Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

Set Route 53 alias record to the ALB would help if a public service uses an ALB but clients need a friendly custom DNS name. Route 53 alias records target supported AWS resources. That is not the symptom described here: the DNS records resolve but backend AZ is unhealthy. The matching response is Configure appropriate health-check and regional failover behavior, because dNS availability depends on endpoint health design.

For the alternative failure vPC hosts require on-prem DNS zones not available in public DNS, the control Use Route 53 Resolver outbound endpoints with forwarding rules is relevant: outbound resolvers forward specific DNS domains to external DNS. Here the evidence instead is the DNS records resolve but backend AZ is unhealthy. The selected technical mechanism is Configure appropriate health-check and regional failover behavior: dNS availability depends on endpoint health design.

Use Route 53 private hosted zones associated with intended VPCs solves a different operational problem where internal services need name resolution only inside authorized VPCs. Private zone records are scoped to associated VPC resolvers. It does not directly address the DNS records resolve but backend AZ is unhealthy. The case calls for Configure appropriate health-check and regional failover behavior, since dNS availability depends on endpoint health design.

Deploy Global Accelerator for eligible non-HTTP or TCP traffic would help if a long-lived TCP connection to a regional app experiences unstable internet path. Global Accelerator leverages AWS global network routing. That is not the symptom described here: website visitors repeatedly download static content over slow transcontinental paths. The matching response is Cache at CloudFront edges and use compression where supported, because edge caching and compression reduce transferred origin bytes.

For the alternative failure clients need a simple HTTPS redirect and certificate termination, the control Configure ALB HTTPS listener and ACM certificate with redirect from HTTP is relevant: aLB handles managed TLS and HTTP listener actions. Here the evidence instead is website visitors repeatedly download static content over slow transcontinental paths. The selected technical mechanism is Cache at CloudFront edges and use compression where supported: edge caching and compression reduce transferred origin bytes.

Use VPC peering, Transit Gateway or PrivateLink matching routing requirements solves a different operational problem where private applications between VPCs must avoid internet exposure. AWS private connectivity options keep network flows on controlled paths. It does not directly address website visitors repeatedly download static content over slow transcontinental paths. The case calls for Cache at CloudFront edges and use compression where supported, since edge caching and compression reduce transferred origin bytes.

For the alternative failure clients need a simple HTTPS redirect and certificate termination, the control Configure ALB HTTPS listener and ACM certificate with redirect from HTTP is relevant: aLB handles managed TLS and HTTP listener actions. Here the evidence instead is a long-lived TCP connection to a regional app experiences unstable internet path. The selected technical mechanism is Deploy Global Accelerator for eligible non-HTTP or TCP traffic: global Accelerator leverages AWS global network routing.

Use VPC peering, Transit Gateway or PrivateLink matching routing requirements solves a different operational problem where private applications between VPCs must avoid internet exposure. AWS private connectivity options keep network flows on controlled paths. It does not directly address a long-lived TCP connection to a regional app experiences unstable internet path. The case calls for Deploy Global Accelerator for eligible non-HTTP or TCP traffic, since global Accelerator leverages AWS global network routing.

The option Use Global Accelerator health-based endpoint failover as appropriate addresses a separate condition: a cross-region API requires quick automatic failover independent of stale client DNS caches. Anycast routing can shift eligible connections without changing DNS records. The actual requirement is a long-lived TCP connection to a regional app experiences unstable internet path. Recommended corrective action: Deploy Global Accelerator for eligible non-HTTP or TCP traffic. Global Accelerator leverages AWS global network routing.

Cache at CloudFront edges and use compression where supported solves a different operational problem where website visitors repeatedly download static content over slow transcontinental paths. Edge caching and compression reduce transferred origin bytes. It does not directly address private applications between VPCs must avoid internet exposure. The case calls for Use VPC peering, Transit Gateway or PrivateLink matching routing requirements, since aWS private connectivity options keep network flows on controlled paths.

