SAP-C02 Practice Question: Design Solutions for Organizational Complexity
A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?
⚠ Common exam trap
Many exam-takers assume Gateway Load Balancers inherently distribute traffic across all Availability Zones like Application Load Balancers do, but in reality, GWLB endpoints are zonal by default and require explicit cross-zone load balancing to spread traffic across AZs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable cross-zone load balancing on the Gateway Load Balancer to distribute traffic evenly across all firewall instances in all Availability Zones.
Gateway Load Balancers (GWLB) by default do not distribute traffic across Availability Zones (AZs); they only send traffic to targets in the same AZ as the GWLB endpoint. Enabling cross-zone load balancing allows the GWLB to distribute traffic evenly across all healthy firewall instances in all AZs, which prevents overloading a single AZ's instances and ensures the auto-scaling group can scale effectively based on overall load, reducing latency and packet loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable cross-zone load balancing on the Gateway Load Balancer to distribute traffic evenly across all firewall instances in all Availability Zones.
Why this is correct
Cross-zone load balancing ensures that traffic is balanced across all healthy targets, improving scaling and reducing latency.
- ✗
Increase the size of the firewall instances to larger instance types to handle more traffic per instance.
Why it's wrong here
This may help but does not solve the scaling issue; the auto-scaling group should scale out, not up.
- ✗
Create additional Gateway Load Balancer endpoints in each Availability Zone and use a separate transit gateway route table for each AZ.
Why it's wrong here
This increases complexity and does not guarantee even distribution.
- ✗
Configure the auto-scaling group to use a step scaling policy based on network throughput.
Why it's wrong here
This helps scaling but does not address the distribution of traffic across instances.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.