NAT Gateway practice questions

A company is hosting a web application on EC2 instances behind an Application Load Balancer. The security team requires that all data in transit between the client and the ALB be encrypted using TLS. Which service should the architect use to manage the SSL/TLS certificates for the ALB?

Trap 1: AWS Secrets Manager

Secrets Manager is designed to manage database credentials, API keys, and other sensitive configuration strings. It does not provide the specialized infrastructure required to serve SSL/TLS certificates for public-facing load balancers. While you could store certificates here, it lacks the integration to automatically attach them to an ALB.

Trap 2: AWS Key Management Service (KMS)

KMS is primarily used for creating and controlling cryptographic keys used to encrypt data at rest within various AWS services. It is not intended for managing public SSL/TLS certificates used for identity verification and encryption in transit for web traffic, as it lacks public certificate authority trust.

Trap 3: IAM Server Certificate Upload

Uploading certificates to IAM is a legacy method used primarily for specific AWS services that do not support ACM integration. It requires manual tracking of certificate expiration dates and manual replacement, making it an operationally inefficient and insecure practice for modern ALB deployments when ACM is available.

A
AWS Secrets Manager
Why it fails: Secrets Manager is designed to manage database credentials, API keys, and other sensitive configuration strings. It does not provide the specialized infrastructure required to serve SSL/TLS certificates for public-facing load balancers. While you could store certificates here, it lacks the integration to automatically attach them to an ALB.
B
AWS Certificate Manager (ACM)
ACM provides a managed service to generate or import SSL/TLS certificates and associate them directly with an ALB. It handles the complexities of certificate lifecycle management, including automated renewals, ensuring that the web application maintains continuous, encrypted communication with clients without manual intervention or certificate expiration risks.
C
AWS Key Management Service (KMS)
Why it fails: KMS is primarily used for creating and controlling cryptographic keys used to encrypt data at rest within various AWS services. It is not intended for managing public SSL/TLS certificates used for identity verification and encryption in transit for web traffic, as it lacks public certificate authority trust.
D
IAM Server Certificate Upload
Why it fails: Uploading certificates to IAM is a legacy method used primarily for specific AWS services that do not support ACM integration. It requires manual tracking of certificate expiration dates and manual replacement, making it an operationally inefficient and insecure practice for modern ALB deployments when ACM is available.

Question 2easymultiple choice

A company has several VPCs in the same region that need to access an Amazon S3 bucket for data logging. Currently, data is transferred over the public internet, incurring data transfer charges. What is the most cost-effective way to allow the VPCs to access S3?

Trap 1: Deploy a NAT Gateway in each VPC.

NAT Gateways carry an hourly charge per gateway and a data processing fee per GB. While they allow access to S3 via the internet, they are significantly more expensive than using a Gateway Endpoint, which provides the same connectivity for free and without the per-GB processing costs.

Trap 2: Create an S3 Interface Endpoint (PrivateLink) in each VPC.

Interface Endpoints (AWS PrivateLink) charge an hourly fee for each Availability Zone where they are deployed, plus a data processing fee per GB. While useful for accessing S3 from on-premises or across regions, they are more expensive than Gateway Endpoints for standard VPC-to-S3 connectivity within a region.

Trap 3: Establish a AWS Direct Connect connection to S3.

Direct Connect is a high-cost physical connection between an on-premises data center and AWS. It is not a cost-effective solution for intra-region VPC-to-S3 traffic, as it involves significant setup costs, monthly port fees, and is designed for hybrid cloud connectivity rather than internal AWS traffic.

A
Deploy a NAT Gateway in each VPC.
Why it fails: NAT Gateways carry an hourly charge per gateway and a data processing fee per GB. While they allow access to S3 via the internet, they are significantly more expensive than using a Gateway Endpoint, which provides the same connectivity for free and without the per-GB processing costs.
B
Create an S3 Interface Endpoint (PrivateLink) in each VPC.
Why it fails: Interface Endpoints (AWS PrivateLink) charge an hourly fee for each Availability Zone where they are deployed, plus a data processing fee per GB. While useful for accessing S3 from on-premises or across regions, they are more expensive than Gateway Endpoints for standard VPC-to-S3 connectivity within a region.
C
Establish a AWS Direct Connect connection to S3.
Why it fails: Direct Connect is a high-cost physical connection between an on-premises data center and AWS. It is not a cost-effective solution for intra-region VPC-to-S3 traffic, as it involves significant setup costs, monthly port fees, and is designed for hybrid cloud connectivity rather than internal AWS traffic.
D
Create an S3 Gateway Endpoint in each VPC.
S3 Gateway Endpoints are a free feature of VPCs. They require no management of hardware or software and do not charge for the amount of data processed. By updating the route table to point S3 traffic to the endpoint, the company eliminates data transfer costs to the internet.

