Question 10
A global game lobby uses UDP and requires improved internet ingress latency without altering its protocol. Which AWS edge service is most suitable?
- Deploy a Lambda@Edge function for a supported event that needs network access
- Adjust Global Accelerator endpoint weights in the endpoint groups
- Place the UDP service behind a Global Accelerator listener with supported regional endpoints
- Create an AWS Global Accelerator standard accelerator with TCP listeners and regional endpoint groups
Explanation
Correct Answer
C:Global Accelerator accepts UDP flows at edge locations and transports them over AWS networking toward application endpoints.
Incorrect Answers
A:Lambda@Edge supports more complex edge logic and network-access use cases than the restricted CloudFront Functions runtime; that addresses edge function logic requiring external network calls, rather than global acceleration of UDP sessions.
B:Accelerator weights influence how a region's traffic is distributed among eligible endpoints without introducing an HTTP cache; this belongs to policy-based distribution of global network ingress, while the problem is global acceleration of UDP sessions.
D:In the static anycast access for a non-HTTP application workflow, global Accelerator supplies static anycast addresses and steers TCP traffic across the AWS global network to healthy application endpoints; the current case needs global acceleration of UDP sessions.
Question 11
An interactive HTTP application needs custom logic to manipulate headers at CloudFront viewer-request time without deploying regional EC2 proxies. Which programmable edge mechanism fits lightweight code?
- Use a CloudFront Function on the viewer-request event
- Choose the CloudFront viewer protocol policy Redirect HTTP to HTTPS
- Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate
- Deploy a Lambda@Edge function for a supported event that needs network access
Explanation
Correct Answer
A:CloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events.
Incorrect Answers
B:The viewer protocol policy controls client-to-edge connections and can issue an HTTPS redirect before origin processing; this belongs to client-side transport upgrade at the CDN, while the problem is lightweight viewer-event header processing at CDN edge.
C:The origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic; this changes TLS protection for both CloudFront connection segments, not the necessary lightweight viewer-event header processing at CDN edge.
D:In the edge function logic requiring external network calls workflow, lambda@Edge supports more complex edge logic and network-access use cases than the restricted CloudFront Functions runtime; the current case needs lightweight viewer-event header processing at CDN edge.
Question 12
A legacy edge application requires outbound calls from its request-processing logic to an external authorization service. Which CloudFront compute option is appropriate?
- Use CloudFront signed cookies with an appropriate trusted signer or key group
- Place the UDP service behind a Global Accelerator listener with supported regional endpoints
- Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate
- Use a CloudFront Function on the viewer-request event
- Deploy a Lambda@Edge function for a supported event that needs network access
Explanation
Correct Answer
E:Lambda@Edge supports more complex edge logic and network-access use cases than the restricted CloudFront Functions runtime.
Incorrect Answers
A:Signed cookies authorize groups of objects without generating a distinct signed URL for every requested segment; that addresses authorization covering multiple restricted cached objects, rather than edge function logic requiring external network calls.
B:Global Accelerator accepts UDP flows at edge locations and transports them over AWS networking toward application endpoints; this belongs to global acceleration of UDP sessions, while the problem is edge function logic requiring external network calls.
C:The origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic; this changes TLS protection for both CloudFront connection segments, not the necessary edge function logic requiring external network calls.
D:In the lightweight viewer-event header processing at CDN edge workflow, cloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events; the current case needs edge function logic requiring external network calls.
Question 13
A marketing campaign expects request rates to spike for the same origin API response. Which CloudFront behavior would reduce duplicate simultaneous origin fetches?
- Include the response-varying header in the CloudFront cache policy's cache key
- Use CloudFront origin access control and a bucket policy allowing the distribution
- Use a CloudFront Function on the viewer-request event
- Use CloudFront origin request collapsing through an effective cache policy
Explanation
Correct Answer
D:Eligible simultaneous misses for a cacheable object can be consolidated before requests reach an origin, reducing repetitive fetches.
Incorrect Answers
A:The cache key must distinguish requests whose selected headers alter origin content, preventing incorrect reuse between those requests; that addresses accurate cache partitioning by an origin-varying request header, rather than fewer duplicate origin requests for hot cached responses.
B:Origin access control signs CloudFront requests to S3, so the bucket can stay private while edge delivery succeeds; this belongs to private S3 content delivery through CloudFront, while the problem is fewer duplicate origin requests for hot cached responses.
C:CloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events; this changes lightweight viewer-event header processing at CDN edge, not the necessary fewer duplicate origin requests for hot cached responses.
