Architecting on AWS Certification Architecting on AWS Certification Networking & Content Delivery 2 — Questions and Answers
Question 1: An architect is designing a multi-tier application and wants to ensure that database instances in the data tier are not directly accessible from the internet. What is the best approach?
- Place database instances in a public subnet with strict Security Groups
- Place database instances in a private subnet with no route to an Internet Gateway (Correct answer)
- Use NACLs to block port 3306 on the Internet Gateway
- Assign database instances Elastic IP addresses and restrict access via IAM
Correct answer: Place database instances in a private subnet with no route to an Internet Gateway
Placing database instances in a private subnet ensures there is no route to the Internet Gateway, making them inaccessible from the public internet by network design.
Question 2: A company wants to accelerate the transfer of large files to Amazon S3 from users worldwide. Which feature should be enabled?
- S3 Cross-Region Replication
- S3 Transfer Acceleration (Correct answer)
- CloudFront with S3 origin
- AWS Global Accelerator
Correct answer: S3 Transfer Acceleration
S3 Transfer Acceleration uses CloudFront's globally distributed edge locations to route uploads over optimized AWS network paths, significantly speeding up transfers from distant locations.
Question 3: Which Route 53 routing policy would you use to direct a small percentage of traffic to a new application version for testing while the majority continues to the existing version?
- Latency-based routing
- Failover routing
- Weighted routing (Correct answer)
- Geoproximity routing
Correct answer: Weighted routing
Weighted routing lets you assign numeric weights to resource record sets, allowing you to split traffic in any ratio — ideal for canary deployments or A/B testing.
Question 4: An application needs to distribute incoming TCP traffic across multiple EC2 instances and requires support for static IP addresses. Which load balancer type should be used?
- Application Load Balancer (ALB)
- Classic Load Balancer
- Network Load Balancer (NLB) (Correct answer)
- Gateway Load Balancer
Correct answer: Network Load Balancer (NLB)
Network Load Balancer operates at Layer 4, supports static and Elastic IP addresses, and handles millions of TCP requests per second with ultra-low latency.
Question 5: What is the maximum number of route tables that can be associated with a single subnet in a VPC?
- Two — one main and one custom
- Unlimited
- One (Correct answer)
- Four
Correct answer: One
Each subnet can be associated with only one route table at a time, though the same route table can be associated with multiple subnets.
Question 6: A solutions architect needs to implement DNS failover so that traffic is automatically rerouted to a healthy endpoint when the primary endpoint becomes unavailable. Which Route 53 feature enables this?
- Alias records
- Health checks with failover routing (Correct answer)
- Geolocation routing
- Traffic flow policies
Correct answer: Health checks with failover routing
Route 53 health checks continuously monitor endpoint health and, combined with failover routing policy, automatically route traffic to the secondary endpoint when the primary fails.
Question 7: Which VPC feature allows two VPCs to route traffic between each other using private IPv4 or IPv6 addresses, as if they were within the same network?
- VPC Endpoint
- VPC Peering (Correct answer)
- AWS Transit Gateway
- Internet Gateway
Correct answer: VPC Peering
VPC Peering creates a networking connection between two VPCs enabling instances to communicate using private IP addresses, but it is non-transitive and limited to two VPCs per connection.
Architecting on AWS Certification Architecting on AWS Certification Networking & Content Delivery 2
An architect is designing a multi-tier application and wants to ensure that database instances in the data tier are not directly accessible from the internet.
What is the best approach?