A company recently announced the deployment of its retail website to a global audience. The website runs on multiple Amazon EC2 instances behind an Elastic Load Balancer. The instances run in an Auto Scaling group across multiple Availability Zones.The company wants to provide its customers with different versions of content based on the devices that the customers use to access the website.Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
Answer(s): A,C
Caching and edge logic are used to serve device-specific content globally.A) Correct: CloudFront can cache multiple versions of content and, with cache policies and origin configurations, deliver device- or User-Agent-specific objects, reducing latency for a global audience.C) Correct: Lambda@Edge can inspect the User-Agent header and route or tailor responses (e.g., send specific objects) at the edge, enabling device-aware content delivery without backhaul.B) Incorrect: Host header on NLB does not support path/device-based routing to EC2 instances; NLB operates at layer 4 and lacks content-aware routing.D/E) Incorrect: Global Accelerator+NLB can improve availability but does not natively provide per-device content variants via host/path-based routing at the edge; Lambda@Edge/CloudFront already cover this.
A company plans to use Amazon ElastiCache for its multi-tier web application. A solutions architect creates a Cache VPC for the ElastiCache cluster and an App VPC for the application’s Amazon EC2 instances. Both VPCs are in the us-east-1 Region.The solutions architect must implement a solution to provide the application’s EC2 instances with access to the ElastiCache cluster.Which solution will meet these requirements MOST cost-effectively?
Answer(s): A
A) A VPC peering connection with route table updates and proper security group rules is the most cost-effective, direct, and low-latency method for cross-VPC access within the same region, suitable for ElastiCache and EC2 in us-east-1.B) Transit VPC adds unnecessary cost and complexity for two VPCs in the same region; not cost-efficient for this simple use case.C) Peering requires correct security group referencing of the peering connection, which is not a distinct security group entity; the configuration is via security group rules, not a “peering security group.”D) Transit VPC is overkill here and introduces extra hops and cost without added security or functionality benefits for this scenario.
A company is building an application that consists of several microservices. The company has decided to use container technologies to deploy its software on AWS. The company needs a solution that minimizes the amount of ongoing effort for maintenance and scaling. The company cannot manage additional infrastructure.Which combination of actions should a solutions architect take to meet these requirements? (Choose two.)
Answer(s): A,D
Using ECS with Fargate minimizes maintenance and scaling effort because AWS manages the infrastructure and you can run containers without provisioning servers. ECS on Fargate (D) satisfies the requirement of zero infrastructure management and supports multiple replicas for scalability.A) ECS cluster deployment is necessary, but on its own does not specify a serverless, fully managed execution environment; you still manage EC2 instances if not using Fargate, increasing maintenance.B) Kubernetes control plane on EC2 is managed by EKS, not ECS, and requires more maintenance; it does not meet “cannot manage additional infrastructure.”C) ECS with EC2 launch type requires managing the underlying EC2 instances and scaling, increasing maintenance.E) Kubernetes worker nodes and replicas imply Kubernetes management, which adds operational overhead not aligned with minimal maintenance.
A company has a web application hosted over 10 Amazon EC2 instances with traffic directed by Amazon Route 53. The company occasionally experiences a timeout error when attempting to browse the application. The networking team finds that some DNS queries return IP addresses of unhealthy instances, resulting in the timeout error.What should a solutions architect implement to overcome these timeout errors?
Answer(s): D
Route 53 should route traffic to a single, highly available endpoint that can perform health checks and direct traffic away from unhealthy instances. ALB provides built-in health checks, distributes traffic across healthy EC2 instances, and Route 53 can point to the ALB domain, ensuring users are not directed to unhealthy instances.A) Simple routing with per-instance records lacks centralized health management; DNS-level checks don’t inherently prevent sending users to unhealthy instances.B) Failover routing isn’t appropriate for load-balanced EC2 pools; it’s for primary/secondary failover, not dynamic health-based distribution.C) CloudFront adds a cache layer but isn’t required when ALB already handles health-aware routing to instances.D) Correct: ALB with health checks in front of instances, Route 53 targets the ALB.
A solutions architect needs to design a highly available application consisting of web, application, and database tiers. HTTPS content delivery should be as close to the edge as possible, with the least delivery time.Which solution meets these requirements and is MOST secure?
Answer(s): C
Correct answer: CCloudFront should be positioned in front of a private subnet ALB to minimize latency to edge locations while maintaining security via private subnets and the ALB in a VPC with restricted access. Public ALB in private subnets is not valid for public access; the ALB must be reachable via CloudFront, and the backend instances should reside in private subnets behind the ALB.A and D place EC2 in public subnets, increasing exposure and reducing security. B uses EC2 as origin, which is less favorable for edge delivery; using an ALB as origin with CloudFront provides better security, TLS termination at edge, and caching.
Post your Comments and Discuss Amazon SAA-C03 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SAA-C03 content, but please register or login to continue.