Question 3mediummultiple choice

A developer is using an EC2 instance to process images. The images are stored in an S3 bucket. The developer notices that the network transfer between S3 and the EC2 instance is the bottleneck. How can the developer resolve this?

Trap 1: Increase the EC2 instance size.

Increasing the instance size provides more CPU and RAM but does not inherently improve network throughput if the bottleneck is the path to S3. While larger instances have higher network limits, the fundamental issue of network routing remains. Optimizing the network path via VPC endpoints is more effective.

Trap 2: Enable S3 Transfer Acceleration.

S3 Transfer Acceleration is designed for long-distance uploads to S3 from client machines over the public internet using CloudFront edge locations. It is not intended for high-speed data transfer between AWS services within the same internal network, making it an inappropriate solution for this specific EC2-to-S3 bottleneck.

Trap 3: Use CloudFront to cache the images.

CloudFront is excellent for distributing content to users, but for an EC2 instance pulling data for processing, adding a caching layer adds architectural complexity without guaranteeing performance improvements. The instance should be pulling directly from S3, ideally via a VPC endpoint, for the most efficient, low-latency performance.

A
Use an Amazon S3 Gateway Endpoint.
A Gateway Endpoint allows traffic to route privately and directly from a VPC to S3 within the same region. By keeping traffic within the AWS network, it avoids public internet congestion, leading to improved throughput and lower latency for data-intensive operations like image processing, directly addressing the identified bottleneck.
B
Increase the EC2 instance size.
Why it fails: Increasing the instance size provides more CPU and RAM but does not inherently improve network throughput if the bottleneck is the path to S3. While larger instances have higher network limits, the fundamental issue of network routing remains. Optimizing the network path via VPC endpoints is more effective.
C
Enable S3 Transfer Acceleration.
Why it fails: S3 Transfer Acceleration is designed for long-distance uploads to S3 from client machines over the public internet using CloudFront edge locations. It is not intended for high-speed data transfer between AWS services within the same internal network, making it an inappropriate solution for this specific EC2-to-S3 bottleneck.
D
Use CloudFront to cache the images.
Why it fails: CloudFront is excellent for distributing content to users, but for an EC2 instance pulling data for processing, adding a caching layer adds architectural complexity without guaranteeing performance improvements. The instance should be pulling directly from S3, ideally via a VPC endpoint, for the most efficient, low-latency performance.

Question 4hardmultiple choice

Refer to the exhibit. A company wants to optimize the performance and security of data transfers between their EC2 instances and an S3 bucket named 'my-app-data'. Which architectural benefit is primarily achieved by implementing the policy shown in the exhibit?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-app-data/*",
      "Condition": {
        "StringEquals": {
          "aws:SourceVpce": "vpce-1a2b3c4d"
        }
      }
    }
  ]
}

Trap 1: It enables S3 Transfer Acceleration for faster global uploads.

S3 Transfer Acceleration uses Amazon CloudFront's edge locations to speed up long-distance data transfers over the public internet. The policy in the exhibit, however, restricts access to a specific VPC endpoint, which keeps traffic entirely within the AWS private network. These are two different performance optimization strategies that serve different geographic use cases.

Trap 2: It provides cross-region replication for high availability of data.

Cross-region replication is a feature used to automatically copy objects across different AWS Regions for disaster recovery or latency reduction for global users. The exhibited policy is a resource-based access control policy and does not configure or enable replication features. It focuses strictly on controlling the network path used to access the bucket.

Trap 3: It allows public access to the bucket for faster content delivery.

The policy actually restricts access rather than allowing general public access, as it requires the request to originate from a specific VPC endpoint. While the Principal is a wildcard, the Condition block effectively limits access to authorized internal network paths. This improves security and performance for internal applications but does not facilitate public delivery.