Question 14
A global application must keep a fixed pair of ingress IP addresses during a migration from one regional Network Load Balancer to another. Which feature solves the IP continuity requirement?
- Create an AWS Global Accelerator standard accelerator with TCP listeners and regional endpoint groups
- Place the UDP service behind a Global Accelerator listener with supported regional endpoints
- Preserve the Global Accelerator static IP addresses and update accelerator endpoints
- Adjust Global Accelerator endpoint weights in the endpoint groups
Explanation
Correct Answer
C:Clients continue targeting fixed anycast addresses while the accelerator's endpoint configuration controls destination changes.
Incorrect Answers
A:Global Accelerator supplies static anycast addresses and steers TCP traffic across the AWS global network to healthy application endpoints; that addresses static anycast access for a non-HTTP application, rather than client-IP stability during regional backend migration.
B:Global Accelerator accepts UDP flows at edge locations and transports them over AWS networking toward application endpoints; this belongs to global acceleration of UDP sessions, while the problem is client-IP stability during regional backend migration.
D:In the policy-based distribution of global network ingress workflow, accelerator weights influence how a region's traffic is distributed among eligible endpoints without introducing an HTTP cache; the current case needs client-IP stability during regional backend migration.
Question 15
An existing CloudFront distribution must deliver privately stored S3 media without exposing the bucket, while requests made over HTTP must be upgraded before content delivery. Which TWO configurations address these distinct requirements? Choose TWO.
- Put an Amazon CloudFront distribution in front of the image origin and set suitable cache behavior
- Choose the CloudFront viewer protocol policy Redirect HTTP to HTTPS
- Submit a CloudFront invalidation for the affected object path
- Use a CloudFront Function on the viewer-request event
- Use CloudFront origin access control and a bucket policy allowing the distribution
Explanation
Correct Answers
B:The viewer protocol policy controls client-to-edge connections and can issue an HTTPS redirect before origin processing; this covers the client-side transport upgrade at the CDN component of the combined scenario.
E:Origin access control signs CloudFront requests to S3, so the bucket can stay private while edge delivery succeeds; this covers the private S3 content delivery through CloudFront component of the combined scenario.
Incorrect Answers
A:CloudFront serves cacheable HTTP objects from edge locations, reducing origin requests and long-distance round trips; that addresses edge caching of HTTP objects, rather than private S3 CloudFront origin access and viewer HTTPS redirect.
C:Invalidation causes CloudFront to remove matching cached representations so the origin's updated notice can be fetched on subsequent requests; this changes prompt eviction of a specific stale CDN object, not the necessary private S3 CloudFront origin access and viewer HTTPS redirect.
D:In the lightweight viewer-event header processing at CDN edge workflow, cloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events; the current case needs private S3 CloudFront origin access and viewer HTTPS redirect.
Question 16
A company wants existing web users redirected from HTTP to HTTPS at the CDN edge without changing origin application code. Which setting should be used?
- Use a CloudFront Function on the viewer-request event
- Set the custom origin protocol policy to HTTPS only and provide a valid origin TLS certificate
- Adjust Global Accelerator endpoint weights in the endpoint groups
- Choose the CloudFront viewer protocol policy Redirect HTTP to HTTPS
Explanation
Correct Answer
D:The viewer protocol policy controls client-to-edge connections and can issue an HTTPS redirect before origin processing.
Incorrect Answers
A:CloudFront Functions execute lightweight JavaScript at CloudFront edge locations for request or response transformations in supported events; that addresses lightweight viewer-event header processing at CDN edge, rather than client-side transport upgrade at the CDN.
B:The origin connection policy determines whether CloudFront uses TLS on the second hop; viewer HTTPS alone does not encrypt CloudFront-to-origin traffic; this belongs to TLS protection for both CloudFront connection segments, while the problem is client-side transport upgrade at the CDN.
C:Accelerator weights influence how a region's traffic is distributed among eligible endpoints without introducing an HTTP cache; this changes policy-based distribution of global network ingress, not the necessary client-side transport upgrade at the CDN.
Question 17
CloudFront should compress eligible text assets for browsers that advertise supported compression algorithms. What configuration minimizes bandwidth?
- Enable automatic compression in the CloudFront cache behavior
- Publish the changed file under a versioned object name and reference that name in the application
- Include the response-varying header in the CloudFront cache policy's cache key
- Use CloudFront origin request collapsing through an effective cache policy
Explanation
Correct Answer
A:CloudFront can deliver supported compressed object variants based on viewer capabilities, reducing payload transfer for compressible types.
