Networking and Content Delivery practice questions

AWS Virtual Private Gateway

Why wrong: Incorrect. A virtual private gateway is an endpoint for VPN connections from on-premises, but those VPNs typically traverse the public internet.

AWS Transit Gateway

Why wrong: Incorrect. Transit Gateway is used to connect multiple VPCs and on-premises networks via VPN or Direct Connect, but it is not the direct private connection itself.

VPC Peering

Why wrong: Incorrect. VPC peering connects two VPCs, but does not connect on-premises data centers to AWS.

Use a Transit Gateway instead of VPC Peering for cross-region connectivity.

Why wrong: Incorrect. Changing to Transit Gateway does not inherently improve latency; it adds a hub but traffic still traverses the AWS backbone.

Increase the MTU on the instances' network interfaces to 9001.

Why wrong: Incorrect. While jumbo frames can improve throughput, latency is not significantly affected by MTU changes.

Configure ECMP (Equal-Cost Multi-Path) routing on the VPC peering connection.

Why wrong: Incorrect. VPC Peering does not support ECMP; it is a one-to-one connection.

Use Amazon Route 53 with a simple routing policy pointing to the ALB DNS name

Why wrong: Route 53 simple routing resolves to the ALB's DNS name, which resolves to the ALB's IP addresses, but those IPs can change over time. The third party requires static IPs, not a DNS name.

Use an Amazon CloudFront distribution with the ALB as the origin and provide the CloudFront IP addresses

Why wrong: CloudFront uses a shared IP range that is not dedicated to a specific distribution. These IPs also change when CloudFront updates its edge locations, so they are not a stable, dedicated set of IPs for allowlisting.

Use an AWS Network Load Balancer (NLB) with static IP addresses in front of the ALB

Why wrong: An NLB cannot directly target an Application Load Balancer. You would need to configure a target group of instances or IPs, which adds complexity and does not leverage the ALB's advanced features. Global Accelerator is the simpler and recommended solution.

Add a route in the VPC route table pointing to the on-premises network via a NAT gateway

Why wrong: A NAT gateway is used to provide internet access to instances in private subnets. It is not used to route traffic to on-premises networks via Direct Connect.

Add a route in the VPC route table pointing to the on-premises network via an internet gateway

Why wrong: An internet gateway allows traffic to and from the internet. Using it for on-premises traffic would route over the public internet, defeating the purpose of Direct Connect.

Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection

Why wrong: VPC peering is used to connect two VPCs, not a VPC to an on-premises network. Direct Connect requires a VGW or a Transit Gateway.

AWS Transit Gateway

Why wrong: Transit Gateway is a hub-and-spoke solution best for many VPCs; for just two VPCs, peering is simpler and cheaper.

AWS Direct Connect

Why wrong: Direct Connect is for connecting on-premises data centers to AWS, not for inter-VPC connectivity.

AWS Site-to-Site VPN

Why wrong: VPN connects on-premises networks to AWS, not VPC-to-VPC; also uses public internet and incurs hourly costs.

Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

Why wrong: When Global Accelerator routes traffic to an ALB endpoint, it replaces the source IP with its own IP addresses. The original client IP is not preserved in the X-Forwarded-For header by default; the header will contain the Global Accelerator IPs.

Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

Why wrong: Proxy Protocol is used with Network Load Balancers to preserve client IP. Application Load Balancers do not support Proxy Protocol; they rely on the X-Forwarded-For header. This option is not valid for ALBs.

Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

Why wrong: CloudFront, like Global Accelerator, does not preserve the original client IP when the origin is an ALB. It also adds a CDN layer which may not be necessary for this use case and introduces additional cost and complexity.

Geolocation routing

Why wrong: Geolocation routing directs traffic based on the geographic location of the user, not the actual latency. It does not automatically adapt to changes in network conditions.

Weighted routing

Why wrong: Weighted routing distributes traffic based on assigned weights. It does not consider latency or health for routing decisions and would not automatically failover to the healthy region.

Failover routing

Why wrong: Failover routing is used for active-passive configurations. All traffic goes to the primary region unless it fails, then goes to the secondary. It does not consider latency and cannot route based on performance.

Use AWS Transit Gateway with attachment route tables that isolate traffic between VPCs, ensuring that VPC A and VPC B routes are separate.

Why wrong: Transit Gateway can segregate traffic using separate route tables, but overlapping CIDR blocks (VPC A and VPC B both have 10.0.0.0/16) cause routing ambiguity. While the route tables can prevent direct communication, traffic destined to VPC C (unique CIDR) works, but the overlapping issue complicates routing and may lead to unpredictable behavior. Transit Gateway is not recommended for overlapping CIDRs.

Create two VPC peering connections: one between VPC A and VPC C, and one between VPC B and VPC C.

Why wrong: VPC peering does not support overlapping CIDR blocks. If VPC A and VPC B both have CIDR 10.0.0.0/16, they cannot peer with VPC C if VPC C's CIDR also overlaps? VPC C is 10.1.0.0/16, no overlap. The peering between VPC A and VPC C would work, but VPC A's route table would need a route to VPC C (10.1.0.0/16) via the peering connection. However, if VPC A has a subnet 10.0.0.0/24, and VPC B has a subnet 10.0.1.0/24, traffic from VPC A to 10.0.1.0/24 would be sent to the peering connection if a route exists, but that's only for VPC C? This is messy. VPC peering requires non-overlapping CIDRs to function correctly because if VPC A has 10.0.0.0/16 and tries to reach 10.0.1.0/24 (which is in VPC B, but they are not peered), it will route locally. But with VPC C, peering is fine. However, VPC peering does not scale well for many VPCs as it requires full mesh or hub-and-spoke. This option is valid but less scalable and may have issues if future VPCs have overlapping CIDRs.

Set up two AWS Site-to-Site VPN connections from VPC C to VPC A and VPC B using virtual private gateways.

Why wrong: Site-to-Site VPN is designed for connecting on-premises networks to AWS, not for VPC-to-VPC connectivity. While it could technically work, it is not optimal for within-region VPC connectivity due to higher latency, cost, and complexity. Also, overlapping CIDRs still cause routing issues.

Amazon CloudFront with origins configured for both dynamic and static content

Why wrong: CloudFront is a content delivery network (CDN) that caches content at edge locations and supports HTTP/HTTPS only. It does not support UDP traffic, which is essential for many gaming applications.

AWS Shield Advanced

Why wrong: AWS Shield Advanced provides cost-effective protection against distributed denial-of-service (DDoS) attacks. It does not accelerate content delivery or improve latency for normal traffic.

AWS App Mesh

Why wrong: AWS App Mesh is a service mesh that provides application-level networking for microservices. It does not provide global acceleration or edge-based content delivery.

AWS Transit Gateway

Why wrong: Transit Gateway is a network transit hub that can connect many VPCs and on-premises networks. For just two VPCs, VPC peering is simpler and less expensive.

AWS Direct Connect

Why wrong: Direct Connect is a dedicated network connection from on-premises to AWS, not designed for VPC-to-VPC connectivity.

Internet Gateway

Why wrong: An Internet Gateway allows outbound and inbound internet traffic. It does not provide private communication between VPCs; traffic would be routed over the public internet.

Create a NAT gateway in a public subnet and update the private route tables to point 0.0.0.0/0 to the NAT gateway.

Why wrong: This provides internet access via NAT, but traffic still traverses the internet, and it incurs NAT gateway costs. Does not meet the 'without traversing the internet' requirement.

Create a VPC endpoint for S3 (Interface type) and assign a security group to the endpoint.

Why wrong: While Interface Endpoints also work for S3, they are more expensive and typically used when you need PrivateLink functionality. Gateway Endpoints are the recommended and simpler option for S3.

Create an AWS Direct Connect connection and route traffic to S3 through the on-premises network.

Why wrong: This adds unnecessary complexity and cost. Direct Connect is for extending on-premises networks, not for VPC-to-S3 access within the same region.

Create a CloudFront distribution and point it to the ALB as an origin.

Why wrong: CloudFront is primarily for caching static and dynamic content, but it does not provide the same low-latency, static IP address capabilities for dynamic content that Global Accelerator offers. Global Accelerator is better suited for non-cacheable traffic.

Set up a Route 53 geoproximity routing policy for the ALB.

Why wrong: Route 53 geoproximity routing can route users to the closest region, but Global Accelerator provides additional benefits like anycast static IPs and faster failover, making it the preferred solution for this requirement.

Use AWS WAF to allow traffic from Global Accelerator edge locations.