A
It enables S3 Transfer Acceleration for faster global uploads.
Why it fails: S3 Transfer Acceleration uses Amazon CloudFront's edge locations to speed up long-distance data transfers over the public internet. The policy in the exhibit, however, restricts access to a specific VPC endpoint, which keeps traffic entirely within the AWS private network. These are two different performance optimization strategies that serve different geographic use cases.
B
It ensures traffic remains on the private AWS network, reducing latency.
By specifying a SourceVpce condition, the policy ensures that only requests coming through the designated VPC Gateway Endpoint are allowed. This configuration routes S3 traffic over the AWS private network backbone rather than the public internet. This results in more consistent performance, lower latency, and reduced data transfer costs for internal AWS traffic.
C
It provides cross-region replication for high availability of data.
Why it fails: Cross-region replication is a feature used to automatically copy objects across different AWS Regions for disaster recovery or latency reduction for global users. The exhibited policy is a resource-based access control policy and does not configure or enable replication features. It focuses strictly on controlling the network path used to access the bucket.
D
It allows public access to the bucket for faster content delivery.
Why it fails: The policy actually restricts access rather than allowing general public access, as it requires the request to originate from a specific VPC endpoint. While the Principal is a wildcard, the Condition block effectively limits access to authorized internal network paths. This improves security and performance for internal applications but does not facilitate public delivery.

Question 5mediummultiple choice

A company's security team identifies that its public-facing web application is being targeted by SQL injection and cross-site scripting (XSS) attacks. The application is running on EC2 instances behind an Application Load Balancer (ALB). Which service should the solutions architect implement to protect the application from these specific web-based attacks?

Trap 1: AWS Shield Advanced

AWS Shield Advanced is primarily focused on protecting applications against Distributed Denial of Service (DDoS) attacks at Layers 3, 4, and 7. While it includes AWS WAF at no extra cost, WAF itself is the specific service that provides the filtering for SQL injection and XSS attacks.

Trap 2: Amazon GuardDuty

Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior across your AWS accounts and workloads. It can detect compromised instances or unusual API calls, but it is not an inline firewall capable of blocking SQL injection or XSS in real-time.

Trap 3: Amazon Inspector

Amazon Inspector is an automated vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. It is a proactive scanning tool rather than a reactive firewall for blocking incoming web-based attacks like SQL injection or XSS.

A
AWS Shield Advanced
Why it fails: AWS Shield Advanced is primarily focused on protecting applications against Distributed Denial of Service (DDoS) attacks at Layers 3, 4, and 7. While it includes AWS WAF at no extra cost, WAF itself is the specific service that provides the filtering for SQL injection and XSS attacks.
B
Amazon GuardDuty
Why it fails: Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior across your AWS accounts and workloads. It can detect compromised instances or unusual API calls, but it is not an inline firewall capable of blocking SQL injection or XSS in real-time.
C
AWS WAF
AWS WAF allows users to create web ACLs that contain rules to inspect HTTP/HTTPS requests. It includes pre-configured managed rule groups that specifically target SQL injection and XSS patterns, providing a robust defense layer at the application level to mitigate these common security threats effectively.
D
Amazon Inspector
Why it fails: Amazon Inspector is an automated vulnerability management service that scans EC2 instances, container images, and Lambda functions for software vulnerabilities and unintended network exposure. It is a proactive scanning tool rather than a reactive firewall for blocking incoming web-based attacks like SQL injection or XSS.

Question 6mediummultiple choice

A company has several VPCs in a single region that need to access an S3 bucket for data processing. Currently, traffic goes through a NAT Gateway in each VPC. What is the most cost-effective way to provide access to S3?

Trap 1: Create an Interface VPC Endpoint for S3 in each VPC.

Interface VPC Endpoints (AWS PrivateLink) for S3 carry an hourly charge and a per-GB processing fee. While they offer connectivity, they are less cost-effective than Gateway Endpoints for S3, which are provided at no additional cost. Interface endpoints should only be used if access from on-premises or different regions is required.

Trap 2: Deploy a single NAT Instance in a shared services VPC.

While a NAT Instance might be cheaper than a NAT Gateway in terms of hourly rates, it requires manual management, patching, and scaling. Furthermore, it still incurs data transfer charges across VPCs and regions. It is not as cost-effective or reliable as using a free Gateway VPC Endpoint for S3.

