SOA-C02 Practice Exam 53 — 20 Questions

Question 1

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection is redundant with two virtual interfaces (VIFs). Recently, one VIF failed, and the administrator notices that traffic is not automatically failing over. What must be configured to enable automatic failover?

Accepted Answer

Create a VPN connection as a backup and configure route propagation with a lower priority.. AWS Direct Connect does not automatically failover. Using BGP with AS_PATH prepending or using a Direct Connect gateway with multiple VIFs can help, but the simplest approach is to use a VPN as a backup or configure BGP metrics. However, the question implies the need for active/backup. The common solution is to use a VPN connection as a backup and configure route propagation.

Answer

Configure BGP metrics to prefer the primary VIF.

Answer

Place both VIFs in the same VLAN.

Answer

Enable equal-cost multi-path (ECMP) routing.

Question 2

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. Option B is correct because the most common issue is that the route table for the private subnet does not have a default route pointing to the NAT Gateway. Option A is wrong because NACLs and security groups are stateful for NAT Gateway traffic, but the route table is the first thing to verify. Option C is wrong because the NAT Gateway's public IP is not relevant; the issue is routing. Option D is wrong because the internet gateway is needed for the NAT Gateway, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 502 errors. The SysOps administrator checks the ALB access logs and sees that the error occurs when the target group has 'unhealthy' targets. What is the MOST likely cause of the 502 errors?

Accepted Answer

The target instances are not passing health checks.. Option B is correct because unhealthy targets cause the ALB to return 502 errors when it cannot establish a connection or receive a valid response. Option A is wrong because certificate issues cause 503 errors. Option C is wrong because client request timeout causes 408 errors. Option D is wrong because insufficient capacity causes 503 errors.

Answer

The SSL certificate on the ALB is expired.

Answer

The ALB does not have enough capacity to handle the traffic.

Answer

The client request exceeds the idle timeout.

Question 4

A company has an internal Application Load Balancer (ALB) in a VPC. The ALB is used by an on-premises application via AWS Direct Connect. The on-premises application needs to resolve the ALB's DNS name. The VPC has Route 53 private hosted zone associated with the VPC. The on-premises DNS servers are configured to forward queries for the company's domain to the VPC's Route 53 inbound resolver endpoints. However, the on-premises application cannot resolve the ALB's DNS name. What is the likely cause?

Accepted Answer

The ALB's DNS name is not in the Route 53 private hosted zone.. The ALB's DNS name is a public DNS name, not a private one. The Route 53 private hosted zone only contains records for the private hosted zone's domain. To resolve public DNS names on-premises via Direct Connect, the on-premises DNS servers need to forward queries to the Route 53 inbound resolver, but the resolver may not be configured to resolve public DNS names unless the private hosted zone is associated with the VPC and the record is private. Actually, the ALB's DNS name is public, so the on-premises DNS should resolve it via the public internet or via the Route 53 inbound resolver if the resolver is configured to forward queries to the public internet. The likely cause is that the ALB's DNS name is not in the private hosted zone. Option B is incorrect because the ALB is internal, meaning it has a private IP, but its DNS name is still public. Option C is incorrect because the inbound resolver is not required to resolve public names unless configured to do so. Option D is incorrect because the ALB's security group does not affect DNS resolution.

Answer

The ALB's security group blocks inbound traffic from the on-premises CIDR.

Answer

The ALB is internal and does not have a public DNS name.

Answer

The Route 53 inbound resolver is not configured to forward queries to the public internet.

Question 5

A web application on EC2 instances behind an ALB experiences increased latency during peak hours. The SysOps administrator notices that the ALB's RequestCount per target is high. What design change should improve performance?

Accepted Answer

Add more EC2 instances to the target group.. Increasing the number of targets (EC2 instances) spreads the load and reduces latency.

Answer

Switch to a Network Load Balancer.

Answer

Enable sticky sessions on the ALB.

Answer

Reduce the idle timeout on the ALB.

Question 6

A company uses Amazon CloudFront to serve content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Users report that they can access the content via CloudFront but also directly via the S3 bucket URL. How can the company restrict direct access to the S3 bucket?

Accepted Answer

Update the S3 bucket policy to deny access to any principal other than the CloudFront service.. Option A is correct because an S3 bucket policy that denies all access except when the request includes a specific CloudFront header (via OAC) or is from the CloudFront service principal is the standard way to restrict direct access. Option B is wrong because removing the bucket policy would make the bucket public if ACLs allow, but OAC requires a bucket policy to allow CloudFront access. Option C is wrong because using a pre-signed URL is for temporary access, not for blocking direct access. Option D is wrong because OAC already restricts access to CloudFront only; the bucket policy must explicitly deny all other principals.

Answer

Disable OAC and use Origin Access Identity (OAI) instead.

Answer

Use pre-signed URLs for all S3 requests.

Answer

Remove the bucket policy and rely on ACLs.

Question 7

A SysOps administrator needs to route traffic for a domain name 'example.com' to an Application Load Balancer. Which AWS service should be used to create the DNS record?

Accepted Answer

Amazon Route 53. Option A is correct. Amazon Route 53 is the DNS service to manage domain records. Option B is wrong because CloudFront is a CDN. Option C is wrong because ALB is the load balancer itself. Option D is wrong because EC2 is compute.

