The AWS Certified Solutions Architect – Associate (SAA-C03) exam tests network design within high-performing architectures, worth 24% of scored content, and secure architectures, worth 30%. You must select connection paths, configure routing, and protect traffic without adding unnecessary operational work. These SAA-C03 networking questions cover hybrid DNS, private connectivity, and VPC troubleshooting.
This is the seventh set in our AWS Certified Solutions Architect – Associate SAA-C03 series (Questions 61-70). It follows SAA-C03 Questions 51-60 on cost-optimized architectures. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
For hybrid DNS, identify where the query starts before selecting an endpoint. For routing problems, separate a missing network path from a rule that blocks an otherwise valid path.
Question 61: A Connection Through the Middle VPC
A company has three VPCs with nonoverlapping address ranges. VPC A is peered with VPC B and VPC C, but B and C have no direct connection. An engineer adds routes intended to send traffic from B to C through A. Security groups and network ACLs allow the traffic. What is the smallest topology change that enables direct private communication between B and C?
A) Enable DNS resolution on the two existing peering connections.
B) Add B-to-C peering and routes in both VPCs’ route tables.
C) Enable route propagation on the two existing peering connections.
D) Route both VPCs through the internet gateway attached to A.
👁 Reveal Answer
Correct Answer: B
Explanation: VPC peering is not transitive. A cannot act as a transit point between its two peers, even when routes and traffic rules appear permissive. B creates the missing direct relationship and provides routes for both directions. A changes name resolution, not connectivity. C assumes a peering route-propagation feature instead of adding the required explicit routes. D cannot share A’s internet gateway through peering and would not provide the requested direct private path.
Question 62: A Growing Network of Accounts
An enterprise is connecting dozens of VPCs with nonoverlapping CIDR blocks in one Region to each other and to its data center. Its full mesh of peering connections is difficult to maintain. It wants a managed hub with centralized routing, not a fleet of routing appliances. Which design best meets these requirements?
A) Connect every VPC to a central VPC using only VPC peering.
B) Install an EC2 routing appliance in each application VPC.
C) Create interface endpoints for every subnet in every VPC.
D) Attach the VPCs and a Site-to-Site VPN to a transit gateway.
👁 Reveal Answer
Correct Answer: D
Explanation: AWS Transit Gateway is a managed network transit hub that interconnects VPCs and on-premises networks. Its attachments and route tables replace a growing collection of pairwise connections. D supplies both VPC and VPN connectivity through that hub. A fails because peering is not transitive. B creates the appliance-management burden the enterprise ruled out. C provides access to endpoint services, not general routed connectivity among all VPCs and the data center.
Reference: What is AWS Transit Gateway for Amazon VPC?
Question 63: Resolving Data Center Names From AWS
EC2 instances use the VPC-provided DNS resolver. They must resolve names under corp.example.com, whose authoritative DNS servers remain in the data center. A working VPN already provides connectivity to those servers. The company wants managed conditional forwarding without changing DNS settings on every instance. What should it configure?
A) A Resolver outbound endpoint and a forwarding rule associated with the VPC.
B) A Resolver inbound endpoint and a forwarding rule on the data center DNS servers.
C) A public hosted zone and public records for every internal corporate server.
D) A private hosted zone and manually maintained copies of all corporate records.
👁 Reveal Answer
Correct Answer: A
Explanation: The queries originate in AWS and must be forwarded out to the corporate DNS servers. A Resolver outbound endpoint supplies that path. A domain-specific forwarding rule identifies the target DNS servers and is associated with the VPC. B serves the opposite direction, from the data center into AWS. C publishes internal records rather than forwarding queries privately. D creates a second manually synchronized source of records instead of using the existing authoritative servers.
Question 64: Resolving AWS Names From the Office
A private hosted zone associated with a VPC contains the names of internal AWS applications. Office users must resolve those names through the company’s existing DNS servers. Direct Connect already provides private network connectivity, and the company does not want DNS proxy servers on EC2. Which configuration should it use?
