Highly available networking: SAA-C03 study notes and practice questions
What to know about Highly available networking for the SAA-C03 exam, from the Design Resilient Architectures domain (26% of the exam guide), then 1 free question to test it. Part of the SAA-C03 study guide.
Network resilience questions show a design with a hidden single point of failure and ask how to remove it, usually at the lowest cost.
Inside the VPC
Subnets live in one Availability Zone. Spread each tier across at least two zones, with an Application or Network Load Balancer in front.
NAT gateways are zonal. One NAT gateway shared by every zone means private subnets in other zones lose internet access if its zone fails. Put a NAT gateway in each zone and route each zone’s private subnets to their own. AWS added a regional NAT gateway mode in late 2025 that expands across zones automatically, but the one-per-zone design is the pattern most questions are built on.
Internet gateways, gateway endpoints and VPC routers are already highly available; you don’t need two.
Interface endpoints should have an ENI in each zone you use.
Elastic Load Balancing is redundant across the zones you enable; cross-zone load balancing spreads traffic evenly across targets in all of them.
Connecting to on premises
Option
Resilience notes
Site-to-Site VPN
Each connection has two tunnels; use both. Add a second customer gateway device for device redundancy
Direct Connect
One connection is a single point of failure. For high resiliency, use two connections at two Direct Connect locations; for maximum resiliency, two at each of two locations
Direct Connect with VPN backup
A low-cost way to survive a Direct Connect failure, at lower bandwidth
Transit Gateway
Regional and highly available; one hub for many VPCs and on-premises links
Between VPCs
VPC peering is simple and has no single point of failure, but isn’t transitive.
Transit Gateway scales to many VPCs and accounts with central routing.
PrivateLink exposes one service to many VPCs without full network access.
Common traps
One NAT gateway “to save money” when the question asks for high availability.
One Direct Connect connection called “resilient”. Add a second connection or a VPN backup.
Assuming peering is transitive. VPC A peered to B, and B to C, doesn’t connect A to C.
A company's VPC has a public subnet and a private subnet in each of two Availability Zones.
Application servers in both private subnets reach the internet through one zonal NAT gateway in the public subnet of Availability Zone A, using a single route table shared by both private subnets. During a recent outage in Availability Zone A, servers in Availability Zone B also lost internet access.
Outbound access must now keep working automatically if either zone fails.
Which change meets this requirement?
Choose one answer.
AA. Associate a second Elastic IP address with the existing NAT gateway, so that it can handle more connections and keep working during failures.
BB. Create a second NAT gateway in Availability Zone B, keep the shared route table, and switch its default route to the new gateway in an outage.
CC. Add a NAT gateway in Availability Zone B's public subnet, and give each private subnet a route table that uses its own zone's gateway.
DD. Replace the NAT gateway with a NAT instance in an Auto Scaling group of one instance that spans both Availability Zones.
Show the answer and explanation
Answer: C
A. Wrong: Extra IP addresses on a NAT gateway raise the number of simultaneous connections it supports. The gateway still runs only in Availability Zone A, so an outage there still cuts off both private subnets. Learn more: NAT gateway basics (opens in a new tab)
B. Wrong: A second gateway removes the single point of failure, but the shared route table can point the default route at only one gateway. Someone would have to change the route during an outage, so failover is manual, not automatic. Learn more: NAT gateways (opens in a new tab)
C. Right: Correct. A zonal NAT gateway is redundant only within its own Availability Zone. With a gateway in each zone and per-zone route tables, servers in each zone use their local gateway, so the failure of one zone does not affect outbound access from the other. Learn more: NAT gateway basics (opens in a new tab)
D. Wrong: The Auto Scaling group would relaunch the NAT instance in the other zone, but only after several minutes, and the route table would still point at the old instance until a script updated it. The team would also have to patch and size the instance itself.
Explanation
Each zonal NAT gateway lives in one Availability Zone, and resources in other zones that share it lose internet access if that zone fails. AWS recommends a NAT gateway in each zone with routing so that resources use the gateway in their own zone. A regional NAT gateway, which spans zones automatically, is another way to remove the single-zone dependency.
Each private subnet routes to the NAT gateway in its own zone, so losing one zone no longer cuts off the other.
Want more on Highly available networking? The 5 full-length practice sets have 10 more Highly available networking questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →