Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

This alternative, Use a Direct Connect gateway with an appropriate Transit Gateway association, is appropriate when A central network team needs to connect many VPCs over a common Direct Connect deployment. A Direct Connect gateway supports scalable private connectivity to multiple AWS VPC networks.

Provision an AWS Direct Connect connection and private virtual interface to the VPC transit design solves the related scenario A data center needs consistent private connectivity to AWS that bypasses the public internet; direct Connect provides a dedicated network path rather than an internet-based encrypted tunnel.

Although Configure an AWS Site-to-Site VPN as a secondary hybrid path with BGP route preference can be valid when The dedicated hybrid connection is healthy but a regional routing disruption requires automatic backup, it targets a different technical condition. The VPN offers an alternate encrypted path if the preferred Direct Connect route is unavailable.

Associate the matching Resolver forwarding rule with the querying VPC solves the related scenario A DNS query for an on-premises suffix still uses public DNS despite an outbound endpoint; a forwarding endpoint alone does not route queries until rules are linked to source VPCs.

Deploy Route 53 Resolver inbound endpoints reachable from the data center would address a different requirement: On-premises application servers need to resolve names in a Route 53 private hosted zone. Inbound endpoints accept forwarded DNS queries into AWS VPC Resolver.

This alternative, Share Route 53 Resolver rules across accounts with AWS RAM and associate the VPCs, is appropriate when Several VPCs require identical corporate DNS conditional forwarding without copying configuration manually. Shared resolver rules centralize hybrid domain-forwarding policy for participating VPCs.

Although Create Route 53 Resolver outbound endpoints and forwarding rules for the corporate domain can be valid when EC2 instances must resolve internal corporate names hosted on on-premises DNS servers, it targets a different technical condition. Outbound Resolver forwarding routes matching VPC DNS queries to enterprise DNS servers.

This alternative, Associate each VPC with the appropriate Route 53 private hosted zone and record set, is appropriate when An internal-only application hostname must resolve differently inside two application VPCs. Private hosted-zone association controls visibility of internal DNS records by VPC.

For the separate situation A DNS query for an on-premises suffix still uses public DNS despite an outbound endpoint, Associate the matching Resolver forwarding rule with the querying VPC could be useful. A forwarding endpoint alone does not route queries until rules are linked to source VPCs.

Associate each VPC with the appropriate Route 53 private hosted zone and record set would address a different requirement: An internal-only application hostname must resolve differently inside two application VPCs. Private hosted-zone association controls visibility of internal DNS records by VPC.

This alternative, Associate the matching Resolver forwarding rule with the querying VPC, is appropriate when A DNS query for an on-premises suffix still uses public DNS despite an outbound endpoint. A forwarding endpoint alone does not route queries until rules are linked to source VPCs.

For the separate situation On-premises application servers need to resolve names in a Route 53 private hosted zone, Deploy Route 53 Resolver inbound endpoints reachable from the data center could be useful. Inbound endpoints accept forwarded DNS queries into AWS VPC Resolver.

For the separate situation Several VPCs require identical corporate DNS conditional forwarding without copying configuration manually, Share Route 53 Resolver rules across accounts with AWS RAM and associate the VPCs could be useful. Shared resolver rules centralize hybrid domain-forwarding policy for participating VPCs.

Create Route 53 Resolver outbound endpoints and forwarding rules for the corporate domain solves the related scenario EC2 instances must resolve internal corporate names hosted on on-premises DNS servers; outbound Resolver forwarding routes matching VPC DNS queries to enterprise DNS servers.

Although Deploy Route 53 Resolver inbound endpoints reachable from the data center can be valid when On-premises application servers need to resolve names in a Route 53 private hosted zone, it targets a different technical condition. Inbound endpoints accept forwarded DNS queries into AWS VPC Resolver.

For the separate situation EC2 instances must resolve internal corporate names hosted on on-premises DNS servers, Create Route 53 Resolver outbound endpoints and forwarding rules for the corporate domain could be useful. Outbound Resolver forwarding routes matching VPC DNS queries to enterprise DNS servers.

