SOA-C02 Practice Exam 52 — 20 Questions

Question 1

An organization uses Amazon CloudFront to serve static content from an S3 bucket. The content is updated frequently, but users are seeing stale files. What is the most efficient way to invalidate the cache for updated objects?

Accepted Answer

Create a CloudFront invalidation for the updated files.. CloudFront supports file invalidation to remove objects from edge caches. Using the console or API to create an invalidation for the specific paths is the direct method.

Answer

Use the S3 console to set a new cache-control header.

Answer

Change the origin path in the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 2

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Accepted Answer

Use AWS WAF with rate-based rules. AWS Shield Advanced provides DDoS protection. Using a web application firewall (WAF) at the edge helps filter malicious traffic. Security groups and NACLs are not effective against DDoS at scale.

Answer

Apply network ACLs with deny rules

Answer

Use restrictive security groups

Answer

Enable VPC Flow Logs

Question 3

A company is using Amazon Route 53 with a private hosted zone for internal DNS resolution within a VPC. The VPC is connected to an on-premises network via a VPN. On-premises resources cannot resolve DNS names in the private hosted zone. Which TWO actions should be taken to resolve this issue? (Choose two.)

Accepted Answer

Enable DNS resolution and DNS hostnames for the VPC.. Options A and D are correct: To allow on-premises resources to resolve private hosted zone names, you must set up a Route 53 inbound resolver endpoint in the VPC (A) and also enable DNS resolution for the VPC (D). Option B is wrong because a public hosted zone is for public DNS, not private. Option C is wrong because the private hosted zone is already associated with the VPC; the issue is that on-premises cannot query it. Option E is wrong because route propagation does not affect DNS resolution.

Answer

Configure route propagation from the VPN to the VPC's route table.

Answer

Associate the private hosted zone with the on-premises network.

Answer

Create a public hosted zone with the same name and associate it with the VPC.

Question 4

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option D is correct. VPC Gateway Endpoint for S3 allows private access to S3 without internet. Option A is wrong because NAT Gateway requires an internet gateway. Option B is wrong because S3 Transfer Acceleration is for speed, not private access. Option C is wrong because VPC Interface Endpoint is for other services, but Gateway Endpoint is more cost-effective for S3.

Answer

Set up a NAT Gateway in a public subnet and route traffic through it.

Answer

Use S3 Transfer Acceleration.

Answer

Create a VPC Interface Endpoint for S3.

Question 5

A SysOps administrator needs to allow an EC2 instance in a private subnet to download patches from the internet. Which AWS service should be used to achieve this securely?

Accepted Answer

NAT Gateway. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet, while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway is for public subnets. Option C is wrong because a VPC Peering connection connects VPCs, not to the internet. Option D is wrong because a VPN connection connects to on-premises networks, not the internet.

Answer

Internet Gateway (IGW)

Answer

AWS VPN

Answer

VPC Peering

Question 6

A SysOps administrator is setting up Amazon Route 53 for a domain that will be used for a web application. The application requires failover to a backup data center in another region if the primary becomes unhealthy. The administrator creates a failover routing policy with two records (primary and secondary) associated with health checks. After testing, the failover does not occur when the primary endpoint fails. What is the most likely cause?

Accepted Answer

The health check is configured to monitor the secondary endpoint instead of the primary. Option B is correct because if the health check is set to evaluate the health of the secondary endpoint instead of the primary, Route 53 will not detect the primary failure. Option A is wrong because DNS TTL affects caching but not failover behavior. Option C is wrong because the failover routing policy is independent of the domain registrar's nameservers. Option D is wrong because an alias record is not required for failover with non-AWS endpoints.

Answer

The primary record is not an alias record

Answer

The domain registrar's nameservers are not pointing to Route 53

Answer

The TTL on the primary record is set too high

Question 7

Refer to the exhibit. A SysOps administrator is troubleshooting internet connectivity for an EC2 instance in subnet subnet-0a1b2c3d4e5f6g7h8. The instance can reach other instances in the VPC but cannot access the internet. Based on the route table output, what is the most likely cause?

Accepted Answer

The NAT gateway does not have a route to an internet gateway. Option C is correct because the route table has a default route to a NAT gateway, but the exhibit does not show that the NAT gateway is in a public subnet with an internet gateway route. If the NAT gateway lacks internet access, private instances cannot reach the internet. Option A is wrong because the route table is associated with the subnet. Option B is wrong because the route exists. Option D is wrong because the VPC CIDR is local, which is fine.

Answer

The default route (0.0.0.0/0) is missing

Answer

The route table is not associated with the subnet

Answer

The VPC CIDR route is misconfigured

Question 8

A SysOps administrator is configuring an Application Load Balancer to route traffic to multiple target groups based on the URL path. The ALB is not routing traffic correctly. Which listener rule configuration should be used to route requests with path /api/* to target group A and all other requests to target group B?

