Question 280
A large AWS footprint uses a fully meshed set of VPC peers and spends significant operational effort updating links when adding new VPCs. Which topology improves manageability?
- Compare VPC peering's simpler path with TGW processing and cross-AZ transfer charges
- Deploy NAT gateways per required AZ and route each private subnet to its local NAT gateway
- Evaluate PrivateLink endpoint-hour and data-processing charges against peering and transit alternatives
- Use a direct VPC peering connection for the high-volume path
- Consolidate connectivity through Transit Gateway where central routing economics and requirements fit
Explanation
Correct Answer
E:A hub reduces growth in pairwise peering relationships and centralizes route control at the expense of transit processing charges.
Incorrect Answers
A:Avoiding unnecessary transit hops may lower processing cost, but full connectivity and segmentation requirements must still be satisfied; that addresses connection-topology optimization for internal data movement, rather than reduction of peer-mesh operational complexity.
B:Zonal NAT egress reduces dependency on one AZ and avoids unnecessary cross-AZ traversal for IPv4 Internet-bound traffic; this belongs to resilient and zonally local outbound NAT routing, while the problem is reduction of peer-mesh operational complexity.
C:Service-private connectivity has operational isolation benefits but different billing drivers than full VPC routed connectivity; this changes economical selection of private service versus network connectivity, not the necessary reduction of peer-mesh operational complexity.
D:In the minimizing unnecessary transit data-processing costs workflow, direct peering avoids routing through a charged transit hop, although it requires explicit peer administration and subnet routing; the current case needs reduction of peer-mesh operational complexity.
Question 281
Two tightly integrated nonoverlapping VPCs exchange very large data volumes, and the company wants to avoid TGW per-GB transit processing for just that pair. What option merits evaluation?
- Use a direct VPC peering connection for the high-volume path
- Consolidate connectivity through Transit Gateway where central routing economics and requirements fit
- Compare VPC peering's simpler path with TGW processing and cross-AZ transfer charges
- Account for port or connection charges, carrier costs, data transfer, and utilization for each connectivity model
Explanation
Correct Answer
A:Direct peering avoids routing through a charged transit hop, although it requires explicit peer administration and subnet routing.
Incorrect Answers
B:A hub reduces growth in pairwise peering relationships and centralizes route control at the expense of transit processing charges; this belongs to reduction of peer-mesh operational complexity, while the problem is minimizing unnecessary transit data-processing costs.
C:Avoiding unnecessary transit hops may lower processing cost, but full connectivity and segmentation requirements must still be satisfied; this changes connection-topology optimization for internal data movement, not the necessary minimizing unnecessary transit data-processing costs.
D:In the full-cost evaluation of dedicated versus Internet hybrid access workflow, A dedicated circuit's economic fit depends on recurring transport fees and traffic profile, not just whether both paths are technically possible; the current case needs minimizing unnecessary transit data-processing costs.
Question 282
A team plans to add more EC2 instances to an Auto Scaling group, but there are only four free addresses in its subnet. What should it change?
- Add or expand usable subnet address capacity before increasing desired capacity
- Add a nonoverlapping secondary VPC CIDR and create new subnets from it
- Enable Elastic Fabric Adapter on compatible HPC instances and workloads
- Configure a Network Load Balancer with compatible IP targets
Explanation
Correct Answer
A:An Auto Scaling group cannot attach new instances to a subnet lacking sufficient assignable private addresses.
Incorrect Answers
B:Additional IPv4 CIDR space extends the VPC's usable addressing without renumbering existing subnets; this belongs to expanding a VPC after initial address exhaustion, while the problem is IP headroom for horizontal scaling.
C:EFA provides OS-bypass-capable network performance suited to tightly coupled HPC communication, beyond ordinary ENA networking; this changes low-latency inter-instance HPC communication, not the necessary IP headroom for horizontal scaling.
D:In the layer-four scaling with IP-registered appliances workflow, NLB provides a stable transport entry point while directing connections to eligible private-address targets; the current case needs IP headroom for horizontal scaling.
Question 283
A VPC's original /24 is full, but it must keep its address range while new workloads deploy. Which VPC capability should be used?
- Add or expand usable subnet address capacity before increasing desired capacity
- Configure a Network Load Balancer with compatible IP targets
- Size VPC subnets for ENI secondary-IP and container networking allocation patterns
- Add a nonoverlapping secondary VPC CIDR and create new subnets from it
Explanation
Correct Answer
D:Additional IPv4 CIDR space extends the VPC's usable addressing without renumbering existing subnets. The added CIDR must not overlap connected networks, and additional appropriately sized subnets are needed to use the new space.