Trap 3: Use a Transit Gateway to route all S3 traffic through a central VPC.

Transit Gateway simplifies networking but introduces its own set of costs, including an hourly charge per attachment and data processing fees. Routing S3 traffic through a Transit Gateway just to reach S3 would be significantly more expensive than using localized Gateway Endpoints, which provide direct and free routing.

A
Create an Interface VPC Endpoint for S3 in each VPC.
Why it fails: Interface VPC Endpoints (AWS PrivateLink) for S3 carry an hourly charge and a per-GB processing fee. While they offer connectivity, they are less cost-effective than Gateway Endpoints for S3, which are provided at no additional cost. Interface endpoints should only be used if access from on-premises or different regions is required.
B
Set up a Gateway VPC Endpoint for S3 in each VPC.
Gateway Endpoints are a cost-free feature of VPCs that route traffic to S3 through the AWS private network. They do not incur hourly charges or data processing fees, unlike NAT Gateways. This makes them the most economical solution for any VPC-based workload that needs to communicate heavily with S3.
C
Deploy a single NAT Instance in a shared services VPC.
Why it fails: While a NAT Instance might be cheaper than a NAT Gateway in terms of hourly rates, it requires manual management, patching, and scaling. Furthermore, it still incurs data transfer charges across VPCs and regions. It is not as cost-effective or reliable as using a free Gateway VPC Endpoint for S3.
D
Use a Transit Gateway to route all S3 traffic through a central VPC.
Why it fails: Transit Gateway simplifies networking but introduces its own set of costs, including an hourly charge per attachment and data processing fees. Routing S3 traffic through a Transit Gateway just to reach S3 would be significantly more expensive than using localized Gateway Endpoints, which provide direct and free routing.

Question 7mediummultiple choice

A web application runs on Amazon EC2 instances managed by an Auto Scaling group across three Availability Zones behind an Application Load Balancer. The application performs heavy computations that consume high CPU resources. Users report intermittent 504 Gateway Timeouts during peak hours. The solutions architect notices that newly launched instances take several minutes to bootstrap before they can serve traffic. How should the architect resolve this issue?

Trap 1: Configure an Amazon SQS queue in front of the EC2 instances to…

Asynchronous queueing decouples request submission from processing but does not shorten the several-minute bootstrap delay that leaves new instances unable to serve traffic, so 504s persist. It tempts because SQS genuinely absorbs spikes for workloads that tolerate deferred results, which this synchronous web application does not.

Trap 2: Switch the load balancer from an Application Load Balancer to a…

A Network Load Balancer forwards TCP without terminating HTTP, so it cannot generate or mitigate 504 Gateway Timeouts, and it does nothing about slow instance bootstrap. It tempts because NLB reduces latency for extreme-throughput or non-HTTP workloads, which is the actual reason to choose it.

Trap 3: Decrease the Auto Scaling group health check grace period to zero…

A zero grace period makes Auto Scaling terminate instances mid-bootstrap before they register as healthy, causing replacement loops rather than fixing the timeout. It tempts because shortening grace periods genuinely helps when health checks are misconfigured and instances are wrongly marked unhealthy.

A
Configure an Amazon SQS queue in front of the EC2 instances to offload computational tasks asynchronously.
Why it fails: Asynchronous queueing decouples request submission from processing but does not shorten the several-minute bootstrap delay that leaves new instances unable to serve traffic, so 504s persist. It tempts because SQS genuinely absorbs spikes for workloads that tolerate deferred results, which this synchronous web application does not.
B
Implement pre-baked Amazon Machine Images (AMIs) with application code pre-installed and configure an Auto Scaling health check grace period.
Pre-baked AMIs remove the multi-minute bootstrap, so new instances serve traffic almost immediately and scale out before peak load causes 504s. The health check grace period prevents the Auto Scaling group terminating instances that are still initialising, avoiding premature replacement.
C
Switch the load balancer from an Application Load Balancer to a Network Load Balancer for faster TCP packet routing.
Why it fails: A Network Load Balancer forwards TCP without terminating HTTP, so it cannot generate or mitigate 504 Gateway Timeouts, and it does nothing about slow instance bootstrap. It tempts because NLB reduces latency for extreme-throughput or non-HTTP workloads, which is the actual reason to choose it.
D
Decrease the Auto Scaling group health check grace period to zero so failing instances are replaced immediately.
Why it fails: A zero grace period makes Auto Scaling terminate instances mid-bootstrap before they register as healthy, causing replacement loops rather than fixing the timeout. It tempts because shortening grace periods genuinely helps when health checks are misconfigured and instances are wrongly marked unhealthy.