A) A Resolver outbound endpoint that forwards AWS queries to office DNS servers.
B) Public hosted-zone records that publish the internal application names externally.
C) A Resolver inbound endpoint targeted by conditional forwarding from office DNS servers.
D) Conditional forwarding from office DNS servers directly to the VPC’s base-plus-two address.
👁 Reveal Answer
Correct Answer: C
Explanation: An inbound endpoint gives the office DNS servers private addresses to which they can forward queries for AWS-hosted names. The Resolver can answer using the associated private hosted zone, and Direct Connect supplies connectivity. A handles queries leaving AWS, which reverses the required direction. B exposes records publicly rather than using the private zone. D bypasses the supported inbound endpoint design; the VPC-provided resolver address is not a substitute for an endpoint reachable from the office.
Reference: Resolving DNS queries between VPCs and your network
Question 65: Outbound Access for IPv6 Servers
Application instances have globally routable IPv6 addresses. They must initiate connections to an external IPv6 update service, but internet hosts must not initiate connections to the instances. The team wants the VPC gateway itself to enforce this direction without running a NAT appliance. Which route should it add?
A) Route ::/0 to a standard internet gateway.
B) Route ::/0 to an egress-only internet gateway.
C) Route ::/0 to an IPv4 public NAT gateway.
D) Route 0.0.0.0/0 to an egress-only internet gateway.
👁 Reveal Answer
Correct Answer: B
Explanation: An egress-only internet gateway permits outbound IPv6 connections and their responses while preventing internet-initiated IPv6 connections. The IPv6 default route is ::/0, so B matches both the protocol and direction. A does not enforce outbound-only behavior at the gateway. C confuses native IPv6 internet access with IPv4 NAT; NAT64 addresses a different case involving IPv4 destinations. D uses an IPv4 destination, which an IPv6-only egress gateway does not support.
Reference: Enable outbound IPv6 traffic using an egress-only internet gateway
Question 66: Encryption on an Existing Private Link
A company transfers sensitive data to a VPC through an existing AWS Direct Connect connection. The application does not encrypt its network traffic, and application changes are prohibited. The connection does not support MACsec. Compliance now requires IPsec encryption while retaining the Direct Connect path. Which change meets the requirement?
A) Enable default EBS encryption on the receiving EC2 instances.
B) Add a second Direct Connect connection with the same routing.
C) Configure an AWS Site-to-Site VPN over the Direct Connect path.
D) Limit the VPC security groups to the data center’s IP range.
👁 Reveal Answer
Correct Answer: C
Explanation: Direct Connect does not encrypt traffic in transit by default. Combining it with AWS Site-to-Site VPN provides an IPsec-encrypted connection while retaining the private network path, without requiring application changes. A protects block storage at rest, not packets in transit. B can improve connection redundancy but does not add encryption. D restricts permitted network sources; access filtering does not encrypt the traffic that those sources are allowed to send.
Reference: Encryption in AWS Direct Connect
Question 67: Which Route Does the Packet Use?
A subnet’s route table contains 10.0.0.0/16 to local, 172.20.0.0/16 to a transit gateway, 172.20.8.0/24 to a peering connection, and 0.0.0.0/0 to a NAT gateway. All routes are active. An instance sends a packet to 172.20.8.25. Which target does the VPC select?
A) The NAT gateway selected by the IPv4 default route.
B) The local target selected by the VPC’s local route.
C) The transit gateway selected by the matching /16 route.
D) The peering connection selected by the matching /24 route.
👁 Reveal Answer
Correct Answer: D
Explanation: VPC routing uses the most specific matching destination, called longest prefix match. The destination lies within both the transit gateway’s /16 and the peering connection’s /24, so the /24 wins. A is less specific than either matching private route. B does not match this destination at all. C matches, but its shorter prefix loses to D. Route selection alone does not prove that downstream rules permit delivery.
