Practice Test #3

A Network Load Balancer can distribute TCP/UDP traffic, but it is not purpose-built for transparent inline security appliance insertion across VPCs. NLB does not provide the same route-table-based service insertion model (via endpoints) that makes steering traffic to appliances operationally simple. You would still need additional routing, NAT, or proxy patterns and may lose key transparency requirements, increasing management overhead.

An Application Load Balancer operates at Layer 7 (HTTP/HTTPS) and typically terminates client connections, which is not appropriate for generic packet inspection and can break end-to-end encryption expectations unless you manage certificates and re-encryption. DLP appliances that inspect packets at the network layer are not integrated through ALB in a transparent way. This adds complexity and is not the intended AWS pattern.

A transit gateway is excellent for hub-and-spoke connectivity and centralized routing between VPCs and on-premises networks. However, it does not by itself provide a managed mechanism to load balance traffic through a fleet of security appliances or to perform transparent service insertion. You would still need to build custom routing and scaling/HA patterns for the appliance, increasing operational overhead compared to GWLB.

EC2 Instance Connect simplifies SSH key delivery, but it does not remove the need for network-level SSH reachability to the instance. In private subnets, you still need a path such as a bastion host, VPN, or Direct Connect to reach port 22. Also, the option explicitly creates a bastion host, which the requirement forbids. Operationally, it still involves managing an access host and related security controls.

A Site-to-Site VPN is valid for private access, but it is not the most cost-effective or simplest for a distributed developer population. Requiring developers to use an additional client VPN (or “second VPN”) adds complexity, support overhead, and potentially extra licensing/cost. It also shifts the solution away from a straightforward AWS-managed administrative access pattern and does not inherently provide session-level auditing like Session Manager.

A public bastion host is a traditional pattern, but it violates the “without bastions” requirement and increases operational burden (patching, hardening, monitoring, key management, and incident response). It also requires opening inbound SSH to the bastion (even if restricted), managing security group rules, and handling SSH keys. This is typically less secure and less cost-optimized than Session Manager for ongoing operations.

This option is incorrect because AWS Cost Explorer does not automatically determine department ownership of resources. Department-level visibility requires a cost attribution method such as cost allocation tags or separate AWS accounts. In addition, AWS Cost Anomaly Detection is intended to identify unusual spending behavior compared to historical patterns, not to monitor a fixed budget threshold like 75% of $50,000. Therefore, this option fails both the ownership attribution requirement and the specific budget-threshold alert requirement.

This option is incorrect because although cost allocation tags are appropriate for assigning costs to departments, AWS Trusted Advisor is not a budgeting or spend-threshold notification service. Trusted Advisor provides recommendations related to cost optimization, security, performance, service limits, and fault tolerance. It does not natively track monthly spend against a defined budget and alert at 75% consumption. AWS Budgets is the correct AWS service for budget-based notifications.

This option is incorrect because AWS Cost Explorer predictive analytics can forecast future spending trends, but it cannot infer which department owns which resources without tags or account boundaries. That means it does not satisfy the requirement for clear visibility into spending by oncology, cardiology, and neurology. While AWS Budgets is the correct service for sending alerts at 75% of a monthly budget, the lack of a valid cost attribution mechanism makes the overall solution incomplete. As a result, this option does not fully meet the stated requirements.

Amazon RDS for SQL Server reduces operational overhead, but it does not provide the level of administrative/host access typically required to install and run specialized third-party libraries and custom security extensions. Replacing those components with AWS Lambda is a significant redesign and may not be feasible quickly or maintain identical functionality. This option underestimates refactoring effort and risk for a financial system.

Running SQL Server on Amazon EC2 with a SQL Server AMI provides full administrative control and can support any third-party libraries. However, it shifts responsibility for backups, patching, monitoring, and high availability/DR design back to the company, which conflicts with the goal of reducing operational overhead. While instance pricing can be optimized, the ongoing labor and operational complexity usually make it less cost-effective overall.

Migrating to Amazon Aurora PostgreSQL would require rewriting the application, stored procedures, and removing SQL Server dependencies, plus reworking third-party library integration. This is a modernization project, not a quick migration, and it introduces significant cost, time, and functional risk. Aurora can be cost-effective long term, but it is not the most cost-effective option for maintaining current functionality under tight timelines.

Incorrect. VPC peering adds operational complexity: managing two VPCs, configuring peering, updating route tables, and handling security rules across VPC boundaries. It also introduces constraints (no transitive routing, careful CIDR planning to avoid overlap). While it works, it is more overhead than simply adding a secondary CIDR to the existing VPC.

Incorrect. Transit Gateway is designed for scalable hub-and-spoke connectivity across many VPCs and on-prem networks. For a single VPC needing more IPs, TGW is unnecessary and adds cost and configuration complexity (attachments, TGW route tables, propagation/associations). It does not address the root problem as directly as expanding the existing VPC.

Incorrect. Using EC2-based VPN instances plus a Site-to-Site VPN/virtual private gateway is high operational overhead (instance management, patching, scaling, HA design) and is not the right tool for connecting two AWS VPCs for simple capacity expansion. This option is slower to deploy, more failure-prone, and more complex than native VPC CIDR expansion.