Why wrong: AWS WAF is a web application firewall that protects against common web exploits. It does not route traffic or accelerate content delivery.

Establish a single Direct Connect connection with a VPN backup.

Why wrong: A VPN backup adds redundancy but the VPN uses the public internet, which may have variable performance and reliability. A second Direct Connect connection is more reliable.

Establish two Direct Connect connections to the same AWS Direct Connect location.

Why wrong: Having two connections to the same location provides device-level redundancy but still depends on the same physical location. If that location experiences an outage, both connections could fail.

Use multiple virtual interfaces on a single Direct Connect connection.

Why wrong: Multiple virtual interfaces provide logical separation but do not add physical redundancy. A single physical connection failure will bring down all virtual interfaces.

Place the web servers in public subnets and assign each instance an Elastic IP address.

Why wrong: This would give static IPs but exposes the instances directly to the internet, increasing the attack surface and going against the requirement for private subnets.

Create a VPC endpoint for the external API service.

Why wrong: VPC endpoints are only supported for AWS and some third-party services listed in AWS PrivateLink. Most external APIs do not support VPC endpoints.

Use AWS Global Accelerator to provide static IP addresses for outbound traffic.

Why wrong: Global Accelerator provides static IPs for inbound traffic to your application, not for outbound traffic from your instances.

AWS Site-to-Site VPN

Why wrong: A VPN connection would require a virtual private gateway in each VPC and tunnels over the internet, adding complexity and potential throughput limitations. It is not the simplest solution for VPC-to-VPC connectivity.

AWS Direct Connect

Why wrong: Direct Connect is designed for dedicated private connections from on-premises to AWS, not for connecting two VPCs. It would be expensive and unnecessarily complex for this use case.

AWS Transit Gateway

Why wrong: Transit Gateway is a centralized hub for connecting many VPCs and on-premises networks. For only two VPCs, it introduces additional cost (hourly fee) and operational overhead without benefit over VPC peering.

Configure static routes in the VPC route table pointing to each VPN connection.

Why wrong: Static routes require manual updates for each new branch and do not automatically propagate routes between VPN connections, making this approach less scalable and more operationally heavy.

Create a separate Transit VPC with EC2-based VPN appliances to route traffic between branch offices.

Why wrong: This approach adds unnecessary complexity and cost. The VPN CloudHub model using a single VPC with dynamic routing is simpler and achieves the same goal.

Place all branch offices in the same IPsec tunnel by configuring identical pre-shared keys.

Why wrong: IPsec tunnels are point-to-point connections; placing multiple branches in the same tunnel is not possible and would cause routing conflicts.

AWS Global Accelerator

Why wrong: Global Accelerator improves latency by routing traffic over the AWS global network to the closest edge, but it does not cache content or offload SSL termination in the same way as a CDN.

AWS WAF (Web Application Firewall)

Why wrong: AWS WAF is a security service that protects web applications from common exploits; it does not improve latency or provide content caching.

Amazon Route 53 with Latency Based Routing

Why wrong: Route 53 latency-based routing directs traffic to the region with the lowest latency, but it does not provide caching or SSL offloading; it only handles DNS resolution.

AWS Transit Gateway

Why wrong: unnecessary for the stated requirement and more expensive for just two VPCs.

AWS Direct Connect

Why wrong: Used for on-premises to AWS connectivity, not VPC-to-VPC.

AWS VPN CloudHub

Why wrong: Used for connecting branch offices to AWS, not VPC-to-VPC.

AWS Global Accelerator

Why wrong: Optimizes TCP/UDP traffic, not static content caching.

Amazon Route 53 latency-based routing

Why wrong: Directs traffic to region with lowest latency but does not cache content.

S3 Transfer Acceleration

Why wrong: Speeds up uploads to S3, not downloads or global delivery.

AWS Transit Gateway

Why wrong: Transit Gateway is a hub-and-spoke model that can connect many VPCs and on-premises networks. For only two VPCs, it introduces unnecessary complexity and additional hourly costs, making it less optimal.

AWS VPN CloudHub

Why wrong: VPN CloudHub is designed to connect multiple on-premises locations using VPN connections to a virtual private gateway. It is not intended for VPC-to-VPC connectivity within AWS.

AWS Direct Connect

Why wrong: Direct Connect is a dedicated network connection from on-premises to AWS. It is not used for connecting VPCs together and involves significant cost and setup time.