Incorrect Answers
B:A new object path uses a new CloudFront cache key and avoids forcing frequent invalidations of otherwise reusable content; this belongs to deterministic publication of new cached asset versions, while the problem is automatic browser-compatible CDN compression.
C:The cache key must distinguish requests whose selected headers alter origin content, preventing incorrect reuse between those requests; this changes accurate cache partitioning by an origin-varying request header, not the necessary automatic browser-compatible CDN compression.
D:In the fewer duplicate origin requests for hot cached responses workflow, eligible simultaneous misses for a cacheable object can be consolidated before requests reach an origin, reducing repetitive fetches; the current case needs automatic browser-compatible CDN compression.
Question 18
An existing Global Accelerator endpoint group has two healthy application endpoints, but operations must send about 70% of the group traffic to the first and 30% to the second. Which control should be changed?
- Adjust Global Accelerator endpoint weights in the endpoint groups
- Preserve the Global Accelerator static IP addresses and update accelerator endpoints
- Create an AWS Global Accelerator standard accelerator with TCP listeners and regional endpoint groups
- Configure Global Accelerator endpoint health and endpoint-group traffic dials
- Place the UDP service behind a Global Accelerator listener with supported regional endpoints
Explanation
Correct Answer
A:Accelerator weights influence how a region's traffic is distributed among eligible endpoints without introducing an HTTP cache.
Incorrect Answers
B:Clients continue targeting fixed anycast addresses while the accelerator's endpoint configuration controls destination changes; this belongs to client-IP stability during regional backend migration, while the problem is policy-based distribution of global network ingress.
C:Global Accelerator supplies static anycast addresses and steers TCP traffic across the AWS global network to healthy application endpoints; this changes static anycast access for a non-HTTP application, not the necessary policy-based distribution of global network ingress.
D:In the network-layer health-aware global regional routing workflow, accelerator continuously uses endpoint health for failover and endpoint-group traffic dials to adjust the proportion of traffic offered to regional groups; the current case needs policy-based distribution of global network ingress.
E:This produces global acceleration of UDP sessions: Global Accelerator accepts UDP flows at edge locations and transports them over AWS networking toward application endpoints; the stem instead tests policy-based distribution of global network ingress.
Question 19
An external DNS zone must direct `portal.example.net` to an Application Load Balancer without managing the balancer's changing IP addresses. Which record is appropriate?
- Create a Route 53 alias A record targeting the Application Load Balancer
- Publish an AAAA record for the service hostname
- Add an NS delegation record set for the child zone's authoritative name servers
- Deploy a Resolver inbound endpoint and configure on-premises conditional forwarding to its IPs
Explanation
Correct Answer
A:Alias records can target supported AWS resources and resolve their current addresses without hardcoding balancer IPs.
Incorrect Answers
B:AAAA record data contains IPv6 addresses; A records contain IPv4 addresses and cannot substitute an IPv6 response; this belongs to DNS mapping of a host name to an IPv6 address, while the problem is stable DNS mapping to an AWS-managed load balancer.
C:NS delegation informs resolvers which authoritative servers control the delegated subdomain's records; this changes delegation of child DNS authority, not the necessary stable DNS mapping to an AWS-managed load balancer.
D:In the resolving AWS private-zone names from external DNS infrastructure workflow, the inbound endpoint accepts recursive DNS requests from connected external resolvers and resolves using the VPC's DNS context; the current case needs stable DNS mapping to an AWS-managed load balancer.
Question 20
Two healthy web regions should get traffic based on measured latency from DNS resolvers, not geographic country boundaries. Which Route 53 routing policy fits?
- Use geoproximity routing with traffic bias values
- Create latency-based records for each regional endpoint
- Configure geolocation routing records with country-specific rules and a default record
- Define Route 53 failover records with primary and secondary roles and appropriate health evaluation
Explanation
Correct Answer
B:Latency routing uses AWS measurements to choose the record associated with the lower-latency AWS Region for a query.
Incorrect Answers
A:Geoproximity policies alter the area from which an endpoint attracts DNS traffic, enabling deliberate regional traffic-shaping; that addresses geographical attraction controlled by traffic bias, rather than DNS region selection based on estimated network latency.
C:Geolocation routing selects responses from location mappings, with a default for clients not matching a specified geography; this changes country-based DNS steering, not the necessary DNS region selection based on estimated network latency.
D:In the active-passive authoritative DNS failover workflow, failover policies prefer the primary while healthy and can provide the secondary record when the primary fails its health condition; the current case needs DNS region selection based on estimated network latency.