Design Secure Architectures
Targeted SAA-C03 practice for this exam objective, with an explanation for every answer option.
- Certification
- SAA-C03
- Domain
- Design Secure Architectures
- Questions
- 10
Practice SAA-C03 Design Secure Architectures questions with exam-style scenarios, detailed explanations, and option-by-option rationale for this domain.
Example question from this objective
Each option is explained, so the reasoning behind the distractors is part of the answer.
A provider VPC exposes one HTTPS analytics service through a Network Load Balancer. Fifteen consumer VPCs in several accounts need consumer-initiated private access only to that service. Several consumer CIDR ranges overlap the provider and each other, and the company does not want general network routing between VPCs. Which design best meets these requirements?
- Publish the Network Load Balancer as a PrivateLink endpoint service and create an interface endpoint in each consumer VPC.
- Share a Transit Gateway with every account, attach all consumer and provider VPCs, and propagate their CIDR routes.
- Associate a Route 53 private hosted zone with every consumer VPC and resolve the Network Load Balancer's private name.
- Create a VPC peering connection from each consumer VPC to the provider VPC and add routes for the service.
Publish the Network Load Balancer as a PrivateLink endpoint service and create an interface endpoint in each consumer VPC. — The provider can publish the Network Load Balancer as an endpoint service. Each consumer creates an interface endpoint with private addresses in its own VPC, so clients reach only the service without general VPC routing. This model works across accounts and avoids the overlapping-CIDR conflict.
Share a Transit Gateway with every account, attach all consumer and provider VPCs, and propagate their CIDR routes. — Transit Gateway is appropriate for centralized many-to-many IP routing across accounts. Here the consumers require only one provider service, and their overlapping CIDR ranges cannot be propagated as a routable Transit Gateway topology.
Associate a Route 53 private hosted zone with every consumer VPC and resolve the Network Load Balancer's private name. — Route 53 private hosted zones can present a consistent internal name across associated VPCs. DNS alone does not connect overlapping VPC networks or provide the endpoint network interfaces required to reach the provider service.
Create a VPC peering connection from each consumer VPC to the provider VPC and add routes for the service. — Peering is a valid low-latency design for private IP routing between two non-overlapping VPCs. It cannot be created for overlapping address ranges, and fifteen pairwise connections would expose network routes rather than only the analytics service.