoped to associated VPC resolvers.

Configure appropriate health-check and regional failover behavior solves a different operational problem where the DNS records resolve but backend AZ is unhealthy. DNS availability depends on endpoint health design. It does not directly address on-premises DNS resolvers reach the VPC but their queries time out at Resolver endpoint IPs. The case calls for Permit the approved DNS ports and sources in Resolver inbound endpoint security groups, since inbound Resolver ENIs require network permission for hybrid DNS queries.

The competing option Use Route 53 Resolver outbound endpoints with forwarding rules would be useful when vPC hosts require on-prem DNS zones not available in public DNS. Outbound resolvers forward specific DNS domains to external DNS. The present issue is on-premises DNS resolvers reach the VPC but their queries time out at Resolver endpoint IPs; it is more directly addressed by Permit the approved DNS ports and sources in Resolver inbound endpoint security groups. Inbound Resolver ENIs require network permission for hybrid DNS queries.

The option Set Route 53 alias record to the ALB addresses a separate condition: a public service uses an ALB but clients need a friendly custom DNS name. Route 53 alias records target supported AWS resources. The actual requirement is on-premises DNS resolvers reach the VPC but their queries time out at Resolver endpoint IPs. Recommended corrective action: Permit the approved DNS ports and sources in Resolver inbound endpoint security groups. Inbound Resolver ENIs require network permission for hybrid DNS queries.

The competing option Permit the approved DNS ports and sources in Resolver inbound endpoint security groups would be useful when on-premises DNS resolvers reach the VPC but their queries time out at Resolver endpoint IPs. Inbound Resolver ENIs require network permission for hybrid DNS queries. The present issue is vPC hosts require on-prem DNS zones not available in public DNS; it is more directly addressed by Use Route 53 Resolver outbound endpoints with forwarding rules. Outbound resolvers forward specific DNS domains to external DNS.

Use Route 53 private hosted zones associated with intended VPCs would help if internal services need name resolution only inside authorized VPCs. Private zone records are scoped to associated VPC resolvers. That is not the symptom described here: vPC hosts require on-prem DNS zones not available in public DNS. The matching response is Use Route 53 Resolver outbound endpoints with forwarding rules, because outbound resolvers forward specific DNS domains to external DNS.

For the alternative failure the DNS records resolve but backend AZ is unhealthy, the control Configure appropriate health-check and regional failover behavior is relevant: dNS availability depends on endpoint health design. Here the evidence instead is vPC hosts require on-prem DNS zones not available in public DNS. The selected technical mechanism is Use Route 53 Resolver outbound endpoints with forwarding rules: outbound resolvers forward specific DNS domains to external DNS.

Set Route 53 alias record to the ALB would help if a public service uses an ALB but clients need a friendly custom DNS name. Route 53 alias records target supported AWS resources. That is not the symptom described here: the DNS records resolve but backend AZ is unhealthy. The matching response is Configure appropriate health-check and regional failover behavior, because dNS availability depends on endpoint health design.

For the alternative failure vPC hosts require on-prem DNS zones not available in public DNS, the control Use Route 53 Resolver outbound endpoints with forwarding rules is relevant: outbound resolvers forward specific DNS domains to external DNS. Here the evidence instead is the DNS records resolve but backend AZ is unhealthy. The selected technical mechanism is Configure appropriate health-check and regional failover behavior: dNS availability depends on endpoint health design.

Use Route 53 private hosted zones associated with intended VPCs solves a different operational problem where internal services need name resolution only inside authorized VPCs. Private zone records are scoped to associated VPC resolvers. It does not directly address the DNS records resolve but backend AZ is unhealthy. The case calls for Configure appropriate health-check and regional failover behavior, since dNS availability depends on endpoint health design.