The option Configure ALB HTTPS listener and ACM certificate with redirect from HTTP addresses a separate condition: clients need a simple HTTPS redirect and certificate termination. ALB handles managed TLS and HTTP listener actions. The actual requirement is private applications between VPCs must avoid internet exposure. Recommended corrective action: Use VPC peering, Transit Gateway or PrivateLink matching routing requirements. AWS private connectivity options keep network flows on controlled paths.

Use Global Accelerator health-based endpoint failover as appropriate would help if a cross-region API requires quick automatic failover independent of stale client DNS caches. Anycast routing can shift eligible connections without changing DNS records. That is not the symptom described here: private applications between VPCs must avoid internet exposure. The matching response is Use VPC peering, Transit Gateway or PrivateLink matching routing requirements, because aWS private connectivity options keep network flows on controlled paths.

The option Cache at CloudFront edges and use compression where supported addresses a separate condition: website visitors repeatedly download static content over slow transcontinental paths. Edge caching and compression reduce transferred origin bytes. The actual requirement is a cross-region API requires quick automatic failover independent of stale client DNS caches. Recommended corrective action: Use Global Accelerator health-based endpoint failover as appropriate. Anycast routing can shift eligible connections without changing DNS records.

Use VPC peering, Transit Gateway or PrivateLink matching routing requirements would help if private applications between VPCs must avoid internet exposure. AWS private connectivity options keep network flows on controlled paths. That is not the symptom described here: a cross-region API requires quick automatic failover independent of stale client DNS caches. The matching response is Use Global Accelerator health-based endpoint failover as appropriate, because anycast routing can shift eligible connections without changing DNS records.

For the alternative failure a long-lived TCP connection to a regional app experiences unstable internet path, the control Deploy Global Accelerator for eligible non-HTTP or TCP traffic is relevant: global Accelerator leverages AWS global network routing. Here the evidence instead is a cross-region API requires quick automatic failover independent of stale client DNS caches. The selected technical mechanism is Use Global Accelerator health-based endpoint failover as appropriate: anycast routing can shift eligible connections without changing DNS records.

The option Use Global Accelerator health-based endpoint failover as appropriate addresses a separate condition: a cross-region API requires quick automatic failover independent of stale client DNS caches. Anycast routing can shift eligible connections without changing DNS records. The actual requirement is clients need a simple HTTPS redirect and certificate termination. Recommended corrective action: Configure ALB HTTPS listener and ACM certificate with redirect from HTTP. ALB handles managed TLS and HTTP listener actions.

Use VPC peering, Transit Gateway or PrivateLink matching routing requirements would help if private applications between VPCs must avoid internet exposure. AWS private connectivity options keep network flows on controlled paths. That is not the symptom described here: clients need a simple HTTPS redirect and certificate termination. The matching response is Configure ALB HTTPS listener and ACM certificate with redirect from HTTP, because aLB handles managed TLS and HTTP listener actions.

For the alternative failure website visitors repeatedly download static content over slow transcontinental paths, the control Cache at CloudFront edges and use compression where supported is relevant: edge caching and compression reduce transferred origin bytes. Here the evidence instead is clients need a simple HTTPS redirect and certificate termination. The selected technical mechanism is Configure ALB HTTPS listener and ACM certificate with redirect from HTTP: aLB handles managed TLS and HTTP listener actions.

Publish a PrivateLink endpoint service instead of trying to route entire peer networks would help if a service with overlapping partner CIDR requires bounded private access. Service-specific private endpoints avoid network-level CIDR overlap. That is not the symptom described here: a database subnet has a route directly to the IGW and public IP exposure. The matching response is Remove unnecessary internet route/public addressing from database resources, because private DB tiers should not be internet routable.

For the alternative failure app instances require TCP database access without opening all VPC CIDRs, the control Allow inbound from the application security group at the database port is relevant: group references scope private tier access. Here the evidence instead is a database subnet has a route directly to the IGW and public IP exposure. The selected technical mechanism is Remove unnecessary internet route/public addressing from database resources: private DB tiers should not be internet routable.

The competing option Associate that route table with the endpoint would be useful when a direct S3 gateway endpoint path is missing from one private subnet route table. Subnet route associations determine private service reachability. The present issue is a database subnet has a route directly to the IGW and public IP exposure; it is more directly addressed by Remove unnecessary internet route/public addressing from database resources. Private DB tiers should not be internet routable.

