SAP-C03 practice question: Global traffic routing (Route 53 policies, Global Accelerator)
Architecture Design and Implementation Built for the Cloud A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A logistics firm's handheld scanners talk to a custom TCP service on port 8443 that runs in two AWS Regions. Port 8443 is not HTTP, so the service sits behind Network Load Balancers. The scanner firmware resolves the service name once at startup and caches the answer until the device restarts.
The firm's carrier partners must allowlist a fixed set of IP addresses, so the addresses must not change when traffic moves between Regions. If one Region becomes unhealthy, scanner traffic must move to the other Region within about a minute, without the partners changing their firewalls.
Which solution meets these requirements?
Choose one answer.
AA. Create an AWS Global Accelerator accelerator with a TCP listener on port 8443, add the Network Load Balancer in each Region as an endpoint, and give the partners the accelerator's static IP addresses.
BB. Create Amazon Route 53 failover records that point to each Region's Network Load Balancer, assign Elastic IP addresses to both load balancers, and give the partners all of those addresses to allowlist.
CC. Create an Amazon CloudFront distribution with an origin group that fails over between the two Regions' Network Load Balancers, and have the partners allowlist CloudFront's published IP ranges.
DD. Place an Application Load Balancer with AWS WAF in each Region, and use Route 53 weighted records to split scanner traffic between them.
Show the answer and explanation
Answer: A
A. Right: Correct. Global Accelerator gives two static anycast IP addresses that stay the same, and it routes to the healthier Region when an endpoint fails. It works for TCP traffic on any port.
B. Wrong: The partners could allowlist both Regions' fixed addresses, but failover depends on the scanners resolving DNS again. Because the scanners cache the answer until they restart, traffic would not move to the other Region within a minute.
C. Wrong: CloudFront serves HTTP and HTTPS traffic, not custom TCP on port 8443. The published IP ranges are also shared by many customers, which makes an allowlist too broad.
D. Wrong: An Application Load Balancer handles HTTP and HTTPS, so it cannot carry the custom TCP service. Weighted records also do not give the partners fixed addresses.
Explanation
Global Accelerator provides static IP addresses for TCP traffic and health-based failover between Regions without any DNS change, so cached answers on the scanners do not matter. DNS failover depends on new lookups, CloudFront does not carry custom TCP, and an Application Load Balancer cannot carry the non-HTTP protocol.
Want more on Global traffic routing (Route 53 policies, Global Accelerator)? The 5 full-length practice sets have 5 more Global traffic routing (Route 53 policies, Global Accelerator) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →