Question 1mediummulti select
Full question →mediummulti selectObjective-mapped
A company runs a customer portal in us-east-1 and a warm standby in us-west-2. The DNS name must send users to us-east-1 while it is healthy and automatically switch to us-west-2 if the primary application endpoint stops responding. Which two actions should the architect take? Select two.
Answer choices
Why each option matters
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A
Best answer
Create Route 53 failover records for the same DNS name with primary and secondary targets.
Failover routing is the Route 53 feature built for primary-to-secondary traffic shifting. It lets DNS answer with the primary target while health checks pass, then returns the secondary target when the primary becomes unhealthy.
B
Distractor review
Use latency-based routing so Route 53 always returns the lowest-latency Region.
Latency-based routing improves performance selection, but it does not provide a simple primary-and-backup failover pattern. Users could still be routed to either Region based on latency, not health-driven standby behavior.
C
Best answer
Associate a Route 53 health check with the primary endpoint that monitors application availability.
A health check tells Route 53 whether the primary site is actually responding. Without it, Route 53 cannot reliably know when to stop returning the primary record and shift traffic to the backup endpoint.
D
Distractor review
Use weighted records with a 50/50 split to balance traffic across both Regions.
Weighted routing is useful for traffic splitting and gradual migration, but it does not automatically behave like a failover policy. A 50/50 split would continue sending traffic to the unhealthy Region.
E
Distractor review
Place the standby application in a private hosted zone so only internal systems can resolve it.
A private hosted zone restricts DNS visibility to associated VPCs, but it does not create internet-facing failover behavior. This choice solves name resolution scope, not automatic health-based regional switching.
Common exam trap
Common exam trap: NAT rules depend on direction and matching traffic
NAT is not only about the public address. The inside/outside interface roles and the ACL or rule that matches traffic are just as important.
Technical deep dive
How to think about this question
NAT questions usually test address translation, overload/PAT behaviour, static mappings and whether the right traffic is being translated. Read the interface direction and address terms carefully.
KKey Concepts to Remember
- Static NAT maps one inside address to one outside address.
- PAT allows many inside hosts to share one public address using ports.
- Inside local and inside global describe the private and translated addresses.
- NAT ACLs identify traffic for translation, not always security filtering.
TExam Day Tips
- Identify inside and outside interfaces first.
- Check whether the scenario needs static NAT, dynamic NAT or PAT.
- Do not confuse NAT matching ACLs with normal packet-filtering intent.
Related practice questions
Related SAA-C03 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
SAA-C03 VPC practice questions
Practise SAA-C03 questions linked to SAA-C03 VPC.
SAA-C03 S3 lifecycle policy questions
Practise SAA-C03 questions linked to SAA-C03 S3 lifecycle policy questions.
SAA-C03 RDS Multi-AZ questions
Practise SAA-C03 questions linked to SAA-C03 RDS Multi-AZ questions.
SAA-C03 IAM policy practice questions
Practise SAA-C03 questions linked to SAA-C03 IAM policy.
SAA-C03 Route 53 failover questions
Practise SAA-C03 questions linked to SAA-C03 Route 53 failover questions.
SAA-C03 CloudFront practice questions
Practise SAA-C03 questions linked to SAA-C03 CloudFront.
SAA-C03 NAT gateway questions
Practise SAA-C03 questions linked to SAA-C03 NAT gateway questions.
SAA-C03 VPC endpoint questions
Practise SAA-C03 questions linked to SAA-C03 VPC endpoint questions.
SAA-C03 Auto Scaling practice questions
Practise SAA-C03 questions linked to SAA-C03 Auto Scaling.
SAA-C03 disaster recovery questions
Practise SAA-C03 questions linked to SAA-C03 disaster recovery questions.
SAA-C03 high availability questions
Practise SAA-C03 questions linked to SAA-C03 high availability questions.
SAA-C03 cost optimization questions
Practise SAA-C03 questions linked to SAA-C03 cost optimization questions.
More questions from this exam
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
A team needs to distribute TCP traffic (not HTTP) across multiple services. The services must see the original client source IP for auditing. Which AWS load balancer is the best fit?
Question 2
A team wants to run containerized services with AWS-managed orchestration and autoscaling. They do NOT require Kubernetes compatibility. Which AWS service choice is most appropriate to meet these goals?
Question 3
A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.
Question 4
A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?
Question 5
A team wants to delegate IAM management to developers, but must ensure developers can never grant themselves permissions beyond a specific limit. Which AWS mechanism best matches this requirement?
Question 6
A solutions architect is designing an S3 bucket for a healthcare document service. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?
FAQ
Questions learners often ask
What does this SAA-C03 question test?
Static NAT maps one inside address to one outside address.
What is the correct answer to this question?
The correct answer is: Create Route 53 failover records for the same DNS name with primary and secondary targets. — Route 53 failover routing with a health check is the correct design for a primary/secondary DNS pattern. The primary record is returned while its health check succeeds, and Route 53 switches to the secondary record when the primary endpoint fails. This gives the business automatic DNS-based failover with minimal operational overhead and no application changes, which is exactly what a warm standby design needs. Why others are wrong: Latency-based routing selects a Region by network performance, not by whether the application is healthy. Weighted routing is for controlled distribution, not automatic standby failover. A private hosted zone only limits DNS visibility; it does not provide resilience. The key requirement here is health-driven DNS switching between two public endpoints, which Route 53 failover records and health checks provide together.
What should I do if I get this SAA-C03 question wrong?
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Discussion
Loading comments…
Sign in to join the discussion.