ExamworthyExamworthy
Open the appStart free

SOA-C03 - Networking and Content Delivery - Section 5.6

Identify and remediate Amazon CloudFront caching issues and troubleshoot hybrid and private connectivity over Site-to-Site VPN and Transit Gateway.

Resolve Amazon CloudFront caching problems by issuing cache invalidations and tuning time-to-live settings on cache behaviours, and troubleshoot hybrid connectivity failures over AWS Site-to-Site VPN and Transit Gateway. Distinguish stale cache issues from origin errors when diagnosing CloudFront behaviour.

CloudFront cache invalidationTime to liveAWS Site-to-Site VPNHybrid connectivity

Practice question for this objective

Free sampleNetworking and Content Deliverymedium

A company connects its data centre to a VPC through a single AWS Site-to-Site VPN that terminates on an AWS Transit Gateway. The VPN provisions two IPsec tunnels and both currently show as UP, but during a recent AWS-side tunnel maintenance event hybrid traffic stopped flowing until an engineer manually intervened. The team wants traffic to fail over automatically to the healthy tunnel and back, with the least operational overhead and no custom code. Which two actions together meet this requirement? (Select TWO.)

  • AConfigure the Site-to-Site VPN connection to use BGP dynamic routing and run BGP on the customer gateway device over both IPsec tunnels. Correct
  • BEnable route propagation from the VPN attachment into the Transit Gateway route table so the learned on-premises routes update automatically. Correct
  • CKeep the VPN on static routing and have an operator update the static routes by hand whenever one of the two tunnels reports a down state.
  • DReplace the Site-to-Site VPN with a new AWS Direct Connect circuit so that hybrid traffic gains a dedicated, more reliable physical path.
  • EPlace AWS Global Accelerator in front of the two VPN tunnel endpoints so that it fails connections over to the healthy tunnel quickly.
Combine BGP dynamic routing on a Site-to-Site VPN with Transit Gateway route propagation to deliver automatic tunnel failover for hybrid connectivity with minimal operational overhead. A Site-to-Site VPN provisions two tunnels for resilience, but automatic failover depends on dynamic routing. BGP on the customer gateway over both tunnels withdraws and re-advertises routes as a tunnel changes state, steering traffic to the healthy tunnel. On the AWS side, route propagation feeds those BGP-learned prefixes into the Transit Gateway route table and updates them as state changes, so forwarding follows the active tunnel. Static routing needs manual edits, Direct Connect is a separate physical link rather than a VPN failover mechanism, and Global Accelerator does not front IPsec tunnels.

Why A is correct: BGP peering on both tunnels lets the customer gateway detect a tunnel going down and shift traffic to the healthy tunnel automatically, with no manual change.

Why B is correct: Propagation installs the BGP-learned on-premises prefixes and refreshes them as tunnel state changes, so the AWS-side forwarding tracks the active tunnel without manual edits.

Why C is wrong: Static routing is tempting because the VPN still passes traffic, but it cannot reroute on its own and the manual updates are exactly the overhead the team wants to remove.

Why D is wrong: Direct Connect is a more reliable link, but provisioning a new physical circuit is a re-architecture with lead time, not a low-overhead way to make the existing two tunnels fail over.

Why E is wrong: Global Accelerator fronts application endpoints such as load balancers, not IPsec Site-to-Site VPN tunnels, so it cannot manage failover between the tunnels at all.

See more SOA-C03 practice questions, answers explained.

More in this domain

Back to all Networking and Content Delivery objectives, or the SOA-C03 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.