Incorrect Answers
A:An Auto Scaling group cannot attach new instances to a subnet lacking sufficient assignable private addresses; that addresses IP headroom for horizontal scaling, rather than expanding a VPC after initial address exhaustion.
B:NLB provides a stable transport entry point while directing connections to eligible private-address targets; this belongs to layer-four scaling with IP-registered appliances, while the problem is expanding a VPC after initial address exhaustion.
C:Container networking can consume substantial address space per host or workload, making subnet sizing central to scale; this changes addressing capacity for container pod or task growth, not the necessary expanding a VPC after initial address exhaustion.
Question 284
A mobile app must access a non-HTTP service across continents with consistent anycast IP entry points. Which performance feature helps?
- Configure a Network Load Balancer with compatible IP targets
- Use Global Accelerator for the supported TCP or UDP application endpoints
- Use Route 53 latency routing with appropriate endpoint health evaluation
- Use IPv6 addresses and an egress-only internet gateway for outbound-only access
Explanation
Correct Answer
B:The global anycast ingress moves the user traffic onto AWS networking near the edge and preserves consistent public endpoint addresses.
Incorrect Answers
A:NLB provides a stable transport entry point while directing connections to eligible private-address targets; that addresses layer-four scaling with IP-registered appliances, rather than improved global transport path for interactive non-HTTP traffic.
C:Latency records select among regional deployments while health information prevents choosing an ineligible endpoint; this changes resilient low-latency regional DNS selection, not the necessary improved global transport path for interactive non-HTTP traffic.
D:In the removing unnecessary IPv4 NAT from suitable outbound workloads workflow, native IPv6 provides globally routable addresses without IPv4 translation, while the egress-only gateway denies new inbound connections; the current case needs improved global transport path for interactive non-HTTP traffic.
Question 285
A DNS name fronts several independently health-checked IP endpoints. Operators want DNS answers to include a rotating set of multiple healthy addresses rather than just a single preferred Region. Which Route 53 policy should be used?
- Configure Route 53 multivalue answer records with suitable health checks
- Use only weighted routing so the DNS response always contains all healthy endpoints
- Use latency-based routing to always select a single closest AWS Region
- Use a simple record with a fixed list of IP addresses and no health checks
Explanation
Correct Answer
A:Multivalue answer routing can return several eligible healthy records for one name, providing simple client-side distribution and omitting failed endpoints from the returned set. It is not a substitute for a load balancer.
Incorrect Answers
B:Weighted DNS routing selects a record based on relative weights; it does not promise several different healthy address records per answer.
C:Latency routing chooses a preferred latency profile among endpoints and is not the multivalue DNS policy requested.
D:A static address set can return failed endpoints because Route 53 has no per-record health information in this configuration.
Question 286
A private service must distribute traffic among IP-based backend appliances, with stable client-facing addresses. What component should be evaluated?
- Use Global Accelerator static anycast public addresses as the client entry point
- Evaluate PrivateLink endpoint-hour and data-processing charges against peering and transit alternatives
- Add or expand usable subnet address capacity before increasing desired capacity
- Use Transit Gateway multicast domain support where requirements and limitations permit
- Configure a Network Load Balancer with compatible IP targets
Explanation
Correct Answer
E:NLB provides a stable transport entry point while directing connections to eligible private-address targets. IP targets can represent approved private-address backends, but the NLB remains a transport-layer endpoint rather than an HTTP router.
Incorrect Answers
A:Accelerator front-end addresses are decoupled from regional deployment endpoints, supporting stable client firewall rules during destination changes; that addresses continuity of remote client IP allowlists, rather than layer-four scaling with IP-registered appliances.
B:Service-private connectivity has operational isolation benefits but different billing drivers than full VPC routed connectivity; this belongs to economical selection of private service versus network connectivity, while the problem is layer-four scaling with IP-registered appliances.
C:An Auto Scaling group cannot attach new instances to a subnet lacking sufficient assignable private addresses; this changes IP headroom for horizontal scaling, not the necessary layer-four scaling with IP-registered appliances.
D:In the supported IP multicast distribution in AWS VPC networking workflow, TGW multicast domains provide managed multicast group connectivity for supported VPC attachments rather than relying on conventional unicast forwarding; the current case needs layer-four scaling with IP-registered appliances.
Question 287
An east-west data path passes through two TGW gateways though the VPCs are in one Region and could peer directly. What should a cost review consider?
- Use a direct VPC peering connection for the high-volume path
- Evaluate PrivateLink endpoint-hour and data-processing charges against peering and transit alternatives
- Evaluate zonal target distribution and cross-zone load balancing settings against resilience needs
- Compare VPC peering's simpler path with TGW processing and cross-AZ transfer charges
Explanation
Correct Answer
D:Avoiding unnecessary transit hops may lower processing cost, but full connectivity and segmentation requirements must still be satisfied.
