Amazon AWS Certified Solutions Architect Associate SAA-C03 Network Topology Load Balancing and Edge Performance Practice Test

 

Topic 14 covers network topology load balancing and edge performance for the AWS Certified Solutions Architect – Associate certification. These original practice questions apply the verified SAA-C03 objectives to practical decisions and troubleshooting. Select one answer unless a fixed number is requested. For broader preparation, visit the AWS Certified Solutions Architect Associate SAA-C03 Exam Dumps page. Each option includes an explanation of the relevant behavior and scenario constraints.

Question 1

A global website serves cacheable images and JavaScript from one S3 origin. Which service should place cached copies near users?

1. Use AWS Global Accelerator with regional endpoints.
2. Use CloudFront in front of the regional HTTP origin.
3. Use Amazon CloudFront.
4. Use AWS Global Accelerator.
5. Use Global Accelerator static anycast IP addresses.

Correct Answer: C

 

Correct Answer

Answer C is correct because CloudFront is a content delivery network that serves HTTP(S) content through edge locations and can cache suitable responses. This directly meets the decisive requirement: CloudFront.

Incorrect Answers

Answer A is incorrect because Global Accelerator is designed for global ingress with static anycast IPs and health-aware endpoint routing. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront.

Answer B is incorrect because CloudFront can improve HTTP connection handling and edge delivery even when some dynamic responses are not cached. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront.

Answer D is incorrect because Global Accelerator routes TCP/UDP traffic through the AWS global network to healthy regional endpoints and provides static anycast IP addresses. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront.

Answer E is incorrect because The static IPs remain stable while endpoint groups and regional endpoints can change behind them. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront.

 

Question 2

A global gaming service uses long-lived TCP connections to regional endpoints and cannot rely on HTTP caching. Which edge service can improve path selection using anycast static IPs?

1. Use AWS Global Accelerator.
2. Use AWS Global Accelerator with regional endpoints.
3. Use CloudFront in front of the regional HTTP origin.
4. Use Amazon CloudFront.
5. Use Global Accelerator static anycast IP addresses.

Correct Answer: A

 

Correct Answer

Answer A is correct because Global Accelerator routes TCP/UDP traffic through the AWS global network to healthy regional endpoints and provides static anycast IP addresses. This directly meets the decisive requirement: Global Accelerator.

Incorrect Answers

Answer B is incorrect because Global Accelerator is designed for global ingress with static anycast IPs and health-aware endpoint routing. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer C is incorrect because CloudFront can improve HTTP connection handling and edge delivery even when some dynamic responses are not cached. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer D is incorrect because CloudFront is a content delivery network that serves HTTP(S) content through edge locations and can cache suitable responses. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer E is incorrect because The static IPs remain stable while endpoint groups and regional endpoints can change behind them. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

 

Question 3

A multi-Region application wants users to enter through two stable global IP addresses and then be routed to the closest healthy regional endpoint. Which service fits?

1. Use CloudFront in front of the regional HTTP origin.
2. Use AWS Global Accelerator with regional endpoints.
3. Use AWS Global Accelerator.
4. Use Amazon CloudFront.
5. Use Global Accelerator static anycast IP addresses.

Correct Answer: B

 

Correct Answer

Answer B is correct because Global Accelerator is designed for global ingress with static anycast IPs and health-aware endpoint routing. This directly meets the decisive requirement: Global Accelerator.

Incorrect Answers

Answer A is incorrect because CloudFront can improve HTTP connection handling and edge delivery even when some dynamic responses are not cached. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer C is incorrect because Global Accelerator routes TCP/UDP traffic through the AWS global network to healthy regional endpoints and provides static anycast IP addresses. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer D is incorrect because CloudFront is a content delivery network that serves HTTP(S) content through edge locations and can cache suitable responses. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer E is incorrect because The static IPs remain stable while endpoint groups and regional endpoints can change behind them. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

 

Question 4

A mostly dynamic HTTPS API already terminates at regional ALBs and benefits from edge connection reuse even when responses are not cached. Which service can still improve global HTTP delivery?

1. Use Global Accelerator static anycast IP addresses.
2. Use CloudFront in front of the regional HTTP origin.
3. Use Amazon CloudFront.
4. Use AWS Global Accelerator with regional endpoints.
5. Use AWS Global Accelerator.

Correct Answer: B

 

Correct Answer

Answer B is correct because CloudFront can improve HTTP connection handling and edge delivery even when some dynamic responses are not cached. This directly meets the decisive requirement: CloudFront as HTTP edge.

Incorrect Answers

Answer A is incorrect because The static IPs remain stable while endpoint groups and regional endpoints can change behind them. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront as HTTP edge.

Answer C is incorrect because CloudFront is a content delivery network that serves HTTP(S) content through edge locations and can cache suitable responses. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront as HTTP edge.

Answer D is incorrect because Global Accelerator is designed for global ingress with static anycast IPs and health-aware endpoint routing. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront as HTTP edge.

Answer E is incorrect because Global Accelerator routes TCP/UDP traffic through the AWS global network to healthy regional endpoints and provides static anycast IP addresses. It may be useful elsewhere, but it does not meet the decisive requirement here: CloudFront as HTTP edge.

 

Question 5

An application needs the same public IP addresses preserved while regional endpoints are changed during deployments. Which edge service is designed around static anycast IPs?

1. Use Global Accelerator static anycast IP addresses.
2. Use Amazon CloudFront.
3. Use AWS Global Accelerator.
4. Use CloudFront in front of the regional HTTP origin.
5. Use AWS Global Accelerator with regional endpoints.

Correct Answer: A

 

Correct Answer

Answer A is correct because The static IPs remain stable while endpoint groups and regional endpoints can change behind them. This directly meets the decisive requirement: Global Accelerator.

Incorrect Answers

Answer B is incorrect because CloudFront is a content delivery network that serves HTTP(S) content through edge locations and can cache suitable responses. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer C is incorrect because Global Accelerator routes TCP/UDP traffic through the AWS global network to healthy regional endpoints and provides static anycast IP addresses. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer D is incorrect because CloudFront can improve HTTP connection handling and edge delivery even when some dynamic responses are not cached. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

Answer E is incorrect because Global Accelerator is designed for global ingress with static anycast IPs and health-aware endpoint routing. It may be useful elsewhere, but it does not meet the decisive requirement here: Global Accelerator.

 

Question 6

A web application must route `/api/*` and `/images/*` to different target groups based on HTTP path. Which load balancer should be used?

