Architecting on AWS Certification Architecting on AWS Certification Networking & Content Delivery 1 — Questions and Answers
Question 1: A company needs to connect its on-premises data center to AWS with consistent, low-latency network performance. Which service should the architect recommend?
- AWS VPN
- AWS Direct Connect (Correct answer)
- Amazon CloudFront
- AWS Transit Gateway
Correct answer: AWS Direct Connect
AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, delivering consistent low-latency performance unlike VPN which traverses the public internet.
Question 2: Which VPC component controls inbound and outbound traffic at the subnet level and is stateless?
- Security Groups
- Internet Gateway
- Network Access Control Lists (NACLs) (Correct answer)
- Route Tables
Correct answer: Network Access Control Lists (NACLs)
NACLs are stateless subnet-level firewalls that evaluate both inbound and outbound rules independently, unlike Security Groups which are stateful.
Question 3: A solutions architect needs to route users to the nearest AWS edge location to reduce latency for a global web application. Which Route 53 routing policy should be used?
- Weighted routing
- Failover routing
- Latency-based routing (Correct answer)
- Geolocation routing
Correct answer: Latency-based routing
Latency-based routing directs users to the AWS region that provides the lowest network latency for their location, improving performance for global applications.
Question 4: An architect wants to enable instances in a private subnet to access the internet for software updates without exposing them to inbound internet traffic. What should be deployed?
- Internet Gateway attached to the private subnet
- NAT Gateway in a public subnet (Correct answer)
- VPC Endpoint for all services
- AWS Direct Connect
Correct answer: NAT Gateway in a public subnet
A NAT Gateway placed in a public subnet allows private subnet instances to initiate outbound internet connections while blocking unsolicited inbound connections.
Question 5: Which AWS service allows you to privately connect your VPC to supported AWS services without requiring an internet gateway, NAT device, or VPN connection?
- VPC Peering
- VPC Endpoints (Correct answer)
- AWS Transit Gateway
- AWS PrivateLink
Correct answer: VPC Endpoints
VPC Endpoints (both Gateway and Interface types) enable private connectivity between your VPC and AWS services without traffic leaving the Amazon network.
Question 6: A company has multiple VPCs that all need to communicate with each other and with an on-premises network. Which AWS service simplifies this hub-and-spoke network topology?
- VPC Peering
- AWS Direct Connect
- AWS Transit Gateway (Correct answer)
- Elastic Load Balancer
Correct answer: AWS Transit Gateway
AWS Transit Gateway acts as a central hub that connects multiple VPCs and on-premises networks, eliminating the complexity of managing multiple VPC peering connections.
Question 7: Which CloudFront feature allows an architect to serve different content to users based on the type of device they are using (mobile vs. desktop)?
- Lambda@Edge (Correct answer)
- CloudFront Origin Groups
- Cache Behaviors with query strings
- Signed URLs
Correct answer: Lambda@Edge
Lambda@Edge runs serverless functions at CloudFront edge locations and can inspect request headers (like User-Agent) to customize responses based on device type.
Architecting on AWS Certification Architecting on AWS Certification Networking & Content Delivery 1
A company needs to connect its on-premises data center to AWS with consistent, low-latency network performance.
Which service should the architect recommend?