Publish a PrivateLink endpoint service instead of trying to route entire peer networks solves a different operational problem where a service with overlapping partner CIDR requires bounded private access. Service-specific private endpoints avoid network-level CIDR overlap. It does not directly address app instances require TCP database access without opening all VPC CIDRs. The case calls for Allow inbound from the application security group at the database port, since group references scope private tier access.

The competing option Use a multi-AZ ALB with redundant healthy targets would be useful when public services in two AZs are reached through only one static host. Managed load balancing removes single-host ingress. The present issue is app instances require TCP database access without opening all VPC CIDRs; it is more directly addressed by Allow inbound from the application security group at the database port. Group references scope private tier access.

The option Remove unnecessary internet route/public addressing from database resources addresses a separate condition: a database subnet has a route directly to the IGW and public IP exposure. Private DB tiers should not be internet routable. The actual requirement is app instances require TCP database access without opening all VPC CIDRs. Recommended corrective action: Allow inbound from the application security group at the database port. Group references scope private tier access.

Associate that route table with the endpoint solves a different operational problem where a direct S3 gateway endpoint path is missing from one private subnet route table. Subnet route associations determine private service reachability. It does not directly address public services in two AZs are reached through only one static host. The case calls for Use a multi-AZ ALB with redundant healthy targets, since managed load balancing removes single-host ingress.

The competing option Allow inbound from the application security group at the database port would be useful when app instances require TCP database access without opening all VPC CIDRs. Group references scope private tier access. The present issue is public services in two AZs are reached through only one static host; it is more directly addressed by Use a multi-AZ ALB with redundant healthy targets. Managed load balancing removes single-host ingress.

Remove unnecessary internet route/public addressing from database resources would help if a database subnet has a route directly to the IGW and public IP exposure. Private DB tiers should not be internet routable. That is not the symptom described here: public services in two AZs are reached through only one static host. The matching response is Use a multi-AZ ALB with redundant healthy targets, because managed load balancing removes single-host ingress.

The competing option Remove unnecessary internet route/public addressing from database resources would be useful when a database subnet has a route directly to the IGW and public IP exposure. Private DB tiers should not be internet routable. The present issue is a direct S3 gateway endpoint path is missing from one private subnet route table; it is more directly addressed by Associate that route table with the endpoint. Subnet route associations determine private service reachability.

The option Allow inbound from the application security group at the database port addresses a separate condition: app instances require TCP database access without opening all VPC CIDRs. Group references scope private tier access. The actual requirement is a direct S3 gateway endpoint path is missing from one private subnet route table. Recommended corrective action: Associate that route table with the endpoint. Subnet route associations determine private service reachability.

Use a multi-AZ ALB with redundant healthy targets would help if public services in two AZs are reached through only one static host. Managed load balancing removes single-host ingress. That is not the symptom described here: a direct S3 gateway endpoint path is missing from one private subnet route table. The matching response is Associate that route table with the endpoint, because subnet route associations determine private service reachability.

Allow inbound from the application security group at the database port would help if app instances require TCP database access without opening all VPC CIDRs. Group references scope private tier access. That is not the symptom described here: a service with overlapping partner CIDR requires bounded private access. The matching response is Publish a PrivateLink endpoint service instead of trying to route entire peer networks, because service-specific private endpoints avoid network-level CIDR overlap.

For the alternative failure a direct S3 gateway endpoint path is missing from one private subnet route table, the control Associate that route table with the endpoint is relevant: subnet route associations determine private service reachability. Here the evidence instead is a service with overlapping partner CIDR requires bounded private access. The selected technical mechanism is Publish a PrivateLink endpoint service instead of trying to route entire peer networks: service-specific private endpoints avoid network-level CIDR overlap.

Use a multi-AZ ALB with redundant healthy targets solves a different operational problem where public services in two AZs are reached through only one static host. Managed load balancing removes single-host ingress. It does not directly address a service with overlapping partner CIDR requires bounded private access. The case calls for Publish a PrivateLink endpoint service instead of trying to route entire peer networks, since service-specific private endpoints avoid network-level CIDR overlap.