1. Use a Gateway Load Balancer for the appliance fleet.
2. Use a Network Load Balancer with static-IP characteristics for the custom TCP protocol.
3. Use an Application Load Balancer with an HTTPS listener and host-based rules.
4. Use an Application Load Balancer with path-based listener rules.
5. Use a Network Load Balancer for the Layer 4 service.

Correct Answer: D

 

Correct Answer

Answer D is correct because ALB operates at Layer 7 and supports HTTP/HTTPS features such as host- and path-based routing. This directly meets the decisive requirement: Application Load Balancer.

Incorrect Answers

Answer A is incorrect because GWLB is designed to deploy, scale, and steer traffic through fleets of virtual network appliances. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

Answer B is incorrect because NLB is appropriate for non-HTTP TCP services and can provide static IP behavior through its network interfaces/EIPs where configured. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

Answer C is incorrect because ALB can terminate TLS and make routing decisions using HTTP host or path information. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

Answer E is incorrect because NLB operates at Layer 4 for TCP/UDP/TLS workloads and supports very high throughput and static IP characteristics. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

 

Question 7

A service requires very high-performance TCP load balancing and the backend application must see the source IP. Which load balancer is appropriate?

1. Use a Network Load Balancer for the Layer 4 service.
2. Use an Application Load Balancer with an HTTPS listener and host-based rules.
3. Use a Gateway Load Balancer for the appliance fleet.
4. Use an Application Load Balancer with path-based listener rules.
5. Use a Network Load Balancer with static-IP characteristics for the custom TCP protocol.

Correct Answer: A

 

Correct Answer

Answer A is correct because NLB operates at Layer 4 for TCP/UDP/TLS workloads and supports very high throughput and static IP characteristics. This directly meets the decisive requirement: Network Load Balancer.

Incorrect Answers

Answer B is incorrect because ALB can terminate TLS and make routing decisions using HTTP host or path information. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

Answer C is incorrect because GWLB is designed to deploy, scale, and steer traffic through fleets of virtual network appliances. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

Answer D is incorrect because ALB operates at Layer 7 and supports HTTP/HTTPS features such as host- and path-based routing. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

Answer E is incorrect because NLB is appropriate for non-HTTP TCP services and can provide static IP behavior through its network interfaces/EIPs where configured. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

 

Question 8

A company inserts a fleet of third-party firewalls transparently into VPC traffic flows. Which load balancer is designed for network virtual appliances?

1. Use a Network Load Balancer for the Layer 4 service.
2. Use a Gateway Load Balancer for the appliance fleet.
3. Use an Application Load Balancer with path-based listener rules.
4. Use an Application Load Balancer with an HTTPS listener and host-based rules.
5. Use a Network Load Balancer with static-IP characteristics for the custom TCP protocol.

Correct Answer: B

 

Correct Answer

Answer B is correct because GWLB is designed to deploy, scale, and steer traffic through fleets of virtual network appliances. This directly meets the decisive requirement: Gateway Load Balancer.

Incorrect Answers

Answer A is incorrect because NLB operates at Layer 4 for TCP/UDP/TLS workloads and supports very high throughput and static IP characteristics. It may be useful elsewhere, but it does not meet the decisive requirement here: Gateway Load Balancer.

Answer C is incorrect because ALB operates at Layer 7 and supports HTTP/HTTPS features such as host- and path-based routing. It may be useful elsewhere, but it does not meet the decisive requirement here: Gateway Load Balancer.

Answer D is incorrect because ALB can terminate TLS and make routing decisions using HTTP host or path information. It may be useful elsewhere, but it does not meet the decisive requirement here: Gateway Load Balancer.

Answer E is incorrect because NLB is appropriate for non-HTTP TCP services and can provide static IP behavior through its network interfaces/EIPs where configured. It may be useful elsewhere, but it does not meet the decisive requirement here: Gateway Load Balancer.

 

Question 9

A web service needs TLS termination and host-based routing at the load balancer. Which type fits best?

1. Use an Application Load Balancer with an HTTPS listener and host-based rules.
2. Use an Application Load Balancer with path-based listener rules.
3. Use a Network Load Balancer with static-IP characteristics for the custom TCP protocol.
4. Use a Gateway Load Balancer for the appliance fleet.
5. Use a Network Load Balancer for the Layer 4 service.

Correct Answer: A

 

Correct Answer

Answer A is correct because ALB can terminate TLS and make routing decisions using HTTP host or path information. This directly meets the decisive requirement: Application Load Balancer.

Incorrect Answers

Answer B is incorrect because ALB operates at Layer 7 and supports HTTP/HTTPS features such as host- and path-based routing. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

Answer C is incorrect because NLB is appropriate for non-HTTP TCP services and can provide static IP behavior through its network interfaces/EIPs where configured. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

Answer D is incorrect because GWLB is designed to deploy, scale, and steer traffic through fleets of virtual network appliances. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

Answer E is incorrect because NLB operates at Layer 4 for TCP/UDP/TLS workloads and supports very high throughput and static IP characteristics. It may be useful elsewhere, but it does not meet the decisive requirement here: Application Load Balancer.

 

Question 10

A backend speaks a custom TCP protocol that is not HTTP and needs static IP support. Which load balancer family fits?

1. Use a Gateway Load Balancer for the appliance fleet.
2. Use an Application Load Balancer with path-based listener rules.
3. Use an Application Load Balancer with an HTTPS listener and host-based rules.
4. Use a Network Load Balancer for the Layer 4 service.
5. Use a Network Load Balancer with static-IP characteristics for the custom TCP protocol.

Correct Answer: E

 

Correct Answer

Answer E is correct because NLB is appropriate for non-HTTP TCP services and can provide static IP behavior through its network interfaces/EIPs where configured. This directly meets the decisive requirement: Network Load Balancer.

Incorrect Answers

Answer A is incorrect because GWLB is designed to deploy, scale, and steer traffic through fleets of virtual network appliances. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

Answer B is incorrect because ALB operates at Layer 7 and supports HTTP/HTTPS features such as host- and path-based routing. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

Answer C is incorrect because ALB can terminate TLS and make routing decisions using HTTP host or path information. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

Answer D is incorrect because NLB operates at Layer 4 for TCP/UDP/TLS workloads and supports very high throughput and static IP characteristics. It may be useful elsewhere, but it does not meet the decisive requirement here: Network Load Balancer.

