Exams / SAA-C03 / Highly available networking / Question 1
SAA-C03 practice question: Highly available networking
Design Resilient Architectures A free question from our original SAA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A company's VPC has a public subnet and a private subnet in each of two Availability Zones. Application servers in both private subnets reach the internet through one zonal NAT gateway in the public subnet of Availability Zone A, using a single route table shared by both private subnets. During a recent outage in Availability Zone A, servers in Availability Zone B also lost internet access. Outbound access must now keep working automatically if either zone fails. Which change meets this requirement?
Choose one answer.
- AA. Associate a second Elastic IP address with the existing NAT gateway, so that it can handle more connections and keep working during failures.
- BB. Create a second NAT gateway in Availability Zone B, keep the shared route table, and switch its default route to the new gateway in an outage.
- CC. Add a NAT gateway in Availability Zone B's public subnet, and give each private subnet a route table that uses its own zone's gateway.
- DD. Replace the NAT gateway with a NAT instance in an Auto Scaling group of one instance that spans both Availability Zones.
Show the answer and explanation
Answer: C
- A. Wrong: Extra IP addresses on a NAT gateway raise the number of simultaneous connections it supports. The gateway still runs only in Availability Zone A, so an outage there still cuts off both private subnets. Learn more: NAT gateway basics (opens in a new tab)
- B. Wrong: A second gateway removes the single point of failure, but the shared route table can point the default route at only one gateway. Someone would have to change the route during an outage, so failover is manual, not automatic. Learn more: NAT gateways (opens in a new tab)
- C. Right: Correct. A zonal NAT gateway is redundant only within its own Availability Zone. With a gateway in each zone and per-zone route tables, servers in each zone use their local gateway, so the failure of one zone does not affect outbound access from the other. Learn more: NAT gateway basics (opens in a new tab)
- D. Wrong: The Auto Scaling group would relaunch the NAT instance in the other zone, but only after several minutes, and the route table would still point at the old instance until a script updated it. The team would also have to patch and size the instance itself.
Explanation
Each zonal NAT gateway lives in one Availability Zone, and resources in other zones that share it lose internet access if that zone fails. AWS recommends a NAT gateway in each zone with routing so that resources use the gateway in their own zone. A regional NAT gateway, which spans zones automatically, is another way to remove the single-zone dependency.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.