AWS Certified SysOps Administrator – Associate

C. NAT Gateway

A NAT Gateway allows instances in a private subnet to connect to the internet while preventing the internet from initiating connections to those instances. It is deployed in a public subnet and routes traffic through an Internet Gateway.

A. Gateway Load Balancer (GWLB)

Gateway Load Balancer (GWLB) is specifically designed to deploy, scale, and manage virtual appliances such as firewalls, intrusion detection systems, and deep packet inspection systems. It acts as a transparent network gateway for all traffic, routing it through the appliance fleet before it reaches its destination (either the internet or other VPCs). This allows the third-party firewall to inspect all outbound traffic from the application instances.

A. Failover routing policy

The Failover routing policy in Route 53 allows you to route traffic to a resource when the primary resource is unhealthy. It requires associating health checks with records to automatically switch to a secondary endpoint if the primary fails.

C. AWS Transit Gateway

AWS Transit Gateway is designed for connecting multiple VPCs and on-premises networks in a hub-and-spoke model, supporting transitive routing. This means that resources in one VPC connected to the Transit Gateway can communicate with resources in another VPC connected to the same Transit Gateway, which is not possible with VPC Peering. Given the need for communication between multiple tiers across VPCs and transitive routing, Transit Gateway is the appropriate solution.

C. NAT Gateway and Route Table

A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for patches) but prevents the internet from initiating connections to those instances. A Route Table must be configured in the private subnet to direct outbound internet-bound traffic (0.0.0.0/0) to the NAT Gateway in a public subnet. This combination ensures secure outbound-only internet access.

D. Enhanced Networking with ENA

Enhanced Networking with Elastic Network Adapter (ENA) provides significantly higher packet per second (PPS) performance, lower inter-instance latency, and lower network jitter compared to traditional network interfaces. This is crucial for applications requiring very high throughput and low latency within a VPC and sensitive to jitter. While Jumbo Frames can help with throughput by reducing packet overhead, ENA provides the fundamental performance improvement.

D. VPC Endpoint

VPC Endpoints allow you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Specifically, Gateway Endpoints for S3 and Interface Endpoints for DynamoDB enable secure access from private subnets.

C. Listener Rules with Authentication Actions

ALB Listener Rules allow you to define actions based on various conditions, including path patterns. One of the powerful actions is 'Authenticate', which enables integration with identity providers (IdPs) like Amazon Cognito, OIDC, or SAML. This action can be configured to redirect unauthenticated users to the IdP and then forward authenticated requests to a target group, precisely meeting the requirement for path-based authentication.

A. Amazon CloudFront

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. It supports HTTPS and integrates directly with S3 for static website hosting.

D. Transit Gateway peering.

Transit Gateway peering allows you to connect two Transit Gateways across different AWS Regions. This establishes a direct, private connection between the Transit Gateways, enabling traffic to flow between attached VPCs in different regions without traversing the public internet, ensuring secure and low-latency communication.

A. AWS Transit Gateway.

AWS Transit Gateway acts as a central hub that connects VPCs, AWS accounts, and on-premises networks. It simplifies network architecture by eliminating the need for complex, mesh-like VPC peering connections as the number of VPCs grows, providing centralized routing and management for inter-VPC and hybrid cloud connectivity.

C. Application Load Balancer (ALB)

An Application Load Balancer (ALB) operates at the application layer (Layer 7) and supports path-based routing, allowing it to route requests to different target groups based on the URL path. It also provides high availability and fault tolerance across multiple Availability Zones.

D. Internet Gateway, NAT Gateway, Application Load Balancer (ALB), Security Group

An Internet Gateway provides internet connectivity for the VPC. An Application Load Balancer (ALB) distributes HTTP/HTTPS traffic to EC2 instances in private subnets and can be configured with listeners for these protocols. A Security Group acts as a virtual firewall for the instances, allowing only specified traffic (HTTP/HTTPS). If instances are in private subnets, they don't need a NAT Gateway for inbound traffic from the internet through an ALB, but the ALB itself would be in a public subnet. The question implies public access to the application, and the ALB provides this while routing to private instances.