Incorrect Answers
A:Direct peering avoids routing through a charged transit hop, although it requires explicit peer administration and subnet routing; that addresses minimizing unnecessary transit data-processing costs, rather than connection-topology optimization for internal data movement.
B:Service-private connectivity has operational isolation benefits but different billing drivers than full VPC routed connectivity; this belongs to economical selection of private service versus network connectivity, while the problem is connection-topology optimization for internal data movement.
C:Localizing eligible backend selection can lower cross-AZ traffic in suitable designs, but affects balance and availability behavior; this changes balancing zonal traffic cost against high availability, not the necessary connection-topology optimization for internal data movement.
Question 288
An organization receives multi-gigabyte uploads from remote customers on several continents into one Amazon S3 general purpose bucket. Its current direct regional uploads are slow over long international paths. Which optional feature should be trialed, while measuring its extra charges?
- Add an S3 gateway VPC endpoint to a subnet in the application Region
- Increase the NAT gateway count in the AWS application VPC to one per AZ
- Replace the S3 upload hostname with an EC2 public IPv4 address in the bucket Region
- Enable S3 Transfer Acceleration and use the bucket’s s3-accelerate upload endpoint
Explanation
Correct Answer
D:S3 Transfer Acceleration uses AWS global edge locations and optimized AWS network paths for eligible long-distance transfers into S3 general purpose buckets. Benchmark improvement against additional transfer charges.
Incorrect Answers
A:A gateway VPC endpoint serves workloads located in associated VPC subnet route tables. It does not accelerate uploads made by geographically distant internet customers to a public S3 endpoint.
B:Zonal NAT gateways improve local VPC egress resilience and may reduce cross-AZ transfers. They do not shorten the wide-area upload path from external clients on other continents.
C:An EC2 public IPv4 address is not an Amazon S3 bucket upload endpoint. Redirecting clients to one instance would add an origin bottleneck instead of providing global edge transport.
Question 289
An endpoint service receives large amounts of internal traffic from multiple consumer VPCs. What should be considered when comparing endpoint designs?
- Add an Amazon S3 gateway endpoint to the workload's effective route tables
- Use a direct VPC peering connection for the high-volume path
- Consolidate connectivity through Transit Gateway where central routing economics and requirements fit
- Evaluate PrivateLink endpoint-hour and data-processing charges against peering and transit alternatives
Explanation
Correct Answer
D:Service-private connectivity has operational isolation benefits but different billing drivers than full VPC routed connectivity.
Incorrect Answers
A:Gateway endpoint routes keep eligible S3 access within the AWS network and avoid the NAT gateway processing path; that addresses S3 transfer path bypassing public NAT egress, rather than economical selection of private service versus network connectivity.
B:Direct peering avoids routing through a charged transit hop, although it requires explicit peer administration and subnet routing; this belongs to minimizing unnecessary transit data-processing costs, while the problem is economical selection of private service versus network connectivity.
C:A hub reduces growth in pairwise peering relationships and centralizes route control at the expense of transit processing charges; this changes reduction of peer-mesh operational complexity, not the necessary economical selection of private service versus network connectivity.
Question 290
An organization wants high availability when scaling a load-balanced app across AZs. What target placement is essential?
- Evaluate PrivateLink endpoint-hour and data-processing charges against peering and transit alternatives
- Register healthy targets across multiple enabled Availability Zones
- Deploy NAT gateways per required AZ and route each private subnet to its local NAT gateway
- Evaluate zonal target distribution and cross-zone load balancing settings against resilience needs
Explanation
Correct Answer
B:Multi-AZ target distribution keeps alternative serving capacity when one zone or its target fleet fails. Spreading targets without ensuring sufficient per-zone healthy capacity is not enough for reliable zonal loss recovery.
Incorrect Answers
A:Service-private connectivity has operational isolation benefits but different billing drivers than full VPC routed connectivity; that addresses economical selection of private service versus network connectivity, rather than zonal resilience of load-balanced backend fleets.
C:Zonal NAT egress reduces dependency on one AZ and avoids unnecessary cross-AZ traversal for IPv4 Internet-bound traffic; this changes resilient and zonally local outbound NAT routing, not the necessary zonal resilience of load-balanced backend fleets.
D:In the balancing zonal traffic cost against high availability workflow, localizing eligible backend selection can lower cross-AZ traffic in suitable designs, but affects balance and availability behavior; the current case needs zonal resilience of load-balanced backend fleets.