 

Question 11

A VPC uses a /24 CIDR and is running out of addresses as more subnets are added. Which planning change should be made before growth continues?

1. Add or redesign VPC CIDR space and subnet sizing before address exhaustion.
2. Design route domains, summarization, and segmentation so route-table scale remains manageable.
3. Plan sufficient subnet IP capacity for ENIs/tasks/pods.
4. Renumber or use a connectivity pattern that can translate/avoid the overlapping address space.
5. Use an egress-only internet gateway for the IPv6 private-subnet egress requirement.

Correct Answer: A

 

Correct Answer

Answer A is correct because IPv4 address capacity is finite, so growth requires explicit CIDR and subnet planning rather than waiting for allocation failures. This directly meets the decisive requirement: add appropriately sized secondary CIDR or redesign address plan.

Incorrect Answers

Answer B is incorrect because Large hub-and-spoke networks need explicit route-domain design to avoid uncontrolled route growth and coupling. It may be useful elsewhere, but it does not meet the decisive requirement here: add appropriately sized secondary CIDR or redesign address plan.

Answer C is incorrect because Compute and container networking can consume subnet addresses quickly, and exhausted subnets block new placements regardless of CPU capacity. It may be useful elsewhere, but it does not meet the decisive requirement here: add appropriately sized secondary CIDR or redesign address plan.

Answer D is incorrect because Overlapping CIDRs cannot be routed normally because the network cannot distinguish identical destination prefixes. It may be useful elsewhere, but it does not meet the decisive requirement here: add appropriately sized secondary CIDR or redesign address plan.

Answer E is incorrect because An egress-only internet gateway allows outbound-initiated IPv6 internet connectivity without accepting unsolicited inbound connections. It may be useful elsewhere, but it does not meet the decisive requirement here: add appropriately sized secondary CIDR or redesign address plan.

 

Question 12

Two companies must connect VPCs after a merger, but both use 10.0.0.0/16. What issue must be resolved before straightforward routing works?

1. Use an egress-only internet gateway for the IPv6 private-subnet egress requirement.
2. Add or redesign VPC CIDR space and subnet sizing before address exhaustion.
3. Design route domains, summarization, and segmentation so route-table scale remains manageable.
4. Renumber or use a connectivity pattern that can translate/avoid the overlapping address space.
5. Plan sufficient subnet IP capacity for ENIs/tasks/pods.

Correct Answer: D

 

Correct Answer

Answer D is correct because Overlapping CIDRs cannot be routed normally because the network cannot distinguish identical destination prefixes. This directly meets the decisive requirement: address overlap.

Incorrect Answers

Answer A is incorrect because An egress-only internet gateway allows outbound-initiated IPv6 internet connectivity without accepting unsolicited inbound connections. It may be useful elsewhere, but it does not meet the decisive requirement here: address overlap.

Answer B is incorrect because IPv4 address capacity is finite, so growth requires explicit CIDR and subnet planning rather than waiting for allocation failures. It may be useful elsewhere, but it does not meet the decisive requirement here: address overlap.

Answer C is incorrect because Large hub-and-spoke networks need explicit route-domain design to avoid uncontrolled route growth and coupling. It may be useful elsewhere, but it does not meet the decisive requirement here: address overlap.

Answer E is incorrect because Compute and container networking can consume subnet addresses quickly, and exhausted subnets block new placements regardless of CPU capacity. It may be useful elsewhere, but it does not meet the decisive requirement here: address overlap.

 

Question 13

An internet-facing application wants globally routable addresses without NAT for outbound IPv6 while blocking unsolicited inbound IPv6 from private subnets. Which VPC feature is relevant?

1. Design route domains, summarization, and segmentation so route-table scale remains manageable.
2. Use an egress-only internet gateway for the IPv6 private-subnet egress requirement.
3. Plan sufficient subnet IP capacity for ENIs/tasks/pods.
4. Add or redesign VPC CIDR space and subnet sizing before address exhaustion.
5. Renumber or use a connectivity pattern that can translate/avoid the overlapping address space.

Correct Answer: B

 

Correct Answer

Answer B is correct because An egress-only internet gateway allows outbound-initiated IPv6 internet connectivity without accepting unsolicited inbound connections. This directly meets the decisive requirement: egress-only internet gateway.

Incorrect Answers

Answer A is incorrect because Large hub-and-spoke networks need explicit route-domain design to avoid uncontrolled route growth and coupling. It may be useful elsewhere, but it does not meet the decisive requirement here: egress-only internet gateway.

Answer C is incorrect because Compute and container networking can consume subnet addresses quickly, and exhausted subnets block new placements regardless of CPU capacity. It may be useful elsewhere, but it does not meet the decisive requirement here: egress-only internet gateway.

Answer D is incorrect because IPv4 address capacity is finite, so growth requires explicit CIDR and subnet planning rather than waiting for allocation failures. It may be useful elsewhere, but it does not meet the decisive requirement here: egress-only internet gateway.

Answer E is incorrect because Overlapping CIDRs cannot be routed normally because the network cannot distinguish identical destination prefixes. It may be useful elsewhere, but it does not meet the decisive requirement here: egress-only internet gateway.

 

Question 14

A transit hub connects hundreds of VPCs and route tables are nearing operational complexity. What architecture concern should be evaluated?

1. Use an egress-only internet gateway for the IPv6 private-subnet egress requirement.
2. Add or redesign VPC CIDR space and subnet sizing before address exhaustion.
3. Plan sufficient subnet IP capacity for ENIs/tasks/pods.
4. Renumber or use a connectivity pattern that can translate/avoid the overlapping address space.
5. Design route domains, summarization, and segmentation so route-table scale remains manageable.

Correct Answer: E

 

Correct Answer

Answer E is correct because Large hub-and-spoke networks need explicit route-domain design to avoid uncontrolled route growth and coupling. This directly meets the decisive requirement: route summarization/segmentation and route-table scale.

Incorrect Answers

Answer A is incorrect because An egress-only internet gateway allows outbound-initiated IPv6 internet connectivity without accepting unsolicited inbound connections. It may be useful elsewhere, but it does not meet the decisive requirement here: route summarization/segmentation and route-table scale.

Answer B is incorrect because IPv4 address capacity is finite, so growth requires explicit CIDR and subnet planning rather than waiting for allocation failures. It may be useful elsewhere, but it does not meet the decisive requirement here: route summarization/segmentation and route-table scale.