D. The CloudFront distribution is not configured with an Origin Access Control (OAC) or Origin Access Identity (OAI).

If the S3 bucket policy allows public read access, CloudFront can fetch objects. However, a common best practice (and often the default for new S3 buckets) is to have 'Block public access' enabled, even if the bucket policy tries to grant public access. The most secure way for CloudFront to access a private S3 bucket (or one with 'Block public access' enabled) is by using an Origin Access Control (OAC) or the older Origin Access Identity (OAI). Without OAC/OAI, CloudFront might not have permission to fetch objects, leading to 403 errors, especially if S3's 'Block Public Access' settings are enabled, overriding the bucket policy.

A. NAT Gateway.

A NAT Gateway provides a highly available and managed solution for instances in a private subnet to initiate outbound connections to the internet (e.g., for OS patches) while preventing unsolicited inbound connections from the internet. It operates from a public subnet and uses an Elastic IP.

B. An ALIAS record pointing to the CloudFront distribution's domain name.

To map a root domain (like example.com) or a subdomain to a CloudFront distribution, an ALIAS record in Route 53 is the recommended and most efficient method. ALIAS records are a Route 53-specific extension to DNS that allow you to map your apex domain (e.g., example.com) directly to AWS resources like CloudFront distributions, without incurring DNS query charges and providing faster resolution than CNAMEs for apex domains.

A. Amazon Route 53 with Latency Routing Policy

Amazon Route 53's Latency Routing Policy is specifically designed to route user requests to the AWS Region that provides the lowest latency for the user. It also supports health checks to determine the availability of endpoints, redirecting traffic away from unhealthy ones. This perfectly matches the requirements for highly available, latency-based routing with health checks.

B. Failover routing policy combined with Geolocation routing.

To meet both requirements, a Geolocation routing policy is needed to direct users to the nearest endpoint based on their location. To add automatic failover if that endpoint (or region) becomes unhealthy, health checks must be associated, and this is typically combined with a Failover routing policy. You can combine Geolocation routing with health checks to achieve regional failover based on user location.

A. A NAT Gateway in a public subnet with a route from the private subnet.

EC2 instances in a private subnet with no public IP address cannot directly initiate outbound connections to the internet. A NAT Gateway, placed in a public subnet, allows instances in private subnets to connect to the internet while preventing inbound connections initiated from the internet. The private subnet's route table must have a route to the NAT Gateway.

D. Authentication with Identity Providers (IdPs)

ALB supports native integration with various Identity Providers (IdPs) like Amazon Cognito, Microsoft Active Directory (via SAML), or OpenID Connect. This allows the ALB to handle user authentication before forwarding authenticated requests to the backend targets, meeting the security mandate.

B. The Security Group attached to the EC2 instance is blocking the incoming traffic.

Given that Direct Connect is stable, on-premises routes are correct, and the instance is in a private subnet, the most common issue for failing ping and SSH (which use specific ports) is a restrictive Security Group. Security Groups act as stateful firewalls for instances, and if they don't explicitly allow ICMP for ping or TCP port 22 for SSH from the on-premises IP ranges, the connection will fail. NACLs are stateless and apply at the subnet level, often configured to be more permissive, but Security Groups are usually the first place to check for instance-specific traffic blocking.

B. Network Load Balancer (NLB).

A Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is designed for extreme performance, high throughput, and ultra-low latency. It is the only Elastic Load Balancing type that supports UDP traffic distribution, making it ideal for the given requirements.

A. AWS Direct Connect

AWS Direct Connect provides a dedicated private network connection from your premises to AWS. This offers consistent network performance, reduced cost for high bandwidth, and a more reliable experience compared to internet-based VPN connections, which is crucial for sensitive data and dedicated performance requirements.

D. Gateway Load Balancer (GWLB)

The Gateway Load Balancer (GWLB) is specifically designed to deploy, scale, and manage virtual appliances such as firewalls, intrusion detection/prevention systems, and deep packet inspection systems. It acts as a transparent network gateway, directing all traffic to the appliance fleet and then back to its destination.

B. AWS Direct Connect.

AWS Direct Connect provides a dedicated, private network connection from your on-premises data center to AWS. It offers consistent network performance, reduced network costs, and lower latency compared to internet-based connections like Site-to-Site VPN, making it ideal for transferring large datasets and critical applications.