Reference: How route priority works
Question 68: Requests Arrive, but Responses Do Not Leave
A server receives TCP HTTPS requests from a client in another subnet. Routing is correct, the application is listening, and security groups permit the session. The server subnet’s custom network ACL allows inbound TCP port 443 from the client subnet but has only the default deny rule for outbound traffic. The client subnet’s network ACL permits both directions. Clients use source ports 49152-65535. What is the narrowest network ACL change that permits the server’s replies?
A) Allow outbound TCP destination ports 49152-65535 to the client subnet.
B) Allow outbound TCP destination port 443 to the client subnet.
C) Allow inbound TCP destination ports 49152-65535 from the client subnet.
D) Allow inbound TCP destination port 443 from every IPv4 address.
👁 Reveal Answer
Correct Answer: A
Explanation: Network ACLs are stateless, so an inbound allow does not automatically permit return traffic. The server’s response is addressed to the client’s original source port, in the range stated in the scenario. A permits those replies to the specified client subnet. B permits replies to the wrong destination port. C changes the inbound direction rather than the blocked outbound direction. D broadens request access without allowing any response to leave.
Question 69: Finding the Component That Blocks a Path
After network configuration changes, an EC2 instance cannot connect to another instance in the same VPC. The team wants AWS to analyze the configured path and identify a blocking route table, security group, or network ACL. It does not need packet contents or an application performance trace. Which tool best fits?
A) VPC Reachability Analyzer to evaluate the configured network path.
B) VPC Flow Logs to record accepted and rejected network flows.
C) VPC Traffic Mirroring to copy packets to a monitoring appliance.
D) AWS X-Ray to trace application requests across service components.
👁 Reveal Answer
Correct Answer: A
Explanation: Reachability Analyzer evaluates network configuration between a source and destination. It reports the virtual path when reachable and identifies a blocking component when configuration prevents connectivity. A directly matches the team’s diagnostic requirement. B records flow information but does not produce the requested hop-by-hop blocking analysis. C copies live packets and requires packet analysis rather than providing this configuration-path result. D traces application behavior rather than determining VPC routing and filtering reachability.
Reference: What is Reachability Analyzer?
Question 70: Sharing One Private Application
A software provider hosts a TCP service behind a Network Load Balancer in its VPC. Customers in other AWS accounts must access only that service through private endpoints in their own VPCs. The provider does not want general network routing between customer and provider VPCs or a public service endpoint. Which design should it use?
A) Create VPC peering connections with routes to the provider’s address range.
B) Create a PrivateLink endpoint service with customer interface VPC endpoints.
C) Attach customer VPCs to a transit gateway with routes to the provider VPC.
D) Create gateway VPC endpoints that target the provider’s Network Load Balancer.
👁 Reveal Answer
Correct Answer: B
Explanation: The provider creates an endpoint service backed by its Network Load Balancer and grants the intended customer principals permission to connect. Customers create interface endpoints in their VPCs. B exposes the particular service without establishing general VPC routing. A creates a peering connection instead of the requested service-specific endpoint model. C similarly creates a routed network through a transit gateway. D uses the wrong endpoint type: gateway endpoints do not target a provider-owned Network Load Balancer.
Reference: Share your services through AWS PrivateLink
Study Tips for Networking and Hybrid Connectivity
- Start with direction. Hybrid DNS uses outbound endpoints for AWS-to-office queries and inbound endpoints for office-to-AWS queries.
- Distinguish networks from services. Peering and transit gateways provide routed connectivity; PrivateLink exposes a particular endpoint service.
- Check the return path. Network ACLs are stateless, so replies need explicit permission in the opposite direction.
- Do not equate private with encrypted. Direct Connect needs an appropriate transit-encryption option when confidentiality is required.
Keep Practicing for AWS Solutions Architect Associate
Review SAA-C03 Questions 51-60 for cost decisions, then use these SAA-C03 networking questions to practice tracing connection paths. The next set will cover data services and application resilience.