Answer C is incorrect because Compute and container networking can consume subnet addresses quickly, and exhausted subnets block new placements regardless of CPU capacity. It may be useful elsewhere, but it does not meet the decisive requirement here: route summarization/segmentation and route-table scale.

Answer D is incorrect because Overlapping CIDRs cannot be routed normally because the network cannot distinguish identical destination prefixes. It may be useful elsewhere, but it does not meet the decisive requirement here: route summarization/segmentation and route-table scale.

 

Question 15

A container platform consumes IP addresses rapidly because every task/pod needs VPC addressing. Which resource should be capacity-planned explicitly?

1. Design route domains, summarization, and segmentation so route-table scale remains manageable.
2. Renumber or use a connectivity pattern that can translate/avoid the overlapping address space.
3. Plan sufficient subnet IP capacity for ENIs/tasks/pods.
4. Add or redesign VPC CIDR space and subnet sizing before address exhaustion.
5. Use an egress-only internet gateway for the IPv6 private-subnet egress requirement.

Correct Answer: C

 

Correct Answer

Answer C is correct because Compute and container networking can consume subnet addresses quickly, and exhausted subnets block new placements regardless of CPU capacity. This directly meets the decisive requirement: subnet IP space.

Incorrect Answers

Answer A is incorrect because Large hub-and-spoke networks need explicit route-domain design to avoid uncontrolled route growth and coupling. It may be useful elsewhere, but it does not meet the decisive requirement here: subnet IP space.

Answer B is incorrect because Overlapping CIDRs cannot be routed normally because the network cannot distinguish identical destination prefixes. It may be useful elsewhere, but it does not meet the decisive requirement here: subnet IP space.

Answer D is incorrect because IPv4 address capacity is finite, so growth requires explicit CIDR and subnet planning rather than waiting for allocation failures. It may be useful elsewhere, but it does not meet the decisive requirement here: subnet IP space.

Answer E is incorrect because An egress-only internet gateway allows outbound-initiated IPv6 internet connectivity without accepting unsolicited inbound connections. It may be useful elsewhere, but it does not meet the decisive requirement here: subnet IP space.

 

Question 16

Two VPCs need simple one-to-one private connectivity and there are no transitive-routing requirements. Which option is simplest?

1. Use AWS Direct Connect.
2. Use AWS Site-to-Site VPN.
3. Use AWS Transit Gateway.
4. Use AWS PrivateLink.
5. Use VPC peering.

Correct Answer: E

 

Correct Answer

Answer E is correct because Peering provides direct private routing between two VPCs but is not a transitive hub architecture. This directly meets the decisive requirement: VPC peering.

Incorrect Answers

Answer A is incorrect because Direct Connect provides dedicated private connectivity from customer locations to AWS connectivity locations. It may be useful elsewhere, but it does not meet the decisive requirement here: VPC peering.

Answer B is incorrect because Site-to-Site VPN creates encrypted IPsec tunnels over internet connectivity between the customer network and AWS. It may be useful elsewhere, but it does not meet the decisive requirement here: VPC peering.

Answer C is incorrect because Transit Gateway provides a central routing hub for many VPCs and supported hybrid attachments. It may be useful elsewhere, but it does not meet the decisive requirement here: VPC peering.

Answer D is incorrect because PrivateLink exposes services privately through interface endpoints without sharing full VPC routing domains. It may be useful elsewhere, but it does not meet the decisive requirement here: VPC peering.

 

Question 17

Hundreds of VPCs and several on-premises networks need hub-and-spoke routing with centralized route control. Which service should be used?

1. Use AWS Site-to-Site VPN.
2. Use AWS PrivateLink.
3. Use AWS Direct Connect.
4. Use VPC peering.
5. Use AWS Transit Gateway.

Correct Answer: E

 

Correct Answer

Answer E is correct because Transit Gateway provides a central routing hub for many VPCs and supported hybrid attachments. This directly meets the decisive requirement: Transit Gateway.

Incorrect Answers

Answer A is incorrect because Site-to-Site VPN creates encrypted IPsec tunnels over internet connectivity between the customer network and AWS. It may be useful elsewhere, but it does not meet the decisive requirement here: Transit Gateway.

Answer B is incorrect because PrivateLink exposes services privately through interface endpoints without sharing full VPC routing domains. It may be useful elsewhere, but it does not meet the decisive requirement here: Transit Gateway.

Answer C is incorrect because Direct Connect provides dedicated private connectivity from customer locations to AWS connectivity locations. It may be useful elsewhere, but it does not meet the decisive requirement here: Transit Gateway.

Answer D is incorrect because Peering provides direct private routing between two VPCs but is not a transitive hub architecture. It may be useful elsewhere, but it does not meet the decisive requirement here: Transit Gateway.

 

Question 18

A SaaS provider wants customers to privately access one service endpoint without exposing full VPC routing or requiring peering. Which feature fits?

1. Use AWS PrivateLink.
2. Use AWS Transit Gateway.
3. Use AWS Site-to-Site VPN.
4. Use VPC peering.
5. Use AWS Direct Connect.

Correct Answer: A

 

Correct Answer

Answer A is correct because PrivateLink exposes services privately through interface endpoints without sharing full VPC routing domains. This directly meets the decisive requirement: PrivateLink.

Incorrect Answers

Answer B is incorrect because Transit Gateway provides a central routing hub for many VPCs and supported hybrid attachments. It may be useful elsewhere, but it does not meet the decisive requirement here: PrivateLink.

Answer C is incorrect because Site-to-Site VPN creates encrypted IPsec tunnels over internet connectivity between the customer network and AWS. It may be useful elsewhere, but it does not meet the decisive requirement here: PrivateLink.

Answer D is incorrect because Peering provides direct private routing between two VPCs but is not a transitive hub architecture. It may be useful elsewhere, but it does not meet the decisive requirement here: PrivateLink.

Answer E is incorrect because Direct Connect provides dedicated private connectivity from customer locations to AWS connectivity locations. It may be useful elsewhere, but it does not meet the decisive requirement here: PrivateLink.

 

Question 19

A data center needs predictable private connectivity to AWS with sustained high bandwidth and does not want the primary path to traverse the public internet. Which service should be evaluated?

1. Use AWS PrivateLink.
2. Use AWS Site-to-Site VPN.
3. Use AWS Direct Connect.
4. Use AWS Transit Gateway.
5. Use VPC peering.