Deploy Route 53 Resolver inbound endpoints reachable from the data center solves the related scenario On-premises application servers need to resolve names in a Route 53 private hosted zone; inbound endpoints accept forwarded DNS queries into AWS VPC Resolver.

Associate each VPC with the appropriate Route 53 private hosted zone and record set would address a different requirement: An internal-only application hostname must resolve differently inside two application VPCs. Private hosted-zone association controls visibility of internal DNS records by VPC.

Although Allocate nonoverlapping VPC CIDRs centrally using Amazon VPC IP Address Manager can be valid when A new cloud landing zone will grow across dozens of accounts with unpredictable subnet expansion, it targets a different technical condition. IPAM pools coordinate hierarchical address allocation and overlap prevention.

Place it in a private subnet with a route to a NAT gateway in a public subnet would address a different requirement: A private EC2 workload must access software updates on the internet without accepting unsolicited inbound requests. NAT gateway provides outbound IPv4 translation without direct public inbound routing.

For the separate situation A public-facing Application Load Balancer sits in subnets that do not route to an internet gateway, Add appropriate routes from the ALB public subnets to an attached internet gateway could be useful. Internet-facing IPv4 load balancers require internet-reachable subnet routing.

Place it in a private subnet with a route to a NAT gateway in a public subnet would address a different requirement: A private EC2 workload must access software updates on the internet without accepting unsolicited inbound requests. NAT gateway provides outbound IPv4 translation without direct public inbound routing.

For the separate situation An EC2 instance cannot reach a different VPC even though the networks are peered, Verify both VPC route tables include the peer CIDR targets and allow traffic via security controls could be useful. Peering requires matching routes and security policies rather than automatic route propagation.

Use a private translation or application proxy design rather than direct native VPC routing solves the related scenario Two acquired VPCs use overlapping private CIDR blocks and must exchange application data; vPC peering and Transit Gateway routing cannot transparently route overlapping address ranges.

This alternative, Verify both VPC route tables include the peer CIDR targets and allow traffic via security controls, is appropriate when An EC2 instance cannot reach a different VPC even though the networks are peered. Peering requires matching routes and security policies rather than automatic route propagation.

For the separate situation Two acquired VPCs use overlapping private CIDR blocks and must exchange application data, Use a private translation or application proxy design rather than direct native VPC routing could be useful. VPC peering and Transit Gateway routing cannot transparently route overlapping address ranges.

Although Add appropriate routes from the ALB public subnets to an attached internet gateway can be valid when A public-facing Application Load Balancer sits in subnets that do not route to an internet gateway, it targets a different technical condition. Internet-facing IPv4 load balancers require internet-reachable subnet routing.

For the separate situation A new cloud landing zone will grow across dozens of accounts with unpredictable subnet expansion, Allocate nonoverlapping VPC CIDRs centrally using Amazon VPC IP Address Manager could be useful. IPAM pools coordinate hierarchical address allocation and overlap prevention.

Although Place it in a private subnet with a route to a NAT gateway in a public subnet can be valid when A private EC2 workload must access software updates on the internet without accepting unsolicited inbound requests, it targets a different technical condition. NAT gateway provides outbound IPv4 translation without direct public inbound routing.

Verify both VPC route tables include the peer CIDR targets and allow traffic via security controls would address a different requirement: An EC2 instance cannot reach a different VPC even though the networks are peered. Peering requires matching routes and security policies rather than automatic route propagation.

Allocate nonoverlapping VPC CIDRs centrally using Amazon VPC IP Address Manager solves the related scenario A new cloud landing zone will grow across dozens of accounts with unpredictable subnet expansion; iPAM pools coordinate hierarchical address allocation and overlap prevention.

Although Place it in a private subnet with a route to a NAT gateway in a public subnet can be valid when A private EC2 workload must access software updates on the internet without accepting unsolicited inbound requests, it targets a different technical condition. NAT gateway provides outbound IPv4 translation without direct public inbound routing.

This alternative, Use a private translation or application proxy design rather than direct native VPC routing, is appropriate when Two acquired VPCs use overlapping private CIDR blocks and must exchange application data. VPC peering and Transit Gateway routing cannot transparently route overlapping address ranges.