Amazon Web Services Updated SAA-C03 Exam Questions and Answers by aaryan

This answer is correct because it provides redundancy for the VPN connection between the Management VPC and the data center. If one customer gateway device or one VPN tunnel becomes unavailable, the traffic can still flow over the second customer gateway device and the second VPN tunnel. This way, the single point of failure in the VPN connection is mitigated.

References:

https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-redundant-connection.html

https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/VPC/vpn-tunnel-redundancy.html

Amazon SQS is a fully managed message queuing service that can decouple and scale microservices, distributed systems, and serverless applications. By writing orders to an SQS queue, the application can handle spikes in traffic without losing any orders. The EC2 instances in an Auto Scaling group can read from the SQS queue and process orders into the database at a steady pace. The Application Load Balancer can distribute the load across the EC2 instances and provide health checks. This solution meets all the requirements of the question, while the other options do not. References:

https://docs.aws.amazon.com/wellarchitected/latest/reliability-pillar/welcome.html

https://aws.amazon.com/architecture/serverless/

https://aws.amazon.com/sqs/

it allows the company to protect sensitive information submitted by users throughout the entire application stack and restrict access to certain applications. By configuring a CloudFront field-level encryption profile, the company can encrypt specific fields of user data at the edge locations before sending it to the origin servers. By using public-private key pairs, the company can ensure that only authorized applications can decrypt and access the sensitive information. References:

Field-Level Encryption

Encrypting and Decrypting Data

A NAT gateway enables EC2 instances in private subnets to initiate outbound IPv4 internet requests while blocking inbound traffic from the internet. Deploying NAT gateways in public subnets across two Availability Zones ensures high availability and meets the requirement for outbound-only internet access.

Option B: An internet gateway allows inbound and outbound traffic, violating the requirement to block public IPv4 access.

Option C: A shared route table does not provide the desired separation of routing for highly available architecture.

Option D: Egress-only internet gateways are designed for IPv6 traffic, not IPv4.

AWS Documentation References:

NAT Gateway Overview

Private Subnet Route Tables