Correct Answer: C

 

Correct Answer

Answer C is correct because Direct Connect provides dedicated private connectivity from customer locations to AWS connectivity locations. This directly meets the decisive requirement: Direct Connect.

Incorrect Answers

Answer A is incorrect because PrivateLink exposes services privately through interface endpoints without sharing full VPC routing domains. It may be useful elsewhere, but it does not meet the decisive requirement here: Direct Connect.

Answer B is incorrect because Site-to-Site VPN creates encrypted IPsec tunnels over internet connectivity between the customer network and AWS. It may be useful elsewhere, but it does not meet the decisive requirement here: Direct Connect.

Answer D is incorrect because Transit Gateway provides a central routing hub for many VPCs and supported hybrid attachments. It may be useful elsewhere, but it does not meet the decisive requirement here: Direct Connect.

Answer E is incorrect because Peering provides direct private routing between two VPCs but is not a transitive hub architecture. It may be useful elsewhere, but it does not meet the decisive requirement here: Direct Connect.

 

Question 20

A branch needs encrypted connectivity to a VPC quickly over its existing internet circuit. Which service should be used?

1. Use VPC peering.
2. Use AWS Transit Gateway.
3. Use AWS Site-to-Site VPN.
4. Use AWS PrivateLink.
5. Use AWS Direct Connect.

Correct Answer: C

 

Correct Answer

Answer C is correct because Site-to-Site VPN creates encrypted IPsec tunnels over internet connectivity between the customer network and AWS. This directly meets the decisive requirement: Site-to-Site VPN.

Incorrect Answers

Answer A is incorrect because Peering provides direct private routing between two VPCs but is not a transitive hub architecture. It may be useful elsewhere, but it does not meet the decisive requirement here: Site-to-Site VPN.

Answer B is incorrect because Transit Gateway provides a central routing hub for many VPCs and supported hybrid attachments. It may be useful elsewhere, but it does not meet the decisive requirement here: Site-to-Site VPN.

Answer D is incorrect because PrivateLink exposes services privately through interface endpoints without sharing full VPC routing domains. It may be useful elsewhere, but it does not meet the decisive requirement here: Site-to-Site VPN.

Answer E is incorrect because Direct Connect provides dedicated private connectivity from customer locations to AWS connectivity locations. It may be useful elsewhere, but it does not meet the decisive requirement here: Site-to-Site VPN.

 

Question 21

Most users are in Europe but the application runs only in ap-southeast-1 and latency is unacceptable. Which placement decision should be evaluated first?

1. Place compute near the large data set when possible.
2. Keep highly chatty latency-sensitive components on efficient paths while preserving required fault isolation.
3. Place regional application capacity closer to the primary user population or use appropriate global edge services.
4. Use a Region where the required service is supported or redesign around an available alternative.
5. Distribute required capacity across multiple Availability Zones.

Correct Answer: C

 

Correct Answer

Answer C is correct because Physical distance affects network latency, so Region and edge placement should reflect user geography and application requirements. This directly meets the decisive requirement: place serving resources closer to users.

Incorrect Answers

Answer A is incorrect because Data gravity favors processing close to the data to avoid repeated large transfers and added network latency. It may be useful elsewhere, but it does not meet the decisive requirement here: place serving resources closer to users.

Answer B is incorrect because Unnecessary cross-AZ hops add latency; placement should balance locality with the failure domains the workload must survive. It may be useful elsewhere, but it does not meet the decisive requirement here: place serving resources closer to users.

Answer D is incorrect because A service that is not offered in a Region cannot be selected merely because that Region is otherwise preferable. It may be useful elsewhere, but it does not meet the decisive requirement here: place serving resources closer to users.

Answer E is incorrect because Meeting an AZ-failure objective requires surviving capacity outside any single AZ even if one location is slightly faster. It may be useful elsewhere, but it does not meet the decisive requirement here: place serving resources closer to users.

 

Question 22

An application server and its database communicate heavily across AZs even though no fault-isolation reason requires that path. Which placement change can reduce latency?

1. Place compute near the large data set when possible.
2. Distribute required capacity across multiple Availability Zones.
3. Use a Region where the required service is supported or redesign around an available alternative.
4. Place regional application capacity closer to the primary user population or use appropriate global edge services.
5. Keep highly chatty latency-sensitive components on efficient paths while preserving required fault isolation.

Correct Answer: E

 

Correct Answer

Answer E is correct because Unnecessary cross-AZ hops add latency; placement should balance locality with the failure domains the workload must survive. This directly meets the decisive requirement: co-locate latency-sensitive components within resilient design.

Incorrect Answers

Answer A is incorrect because Data gravity favors processing close to the data to avoid repeated large transfers and added network latency. It may be useful elsewhere, but it does not meet the decisive requirement here: co-locate latency-sensitive components within resilient design.

Answer B is incorrect because Meeting an AZ-failure objective requires surviving capacity outside any single AZ even if one location is slightly faster. It may be useful elsewhere, but it does not meet the decisive requirement here: co-locate latency-sensitive components within resilient design.

Answer C is incorrect because A service that is not offered in a Region cannot be selected merely because that Region is otherwise preferable. It may be useful elsewhere, but it does not meet the decisive requirement here: co-locate latency-sensitive components within resilient design.

Answer D is incorrect because Physical distance affects network latency, so Region and edge placement should reflect user geography and application requirements. It may be useful elsewhere, but it does not meet the decisive requirement here: co-locate latency-sensitive components within resilient design.

 

Question 23

A compute job processes 50 TB already stored in one Region. Which placement principle generally avoids unnecessary movement and latency?

1. Keep highly chatty latency-sensitive components on efficient paths while preserving required fault isolation.
2. Place regional application capacity closer to the primary user population or use appropriate global edge services.
3. Use a Region where the required service is supported or redesign around an available alternative.
4. Distribute required capacity across multiple Availability Zones.
5. Place compute near the large data set when possible.

Correct Answer: E

 

Correct Answer

Answer E is correct because Data gravity favors processing close to the data to avoid repeated large transfers and added network latency. This directly meets the decisive requirement: place compute near data.

Incorrect Answers

Answer A is incorrect because Unnecessary cross-AZ hops add latency; placement should balance locality with the failure domains the workload must survive. It may be useful elsewhere, but it does not meet the decisive requirement here: place compute near data.

Answer B is incorrect because Physical distance affects network latency, so Region and edge placement should reflect user geography and application requirements. It may be useful elsewhere, but it does not meet the decisive requirement here: place compute near data.

Answer C is incorrect because A service that is not offered in a Region cannot be selected merely because that Region is otherwise preferable. It may be useful elsewhere, but it does not meet the decisive requirement here: place compute near data.

Answer D is incorrect because Meeting an AZ-failure objective requires surviving capacity outside any single AZ even if one location is slightly faster. It may be useful elsewhere, but it does not meet the decisive requirement here: place compute near data.

 

Question 24

A required AWS service is unavailable in the business-preferred Region. What must the architecture do?

1. Distribute required capacity across multiple Availability Zones.
2. Keep highly chatty latency-sensitive components on efficient paths while preserving required fault isolation.
3. Place compute near the large data set when possible.
4. Use a Region where the required service is supported or redesign around an available alternative.
5. Place regional application capacity closer to the primary user population or use appropriate global edge services.

Correct Answer: D

 

Correct Answer

Answer D is correct because A service that is not offered in a Region cannot be selected merely because that Region is otherwise preferable. This directly meets the decisive requirement: choose supported Region or alternative service.

Incorrect Answers

Answer A is incorrect because Meeting an AZ-failure objective requires surviving capacity outside any single AZ even if one location is slightly faster. It may be useful elsewhere, but it does not meet the decisive requirement here: choose supported Region or alternative service.

Answer B is incorrect because Unnecessary cross-AZ hops add latency; placement should balance locality with the failure domains the workload must survive. It may be useful elsewhere, but it does not meet the decisive requirement here: choose supported Region or alternative service.

Answer C is incorrect because Data gravity favors processing close to the data to avoid repeated large transfers and added network latency. It may be useful elsewhere, but it does not meet the decisive requirement here: choose supported Region or alternative service.

Answer E is incorrect because Physical distance affects network latency, so Region and edge placement should reflect user geography and application requirements. It may be useful elsewhere, but it does not meet the decisive requirement here: choose supported Region or alternative service.

 

Question 25

A resilient application must survive loss of one AZ. Which placement requirement remains necessary even if one AZ has slightly lower latency?

1. Distribute required capacity across multiple Availability Zones.
2. Place compute near the large data set when possible.
3. Use a Region where the required service is supported or redesign around an available alternative.
4. Place regional application capacity closer to the primary user population or use appropriate global edge services.
5. Keep highly chatty latency-sensitive components on efficient paths while preserving required fault isolation.

Correct Answer: A

 

Correct Answer

Answer A is correct because Meeting an AZ-failure objective requires surviving capacity outside any single AZ even if one location is slightly faster. This directly meets the decisive requirement: distribute required capacity across AZs.

Incorrect Answers

Answer B is incorrect because Data gravity favors processing close to the data to avoid repeated large transfers and added network latency. It may be useful elsewhere, but it does not meet the decisive requirement here: distribute required capacity across AZs.

Answer C is incorrect because A service that is not offered in a Region cannot be selected merely because that Region is otherwise preferable. It may be useful elsewhere, but it does not meet the decisive requirement here: distribute required capacity across AZs.

Answer D is incorrect because Physical distance affects network latency, so Region and edge placement should reflect user geography and application requirements. It may be useful elsewhere, but it does not meet the decisive requirement here: distribute required capacity across AZs.

Answer E is incorrect because Unnecessary cross-AZ hops add latency; placement should balance locality with the failure domains the workload must survive. It may be useful elsewhere, but it does not meet the decisive requirement here: distribute required capacity across AZs.

 

Question 26

A Site-to-Site VPN is consistently near its tested throughput ceiling during business hours. Which action should the architect consider?

1. Increase available VPN capacity or move sustained high-volume traffic to Direct Connect when requirements justify it.
2. Design interface endpoint capacity and AZ/subnet placement for the client population.
3. Scale target capacity and verify load distribution across healthy targets.
4. Use Transit Gateway route tables and controlled route propagation to maintain separate scalable routing domains.
5. Increase Direct Connect bandwidth and design redundant connections/locations as required.

Correct Answer: A

 

Correct Answer

Answer A is correct because A path already at its measured throughput ceiling needs more transport capacity or a different connectivity service. This directly meets the decisive requirement: scale/tune VPN or move high-volume traffic to Direct Connect.

Incorrect Answers

Answer B is incorrect because PrivateLink connectivity depends on endpoint ENIs and DNS/AZ placement, so endpoint topology must scale with usage. It may be useful elsewhere, but it does not meet the decisive requirement here: scale/tune VPN or move high-volume traffic to Direct Connect.

Answer C is incorrect because The load balancer cannot compensate for an undersized or uneven backend fleet once individual targets are saturated. It may be useful elsewhere, but it does not meet the decisive requirement here: scale/tune VPN or move high-volume traffic to Direct Connect.

Answer D is incorrect because Segmented route tables keep large transit networks manageable and prevent every attachment from learning every route unnecessarily. It may be useful elsewhere, but it does not meet the decisive requirement here: scale/tune VPN or move high-volume traffic to Direct Connect.

Answer E is incorrect because Dedicated connectivity must be capacity-planned for projected traffic and resilience rather than assumed to scale without bounds. It may be useful elsewhere, but it does not meet the decisive requirement here: scale/tune VPN or move high-volume traffic to Direct Connect.

 

Question 27

A Direct Connect connection no longer has enough capacity for projected transfer growth. Which planning decision is required?

1. Increase available VPN capacity or move sustained high-volume traffic to Direct Connect when requirements justify it.
2. Design interface endpoint capacity and AZ/subnet placement for the client population.
3. Use Transit Gateway route tables and controlled route propagation to maintain separate scalable routing domains.
4. Increase Direct Connect bandwidth and design redundant connections/locations as required.
5. Scale target capacity and verify load distribution across healthy targets.

Correct Answer: D

 

Correct Answer

Answer D is correct because Dedicated connectivity must be capacity-planned for projected traffic and resilience rather than assumed to scale without bounds. This directly meets the decisive requirement: increase DX capacity/add resilient connections.

Incorrect Answers

Answer A is incorrect because A path already at its measured throughput ceiling needs more transport capacity or a different connectivity service. It may be useful elsewhere, but it does not meet the decisive requirement here: increase DX capacity/add resilient connections.

Answer B is incorrect because PrivateLink connectivity depends on endpoint ENIs and DNS/AZ placement, so endpoint topology must scale with usage. It may be useful elsewhere, but it does not meet the decisive requirement here: increase DX capacity/add resilient connections.

Answer C is incorrect because Segmented route tables keep large transit networks manageable and prevent every attachment from learning every route unnecessarily. It may be useful elsewhere, but it does not meet the decisive requirement here: increase DX capacity/add resilient connections.

Answer E is incorrect because The load balancer cannot compensate for an undersized or uneven backend fleet once individual targets are saturated. It may be useful elsewhere, but it does not meet the decisive requirement here: increase DX capacity/add resilient connections.

 

Question 28

An ALB target group has enough instances but individual targets are overloaded because health traffic is uneven. Which capacity area should be checked?

1. Scale target capacity and verify load distribution across healthy targets.
2. Use Transit Gateway route tables and controlled route propagation to maintain separate scalable routing domains.
3. Increase Direct Connect bandwidth and design redundant connections/locations as required.
4. Design interface endpoint capacity and AZ/subnet placement for the client population.
5. Increase available VPN capacity or move sustained high-volume traffic to Direct Connect when requirements justify it.

Correct Answer: A

 

Correct Answer

Answer A is correct because The load balancer cannot compensate for an undersized or uneven backend fleet once individual targets are saturated. This directly meets the decisive requirement: target capacity and distribution.

Incorrect Answers

Answer B is incorrect because Segmented route tables keep large transit networks manageable and prevent every attachment from learning every route unnecessarily. It may be useful elsewhere, but it does not meet the decisive requirement here: target capacity and distribution.

Answer C is incorrect because Dedicated connectivity must be capacity-planned for projected traffic and resilience rather than assumed to scale without bounds. It may be useful elsewhere, but it does not meet the decisive requirement here: target capacity and distribution.

Answer D is incorrect because PrivateLink connectivity depends on endpoint ENIs and DNS/AZ placement, so endpoint topology must scale with usage. It may be useful elsewhere, but it does not meet the decisive requirement here: target capacity and distribution.

Answer E is incorrect because A path already at its measured throughput ceiling needs more transport capacity or a different connectivity service. It may be useful elsewhere, but it does not meet the decisive requirement here: target capacity and distribution.

 

Question 29

Thousands of clients access one interface VPC endpoint and the service path is healthy, but DNS and endpoint-subnet design is uneven across AZs. What should be scaled?

1. Use Transit Gateway route tables and controlled route propagation to maintain separate scalable routing domains.
2. Scale target capacity and verify load distribution across healthy targets.
3. Design interface endpoint capacity and AZ/subnet placement for the client population.
4. Increase Direct Connect bandwidth and design redundant connections/locations as required.
5. Increase available VPN capacity or move sustained high-volume traffic to Direct Connect when requirements justify it.

Correct Answer: C

 

Correct Answer

Answer C is correct because PrivateLink connectivity depends on endpoint ENIs and DNS/AZ placement, so endpoint topology must scale with usage. This directly meets the decisive requirement: endpoint ENIs/subnet/AZ placement.

Incorrect Answers

Answer A is incorrect because Segmented route tables keep large transit networks manageable and prevent every attachment from learning every route unnecessarily. It may be useful elsewhere, but it does not meet the decisive requirement here: endpoint ENIs/subnet/AZ placement.

Answer B is incorrect because The load balancer cannot compensate for an undersized or uneven backend fleet once individual targets are saturated. It may be useful elsewhere, but it does not meet the decisive requirement here: endpoint ENIs/subnet/AZ placement.

Answer D is incorrect because Dedicated connectivity must be capacity-planned for projected traffic and resilience rather than assumed to scale without bounds. It may be useful elsewhere, but it does not meet the decisive requirement here: endpoint ENIs/subnet/AZ placement.

Answer E is incorrect because A path already at its measured throughput ceiling needs more transport capacity or a different connectivity service. It may be useful elsewhere, but it does not meet the decisive requirement here: endpoint ENIs/subnet/AZ placement.

 

Question 30

A Transit Gateway connects many business units that must remain in separate routing domains. Which scaling practice prevents one flat route domain from growing without control?

1. Scale target capacity and verify load distribution across healthy targets.
2. Increase available VPN capacity or move sustained high-volume traffic to Direct Connect when requirements justify it.
3. Increase Direct Connect bandwidth and design redundant connections/locations as required.
4. Use Transit Gateway route tables and controlled route propagation to maintain separate scalable routing domains.
5. Design interface endpoint capacity and AZ/subnet placement for the client population.

Correct Answer: D

 

Correct Answer

Answer D is correct because Segmented route tables keep large transit networks manageable and prevent every attachment from learning every route unnecessarily. This directly meets the decisive requirement: multiple TGW route tables/controlled propagation.

Incorrect Answers

Answer A is incorrect because The load balancer cannot compensate for an undersized or uneven backend fleet once individual targets are saturated. It may be useful elsewhere, but it does not meet the decisive requirement here: multiple TGW route tables/controlled propagation.

Answer B is incorrect because A path already at its measured throughput ceiling needs more transport capacity or a different connectivity service. It may be useful elsewhere, but it does not meet the decisive requirement here: multiple TGW route tables/controlled propagation.

Answer C is incorrect because Dedicated connectivity must be capacity-planned for projected traffic and resilience rather than assumed to scale without bounds. It may be useful elsewhere, but it does not meet the decisive requirement here: multiple TGW route tables/controlled propagation.

Answer E is incorrect because PrivateLink connectivity depends on endpoint ENIs and DNS/AZ placement, so endpoint topology must scale with usage. It may be useful elsewhere, but it does not meet the decisive requirement here: multiple TGW route tables/controlled propagation.

 

Question 31

Return traffic from a stateful appliance follows a different path than the forward traffic and sessions fail intermittently. Which network issue should be investigated?

1. Inspect DNS records, TTLs, resolver caches, and routing-policy health evaluation.
2. Simplify routing to remove unnecessary transit hops while preserving required controls.
3. Check path MTU, fragmentation behavior, and tunnel overhead.
4. Correct asymmetric routing so stateful traffic uses a compatible symmetric path through the appliance.
5. Increase link capacity or reduce traffic because the connection is saturated.

Correct Answer: D

 

Correct Answer

Answer D is correct because Stateful devices can drop return traffic when the reverse path bypasses the state that was created on the forward path. This directly meets the decisive requirement: asymmetric routing.

Incorrect Answers

Answer A is incorrect because DNS caching or policy can keep clients using an unexpected endpoint after authoritative changes. It may be useful elsewhere, but it does not meet the decisive requirement here: asymmetric routing.

