SAA-C03 Scalable Network Architectures Guide

Performance in AWS networking is about placing traffic on the right path. SAA-C03 wants to know whether you can choose the right load balancer, edge service, hybrid link, and VPC topology so the network supports scale instead of quietly becoming the bottleneck.

What AWS is explicitly testing

The exam guide points to edge networking services, subnet tiers and routing, load balancing, network connection options such as VPN, Direct Connect, and PrivateLink, and scalable topology design.

Network chooser

Load balancer and edge chooser

The architecture question behind the services

SAA-C03 often hides the decision inside one of these phrases:

• “global users need lower latency”
• “hybrid network needs predictable performance”
• “the app must expose only one service privately across VPCs”
• “the traffic is TCP, not HTTP”

Those are not generic networking clues. They usually point directly toward CloudFront, Global Accelerator, Direct Connect, PrivateLink, ALB, or NLB.

Edge and load-balancing choices solve different problems

If the requirement is cacheable HTTP content, CloudFront is usually stronger than Global Accelerator. If the requirement is static anycast entry for TCP/UDP or regional failover, Global Accelerator becomes stronger.

Request-path pattern you should recognize

    flowchart LR
	  U["Global users"] --> E["CloudFront or Global Accelerator"]
	  E --> L["ALB or NLB"]
	  L --> A["Application tiers in the right subnets"]

What matters here is not the exact shape. It is the separation of concerns:

• edge service for global entry or caching
• load balancer for protocol-aware distribution
• application placement and subnet routing behind it

Example: choose an interface endpoint for private service access

This is the kind of network configuration SAA-C03 expects you to reason about:

 1Resources:
 2  ApiEndpoint:
 3    Type: AWS::EC2::VPCEndpoint
 4    Properties:
 5      VpcEndpointType: Interface
 6      VpcId: vpc-1234567890abcdef0
 7      ServiceName: com.amazonaws.us-east-1.execute-api
 8      SubnetIds:
 9        - subnet-app-a
10        - subnet-app-b
11      SecurityGroupIds:
12        - sg-endpoint

What to notice:

• this is a private service access pattern, not broad network peering
• the endpoint spans subnets and uses attached security groups, which makes it operationally different from a simple public path
• SAA-C03 often prefers this kind of narrow private exposure over opening wider connectivity than the requirement justifies

Failure patterns worth recognizing

VPC topology still affects performance

Subnet tiers, route tables, NAT placement, endpoint placement, and peering or transit choices can all become performance problems. A correct service choice with a poor traffic path can still fail the scenario.

Scenario eliminations

Network performance questions are often protocol questions in disguise. Identify whether the traffic is HTTP-aware, transport-level, edge-cacheable, hybrid, or private-service traffic before optimizing the path.

Common traps

• choosing ALB for a requirement that really needs NLB characteristics
• assuming CloudFront and Global Accelerator solve the same problem
• using broad VPC connectivity where a private service exposure model is enough
• focusing on bandwidth only when the real issue is placement, protocol, or edge routing

Decision order that usually wins

When networking answers all feel performance-related, use this order:

1. Decide whether the requirement is HTTP routing, TCP/UDP transport, edge caching, global entry, hybrid connectivity, or private service exposure.
2. If the requirement is HTTP host or path routing, prefer ALB.
3. If it is high-throughput TCP or UDP with static-IP style needs, prefer NLB.
4. If it is global HTTP caching, prefer CloudFront.
5. If it is non-HTTP global entry with fast regional failover, prefer Global Accelerator.

Quiz

Continue with 3.5 Data Ingestion & Transformation to finish the performance domain with transfer, stream, analytics, and transformation paths.