Accepted Answer

Create a rule with path pattern /api/* and forward to target group A with priority 10, and a default rule with path pattern /* and forward to target group B with priority 20.. Option C is correct because the ALB listener rules are evaluated in order; the first rule with a path pattern /api/* will match, and then a default rule (catch-all) is needed for all other paths. Option A is incorrect because order is not automatically prioritized by pattern. Option B is incorrect because a single rule cannot have two conditions with different paths to different target groups. Option D is incorrect because wildcards are not allowed in condition keys.

Answer

Create a rule with a host header condition matching 'api.example.com' and forward to target group A, and a default rule forward to target group B.

Answer

Create one rule with a condition that matches /api/* and forward to target group A, and another condition in the same rule for /* to forward to target group B.

Answer

Create two rules with path patterns /api/* and /*, and set priority based on the pattern length.

Question 9

Refer to the exhibit. A SysOps administrator created this S3 bucket policy to allow CloudFront to access objects in the bucket using an origin access identity (OAI). However, users are still receiving 403 Access Denied errors when accessing the CloudFront distribution. What is the most likely cause?

Accepted Answer

The S3 bucket has Block Public Access settings enabled that deny all access. Option B is correct because the bucket policy only grants read access to the OAI, but if the bucket itself has Block Public Access settings enabled, it can override the policy and deny access. Option A is wrong because the OAI ARN is correctly formatted. Option C is wrong because CloudFront can use the OAI with S3 regardless of region. Option D is wrong because the distribution domain name does not affect the OAI access.

Answer

The CloudFront distribution uses the S3 bucket's regional domain name instead of the distribution domain name

Answer

The CloudFront distribution is in a different region than the S3 bucket

Answer

The OAI ARN in the policy is incorrect

Question 10

A company has a CloudFront distribution with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible through CloudFront. Which configuration is required to ensure that direct access to the S3 bucket is blocked?

Accepted Answer

Create an Origin Access Identity (OAI) and add a bucket policy that grants access only to the OAI. Option A is correct because Origin Access Identity (OAI) prevents direct S3 access by allowing only CloudFront to access the bucket. Option B is wrong because signed URLs control viewer access, not origin access. Option C is wrong because bucket policies alone can restrict access, but OAI is the standard way. Option D is wrong because CloudFront does not use IAM roles for origin access.

Answer

Attach an IAM role to CloudFront that allows S3 access

Answer

Set the S3 bucket policy to deny all access except from CloudFront's IP ranges

Answer

Use signed URLs for all requests

Question 11

A company deploys a web application on EC2 instances behind an Application Load Balancer. The SysOps administrator needs to allow inbound traffic only from the ALB to the EC2 instances. Currently, the EC2 security group allows inbound HTTP from 0.0.0.0/0. Which security group configuration should the administrator apply?

Accepted Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's security group.. The best practice is to reference the ALB's security group ID in the EC2 security group's inbound rule, allowing traffic from that security group. Option A is incorrect because 0.0.0.0/0 allows all traffic, defeating the purpose. Option C is incorrect because the ALB's private IPs can change. Option D is incorrect because the ALB's public IPs are not fixed and should not be used.

Answer

Keep the existing rule that allows inbound HTTP from 0.0.0.0/0, but add a network ACL to block traffic from the internet.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's public IP addresses.

Question 12

A company has a VPC with public and private subnets. A NAT Gateway is in the public subnet, and a private EC2 instance needs to download patches from the internet. The instance can reach the internet after a reboot. Which action should the SysOps administrator take to make the internet access persistent?

Accepted Answer

Update the route table of the private subnet to point 0.0.0.0/0 to the NAT Gateway.. Route tables must be manually updated after adding a NAT Gateway. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway.

Answer

Attach an internet gateway to the private subnet.

Answer

Associate an Elastic IP with the NAT Gateway.

Answer

Enable DNS resolution in the VPC.

Question 13

A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances. Users report intermittent 503 errors. Which of the following is the MOST likely cause?

Accepted Answer

The target instances are not healthy or are overloaded.. Option C is correct because 503 errors from an ALB typically indicate that the target instances are not healthy or are overwhelmed, causing the ALB to return a 503 Service Unavailable response. Option A is wrong because security group rules blocking traffic would result in 504 errors, not 503. Option B is wrong because incorrect health check configuration can cause targets to be marked unhealthy, but the symptom is still 503; however, the most direct cause is unhealthy targets. Option D is wrong because SSL certificate issues cause 502 errors, not 503.

Answer

The health check interval is set too low, causing the ALB to mark instances as unhealthy prematurely.

Answer

The SSL certificate on the ALB has expired.

Answer

The security group for the ALB is blocking incoming traffic.

Question 14

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to send traffic to an EC2 instance in subnet-B. Both instances are in the same VPC and have appropriate security group rules. However, traffic is not reaching the destination. What is the MOST likely cause?

Accepted Answer

The network ACL associated with subnet-B is denying inbound traffic from subnet-A.. Option C is correct because network ACLs are stateless and must allow both inbound and outbound traffic for ephemeral ports. If the NACL on subnet-B does not allow inbound traffic from subnet-A, the traffic will be blocked. Option A is wrong because VPC peering is not needed; both subnets are in the same VPC. Option B is wrong because the route table already has a local route for the VPC CIDR, so no additional routes are needed. Option D is wrong because security groups are stateful; if outbound is allowed, return traffic is automatically allowed.

Answer

The route table for subnet-A does not have a route for subnet-B's CIDR.

Answer

The security group on the destination instance does not allow inbound traffic from the source instance.

Answer

The VPC peering connection is not established between the two subnets.

Question 15

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot be accessed via SSH from the internet. The security group allows inbound SSH (port 22) from 0.0.0.0/0. The network ACL (NACL) for the subnet has an inbound rule allowing SSH from 0.0.0.0/0. What else could be blocking access?

Accepted Answer

The NACL outbound rule is blocking return traffic.. Option C is correct. The NACL must also have an outbound rule to allow return traffic. NACLs are stateless, so outbound rules must be explicitly set. Option A is wrong because the security group is already correct. Option B is wrong because NACL inbound is allowed. Option D is wrong because the internet gateway allows inbound traffic.

Answer

The NACL inbound rule is blocking traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group rule is misconfigured.

Question 16

An application hosted on EC2 instances behind an ALB is experiencing intermittent connectivity errors. The ALB target group is configured with health checks on port 80. The SysOps team notices that the EC2 instances pass health checks but clients still receive 503 errors. What is the most likely cause?

Accepted Answer

Security groups or network ACLs are blocking traffic from the ALB to the instances. Option D is correct because if security groups or network ACLs block traffic from the ALB to the instances, the ALB may still mark them as healthy if the health check is coming from a different source IP, but actual client traffic is blocked. Option A is wrong because if health checks pass, the target group is not empty. Option B is wrong because deregistration delay does not cause 503s. Option C is wrong because if the ALB is not in multiple AZs, it would not cause 503 errors specifically.

Answer

The deregistration delay is too high

Answer

The ALB is only configured in one Availability Zone

Answer

The target group is empty

Question 17

Refer to the exhibit. A SysOps administrator runs the describe-target-health command and sees that an EC2 instance in the target group is unhealthy with a timeout error. What is the most likely cause?

Accepted Answer

The instance's security group does not allow traffic from the ALB on the health check port. Option B is correct because the health check is timing out, which indicates that the instance is not responding to health check requests on port 80. The security group must allow inbound traffic from the ALB on the health check port. Option A is wrong because the target group is configured with port 80, which matches. Option C is wrong because the route table is less likely to cause a timeout; it would cause unreachability. Option D is wrong because the instance is in a public subnet? Not necessarily; but the health check timeout is most often a security group issue.

Answer

The target group is configured with an incorrect port

Answer

The instance is in a private subnet without a NAT gateway

Answer

The instance does not have a route to the internet

Question 18

A company is using Amazon CloudFront to deliver content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which TWO steps should be taken?

Accepted Answer

Configure the S3 bucket policy to grant the OAI s3:GetObject permission.. Options A and C are correct. Creating an Origin Access Identity (OAI) and granting it read access to the S3 bucket, then configuring the bucket policy to deny all other principals, ensures only CloudFront can access the content. Option B is incorrect because presigned URLs are for individual user access, not for CloudFront origin access. Option D is incorrect because CloudFront signed URLs restrict viewer access, not origin access. Option E is incorrect because bucket policies use OAI, not CloudFront distribution IDs.

Answer

Generate presigned URLs for all objects in the S3 bucket.

Answer

Configure CloudFront signed URLs to limit viewer access.

Answer

Set the S3 bucket policy to allow access only from the CloudFront distribution ID.

Question 19

A company has an EC2 instance that needs to have a static public IP address that does not change even if the instance is stopped and started. Which AWS resource should be attached to the instance?

Accepted Answer

An Elastic IP address. Option C is correct because an Elastic IP address is a static public IP that can be associated with an instance and remains with the account until released. Option A is wrong because public IPs assigned by AWS change when the instance is stopped. Option B is wrong because private IPs are not public. Option D is wrong because a secondary private IP is not public.

Answer

An automatically assigned public IP address

Answer

A secondary private IP address

Answer

A static private IP address

Question 20

A SysOps administrator needs to create a VPC with both public and private subnets. The public subnet will host a NAT gateway and a bastion host. The private subnet will host application servers that need outbound internet access for updates. Which routing configuration should the administrator implement?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> NAT Gateway.. The private subnet route table should have a default route (0.0.0.0/0) pointing to the NAT gateway, which is in the public subnet. The public subnet route table should have a default route pointing to the internet gateway. Option A is incorrect because the private subnet should not have a route to the internet gateway. Option C is incorrect because the private subnet should not have a route to the NAT gateway via the internet gateway. Option D is incorrect because the NAT gateway should be in the public subnet.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway via the NAT Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.