Answer B is incorrect because Extra hops add latency and failure dependencies without benefit when no policy requires them. It may be useful elsewhere, but it does not meet the decisive requirement here: asymmetric routing.

Answer C is incorrect because Encapsulation can reduce effective MTU so large packets fail even when small probes succeed. It may be useful elsewhere, but it does not meet the decisive requirement here: asymmetric routing.

Answer E is incorrect because A path consistently near line rate can queue packets and increase latency even when endpoints have spare compute. It may be useful elsewhere, but it does not meet the decisive requirement here: asymmetric routing.

 

Question 32

Large packets fail across a VPN while small pings succeed. Which path property should be checked?

1. Increase link capacity or reduce traffic because the connection is saturated.
2. Check path MTU, fragmentation behavior, and tunnel overhead.
3. Inspect DNS records, TTLs, resolver caches, and routing-policy health evaluation.
4. Correct asymmetric routing so stateful traffic uses a compatible symmetric path through the appliance.
5. Simplify routing to remove unnecessary transit hops while preserving required controls.

Correct Answer: B

 

Correct Answer

Answer B is correct because Encapsulation can reduce effective MTU so large packets fail even when small probes succeed. This directly meets the decisive requirement: MTU/fragmentation.

Incorrect Answers

Answer A is incorrect because A path consistently near line rate can queue packets and increase latency even when endpoints have spare compute. It may be useful elsewhere, but it does not meet the decisive requirement here: MTU/fragmentation.

Answer C is incorrect because DNS caching or policy can keep clients using an unexpected endpoint after authoritative changes. It may be useful elsewhere, but it does not meet the decisive requirement here: MTU/fragmentation.

Answer D is incorrect because Stateful devices can drop return traffic when the reverse path bypasses the state that was created on the forward path. It may be useful elsewhere, but it does not meet the decisive requirement here: MTU/fragmentation.

Answer E is incorrect because Extra hops add latency and failure dependencies without benefit when no policy requires them. It may be useful elsewhere, but it does not meet the decisive requirement here: MTU/fragmentation.

 

Question 33

Users sometimes resolve an endpoint in a distant Region even after the intended DNS change. Which layer should be inspected?

1. Check path MTU, fragmentation behavior, and tunnel overhead.
2. Simplify routing to remove unnecessary transit hops while preserving required controls.
3. Correct asymmetric routing so stateful traffic uses a compatible symmetric path through the appliance.
4. Increase link capacity or reduce traffic because the connection is saturated.
5. Inspect DNS records, TTLs, resolver caches, and routing-policy health evaluation.

Correct Answer: E

 

Correct Answer

Answer E is correct because DNS caching or policy can keep clients using an unexpected endpoint after authoritative changes. This directly meets the decisive requirement: DNS resolution/caching.

Incorrect Answers

Answer A is incorrect because Encapsulation can reduce effective MTU so large packets fail even when small probes succeed. It may be useful elsewhere, but it does not meet the decisive requirement here: DNS resolution/caching.

Answer B is incorrect because Extra hops add latency and failure dependencies without benefit when no policy requires them. It may be useful elsewhere, but it does not meet the decisive requirement here: DNS resolution/caching.

Answer C is incorrect because Stateful devices can drop return traffic when the reverse path bypasses the state that was created on the forward path. It may be useful elsewhere, but it does not meet the decisive requirement here: DNS resolution/caching.

Answer D is incorrect because A path consistently near line rate can queue packets and increase latency even when endpoints have spare compute. It may be useful elsewhere, but it does not meet the decisive requirement here: DNS resolution/caching.

 

Question 34

A path between two VPCs traverses multiple unnecessary transit hops and latency is higher than expected. Which design issue should be corrected?

1. Increase link capacity or reduce traffic because the connection is saturated.
2. Correct asymmetric routing so stateful traffic uses a compatible symmetric path through the appliance.
3. Inspect DNS records, TTLs, resolver caches, and routing-policy health evaluation.
4. Check path MTU, fragmentation behavior, and tunnel overhead.
5. Simplify routing to remove unnecessary transit hops while preserving required controls.

Correct Answer: E

 

Correct Answer

Answer E is correct because Extra hops add latency and failure dependencies without benefit when no policy requires them. This directly meets the decisive requirement: route path simplification.

Incorrect Answers

Answer A is incorrect because A path consistently near line rate can queue packets and increase latency even when endpoints have spare compute. It may be useful elsewhere, but it does not meet the decisive requirement here: route path simplification.

Answer B is incorrect because Stateful devices can drop return traffic when the reverse path bypasses the state that was created on the forward path. It may be useful elsewhere, but it does not meet the decisive requirement here: route path simplification.

Answer C is incorrect because DNS caching or policy can keep clients using an unexpected endpoint after authoritative changes. It may be useful elsewhere, but it does not meet the decisive requirement here: route path simplification.

Answer D is incorrect because Encapsulation can reduce effective MTU so large packets fail even when small probes succeed. It may be useful elsewhere, but it does not meet the decisive requirement here: route path simplification.

 

Question 35

A Direct Connect link shows sustained utilization near line rate and application latency rises at the same time. Which bottleneck is most likely?

1. Inspect DNS records, TTLs, resolver caches, and routing-policy health evaluation.
2. Check path MTU, fragmentation behavior, and tunnel overhead.
3. Correct asymmetric routing so stateful traffic uses a compatible symmetric path through the appliance.
4. Simplify routing to remove unnecessary transit hops while preserving required controls.
5. Increase link capacity or reduce traffic because the connection is saturated.

Correct Answer: E

 

Correct Answer

Answer E is correct because A path consistently near line rate can queue packets and increase latency even when endpoints have spare compute. This directly meets the decisive requirement: congested network link.

Incorrect Answers

Answer A is incorrect because DNS caching or policy can keep clients using an unexpected endpoint after authoritative changes. It may be useful elsewhere, but it does not meet the decisive requirement here: congested network link.

Answer B is incorrect because Encapsulation can reduce effective MTU so large packets fail even when small probes succeed. It may be useful elsewhere, but it does not meet the decisive requirement here: congested network link.

Answer C is incorrect because Stateful devices can drop return traffic when the reverse path bypasses the state that was created on the forward path. It may be useful elsewhere, but it does not meet the decisive requirement here: congested network link.

Answer D is incorrect because Extra hops add latency and failure dependencies without benefit when no policy requires them. It may be useful elsewhere, but it does not meet the decisive requirement here: congested network link.