Question 8hardmulti select

A solutions architect is reviewing the architecture of a large VPC. Currently, thousands of EC2 instances in private subnets transfer several terabytes of data daily to Amazon S3 through a NAT Gateway. The NAT Gateway costs have become prohibitively high. Which TWO changes will reduce these costs?

Trap 1: Replace the NAT Gateway with a NAT Instance.

While a NAT Instance might be cheaper in terms of hourly instance costs compared to a NAT Gateway, it does not solve the fundamental cost issue of high-volume data transfer. NAT Instances also require manual management, scaling, and high-availability configuration, which increases operational overhead without providing the zero-cost benefit of a Gateway Endpoint.

Trap 2: Move the EC2 instances to public subnets.

Moving instances to public subnets and using an Internet Gateway would eliminate NAT Gateway costs, but it severely compromises security. Public subnets expose instances to the internet, increasing the attack surface. Cost optimization must be balanced with security requirements, and VPC Endpoints are the architecturally sound solution here.

Trap 3: Increase the number of NAT Gateways across all Availability Zones.

Increasing the number of NAT Gateways would improve availability and potentially bandwidth, but it would actually increase costs. Each NAT Gateway has an hourly charge. To reduce costs, the goal is to decrease the amount of data flowing through the NAT service, not to provision more of it.

A
Create a Gateway VPC Endpoint for Amazon S3.
Gateway Endpoints for S3 are provided at no additional cost and do not incur data processing charges. By routing S3 traffic through the endpoint instead of the NAT Gateway, the company eliminates the per-GB processing fee for all data transfers to and from S3, leading to massive cost savings.
B
Replace the NAT Gateway with a NAT Instance.
Why it fails: While a NAT Instance might be cheaper in terms of hourly instance costs compared to a NAT Gateway, it does not solve the fundamental cost issue of high-volume data transfer. NAT Instances also require manual management, scaling, and high-availability configuration, which increases operational overhead without providing the zero-cost benefit of a Gateway Endpoint.
C
Update the route table to direct S3 traffic through the Gateway Endpoint.
Creating a Gateway Endpoint is only the first step; you must also update the route tables of the private subnets to point S3-bound traffic (using a prefix list) to the endpoint. This ensures that the instances automatically use the more cost-effective path instead of defaulting to the NAT Gateway.
D
Move the EC2 instances to public subnets.
Why it fails: Moving instances to public subnets and using an Internet Gateway would eliminate NAT Gateway costs, but it severely compromises security. Public subnets expose instances to the internet, increasing the attack surface. Cost optimization must be balanced with security requirements, and VPC Endpoints are the architecturally sound solution here.
E
Increase the number of NAT Gateways across all Availability Zones.
Why it fails: Increasing the number of NAT Gateways would improve availability and potentially bandwidth, but it would actually increase costs. Each NAT Gateway has an hourly charge. To reduce costs, the goal is to decrease the amount of data flowing through the NAT service, not to provision more of it.

Question 9hardmultiple choice

Refer to the exhibit. An application running on an EC2 instance requires access to S3 objects but is encountering slow performance when fetching large files. An architect observes high network latency between the instance and S3. Which strategy will improve retrieval performance?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::my-bucket/*"]
    }
  ]
}

Trap 1: Update the IAM policy to include s3:ListBucket.

Adding s3:ListBucket only allows the application to view the contents of the bucket. It does not address the underlying performance issue related to network latency or data transfer speeds. IAM permission changes do not impact the underlying network throughput between the EC2 instance and the S3 service.

Trap 2: Deploy an Amazon CloudFront distribution in front of the S3 bucket.

CloudFront uses edge locations to cache content, drastically reducing the latency for S3 object retrieval. For high-performance requirements, caching data closer to the compute source provides much faster response times than standard S3 requests, effectively mitigating network congestion and latency issues encountered during high-frequency data access.

