How to Migrate a Custom TCP Protocol Application to AWS with Low Latency
A company is migrating a distributed application that uses a custom TCP protocol between components. The application is deployed on-premises across multiple servers. The company wants to use AWS without modifying the application code. Which approach should the company take to migrate the application while maintaining low latency between components?
Quick Answer
The correct approach is to use Amazon EC2 instances in a Placement Group within a single VPC to ensure low latency. This works because Placement Groups, specifically cluster placement groups, physically pack instances close together inside a single Availability Zone, providing the highest possible network throughput and single-digit millisecond latency between them—critical for a custom TCP protocol that cannot be modified. On the AWS Certified Solutions Architect Professional SAP-C02 exam, this question tests your understanding of how to achieve low-latency inter-instance communication without code changes, often as a distractor against options like VPC peering or Direct Connect, which solve different connectivity problems. A common trap is assuming a VPN or dedicated connection is needed, but for intra-VPC traffic, Placement Groups are the native, code-free solution. Memory tip: think “Placement Group = physical proximity for protocol speed.”
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Amazon EC2 instances in a Placement Group within a single VPC to ensure low latency.
Using a Placement Group ensures that EC2 instances are placed close together within the same Availability Zone, minimizing network latency and maximizing throughput for the custom TCP protocol. This allows the application to run unchanged on AWS. Option B is incorrect because Direct Connect connects on-premises to AWS, but the application components would still be separated by network distance, increasing latency. Option C is incorrect because VPC Peering connects different VPCs, which does not guarantee low latency within a single VPC. Option D is incorrect because a VPN is used for secure connectivity over the internet, which introduces higher latency and is not necessary for components within the same VPC.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Amazon EC2 instances in a Placement Group within a single VPC to ensure low latency.
Why this is correct
Placement Groups provide low latency and high throughput, and EC2 allows running the application unchanged.
- ✗
Use AWS Direct Connect to connect the on-premises servers to AWS and keep the application on-premises.
Why it's wrong here
The goal is to migrate to AWS, not keep on-premises.
- ✗
Use VPC Peering to connect the application components across different VPCs.
Why it's wrong here
VPC peering does not guarantee low latency between components; using a single VPC is better.
- ✗
Use a VPN connection between the on-premises environment and AWS VPC.
Why it's wrong here
VPN does not provide consistent low latency and is not a migration strategy.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 1,660 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is migrating a legacy on-premises application that uses a custom TCP protocol. The application needs to be accessible from the internet while maintaining security. Which AWS service should they use to expose the application without modifying the code?
hard- A.Amazon CloudFront
- ✓ B.Network Load Balancer (NLB)
- C.Amazon API Gateway
- D.Application Load Balancer (ALB)
Why B: Network Load Balancer (NLB) because it operates at Layer 4 (TCP) and can handle custom TCP protocols without requiring application modifications. Option A (CloudFront) is a content delivery network that only supports HTTP/HTTPS. Option C (API Gateway) is designed for HTTP/HTTPS APIs and does not handle raw TCP traffic. Option D (Application Load Balancer, ALB) operates at Layer 7 (HTTP/HTTPS) and cannot process custom TCP protocols.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.