Trap 3: Change the S3 bucket storage class to S3 Intelligent-Tiering.

Storage classes relate to cost management and data lifecycle policies, not performance. Changing the storage class does not influence the network latency or retrieval speeds of the files themselves. Performance optimization requires architectural changes to the delivery mechanism, such as caching or improved network routing, not storage class.

A
Update the IAM policy to include s3:ListBucket.
Why it fails: Adding s3:ListBucket only allows the application to view the contents of the bucket. It does not address the underlying performance issue related to network latency or data transfer speeds. IAM permission changes do not impact the underlying network throughput between the EC2 instance and the S3 service.
B
Create an S3 VPC Endpoint.
While VPC endpoints keep traffic within the AWS network, they are primarily for security and private connectivity. CloudFront provides edge caching, which offers superior performance for large file retrieval by serving objects from closer geographical locations, whereas a VPC endpoint only optimizes the path to the S3 region.
C
Deploy an Amazon CloudFront distribution in front of the S3 bucket.
Why it fails: CloudFront uses edge locations to cache content, drastically reducing the latency for S3 object retrieval. For high-performance requirements, caching data closer to the compute source provides much faster response times than standard S3 requests, effectively mitigating network congestion and latency issues encountered during high-frequency data access.
D
Change the S3 bucket storage class to S3 Intelligent-Tiering.
Why it fails: Storage classes relate to cost management and data lifecycle policies, not performance. Changing the storage class does not influence the network latency or retrieval speeds of the files themselves. Performance optimization requires architectural changes to the delivery mechanism, such as caching or improved network routing, not storage class.

Question 10hardmulti select

A company is planning to connect its on-premises data center to AWS to support a high-performance hybrid cloud architecture. The connection must support a consistent 10 Gbps bandwidth and provide a private, dedicated network path to reduce jitter and latency. Which TWO steps should the architect take?

Trap 1: Configure a Site-to-Site VPN as the primary connection.

Site-to-Site VPNs run over the public internet, which means bandwidth and latency can fluctuate based on internet congestion. A single VPN tunnel is also limited to 1.25 Gbps, making it unsuitable for a requirement of consistent 10 Gbps high-performance throughput.

Trap 2: Enable Accelerated Site-to-Site VPN.

Accelerated VPN uses Global Accelerator to route traffic to the nearest AWS edge location, which can reduce latency compared to standard VPN. However, it still operates over the public internet and cannot guarantee the same level of consistency or 10 Gbps bandwidth as Direct Connect.

Trap 3: Use Amazon Route 53 Resolver for all DNS queries.

While Route 53 Resolver is important for hybrid DNS resolution, it does not impact the physical network performance or provide the 10 Gbps dedicated bandwidth required for the data transfer itself. It is a management service rather than a throughput enhancement solution.

A
Provision an AWS Direct Connect dedicated connection.
A dedicated connection provides a physical Ethernet port (1 Gbps, 10 Gbps, or 100 Gbps) dedicated to a single customer. This ensures that the bandwidth is not shared and provides the most consistent performance for high-throughput applications compared to hosted connections or VPNs.
B
Configure a Site-to-Site VPN as the primary connection.
Why it fails: Site-to-Site VPNs run over the public internet, which means bandwidth and latency can fluctuate based on internet congestion. A single VPN tunnel is also limited to 1.25 Gbps, making it unsuitable for a requirement of consistent 10 Gbps high-performance throughput.
C
Set up a Virtual Private Gateway (VGW) or Direct Connect Gateway.
A Direct Connect Gateway allows the connection to interface with multiple VPCs across different regions. This is a necessary architectural component to route traffic from the Direct Connect location to the specific resources within the AWS cloud environment efficiently.
D
Enable Accelerated Site-to-Site VPN.
Why it fails: Accelerated VPN uses Global Accelerator to route traffic to the nearest AWS edge location, which can reduce latency compared to standard VPN. However, it still operates over the public internet and cannot guarantee the same level of consistency or 10 Gbps bandwidth as Direct Connect.
E
Use Amazon Route 53 Resolver for all DNS queries.
Why it fails: While Route 53 Resolver is important for hybrid DNS resolution, it does not impact the physical network performance or provide the 10 Gbps dedicated bandwidth required for the data transfer itself. It is a management service rather than a throughput enhancement solution.