Answer

Amazon EC2

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 8

A SysOps administrator is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which THREE components are required to achieve this?

Accepted Answer

An Internet Gateway attached to the VPC. Option A, Option D, and Option E are correct. A NAT Gateway in a public subnet, an Internet Gateway attached to the VPC, and a route table in the private subnet with a default route to the NAT Gateway are all required. Option B is wrong because a VPN is not needed. Option C is wrong because a VPC Gateway Endpoint is for specific services like S3, not general internet access.

Answer

A VPC Gateway Endpoint

Answer

A Site-to-Site VPN connection

Question 9

A SysOps administrator needs to troubleshoot connectivity between two EC2 instances in the same VPC but different subnets. The instances cannot communicate. Which THREE checks should the administrator perform? (Choose three.)

Accepted Answer

Verify that the network ACLs for both subnets allow the required traffic. Correct answers: A, B, and D. Option A is correct because security groups control traffic at the instance level. Option B is correct because network ACLs control traffic at the subnet level. Option D is correct because route tables determine if the subnets can route to each other. Option C is wrong because NAT Gateways are for internet access, not internal VPC communication. Option E is wrong because flow logs are for monitoring, not a direct cause.

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Verify that the NAT Gateway is configured correctly

Question 10

A company is using Amazon CloudFront with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible via CloudFront. The SysOps administrator has configured an Origin Access Identity (OAI) and updated the bucket policy to allow access only to the OAI. However, users are still able to access the S3 bucket directly via the S3 URL. What is the most likely reason?

Accepted Answer

The bucket policy allows public read access in addition to the OAI access.. The OAI restricts access to the bucket when accessed via CloudFront, but if the bucket policy allows public read access, users can still access the bucket directly. The OAI restriction must be the only means of access; the bucket policy must deny all other principals. Option B is incorrect because the OAI is properly associated. Option C is incorrect because the bucket is not set to static website hosting. Option D is incorrect because the bucket policy does not need to include a condition if it denies everyone except the OAI.

Answer

The bucket policy does not include a condition to require the OAI.

Answer

The OAI is not properly associated with the CloudFront distribution.

Answer

The S3 bucket is configured as a static website.

Question 11

An organization wants to block traffic from specific IP addresses at the edge of the AWS network before it reaches the application. Which service should be used?

Accepted Answer

AWS WAF. AWS WAF integrates with CloudFront and ALB to filter traffic based on IP addresses. For edge blocking, CloudFront with WAF is the best choice.

Answer

Security groups

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 12

A company has deployed a web application across multiple Availability Zones using an Application Load Balancer. The application experiences increased latency during peak hours. Which action would be MOST effective in reducing latency?

Accepted Answer

Add more EC2 instances to the target group.. Option C is correct because enabling connection idle timeout can help free up resources by closing idle connections, but the most effective for latency is to add more targets. Option A is wrong because enabling cross-zone load balancing is already default and helps distribute traffic evenly. Option B is wrong because increasing the deregistration delay does not reduce latency. Option D is wrong because updating health checks does not directly reduce latency.

Answer

Update the health check to use a more frequent interval.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay for the target group.

Question 13

A company has a VPC with public and private subnets across three Availability Zones. The public subnets host NAT Gateways, and the private subnets host EC2 instances that need to access the internet. The SysOps administrator notices that EC2 instances in one private subnet cannot reach the internet, while others can. What is the MOST likely cause?

Accepted Answer

The route table for the private subnet does not have a default route to the NAT Gateway.. Option C is correct. The route table for the private subnet must have a default route (0.0.0.0/0) pointing to the NAT Gateway. If missing, internet access fails. Option A is wrong because NAT Gateways are in public subnets. Option B is wrong because NACLs are stateless but would affect all instances. Option D is wrong because the secondary private IP is irrelevant.

Answer

The EC2 instances have a secondary private IP address that is not registered.

Answer

The NAT Gateway is not in a public subnet.

Answer

The network ACL for the private subnet blocks outbound traffic.

Question 14

Refer to the exhibit. A company has an S3 bucket policy as shown. The SysOps administrator notices that users from the allowed IP range (192.0.2.0/24) can access objects, but users outside that range are denied. However, a CloudFront distribution with an origin access identity (OAI) is also unable to access the bucket and receives 'Access Denied'. What is the MOST likely cause?

Accepted Answer

The condition aws:SourceIp restricts access based on the requestor's IP, not the CloudFront IP.. Option D is correct. The bucket policy uses aws:SourceIp condition, which blocks CloudFront because CloudFront's IPs are different from the client IP. To allow CloudFront access while restricting direct access, the policy should use aws:SourceArn or refer to the OAI. Option A is wrong because the OAI is not mentioned in the policy. Option B is wrong because the policy allows GetObject. Option C is wrong because the bucket policy allows from 192.0.2.0/24.

Answer

The policy does not allow 's3:GetObject' for the CloudFront OAI.

Answer

The CloudFront distribution is not in the allowed IP range.

Answer

The CloudFront OAI is not configured in the bucket policy.

Question 15

A SysOps administrator notices that an EC2 instance is not receiving traffic from an Application Load Balancer (ALB). The ALB is healthy and the target group shows the instance as healthy. The exhibit shows the network interface attached to the instance. What is the likely cause of the issue?

Accepted Answer

The instance's security group does not allow inbound traffic from the ALB. Option A is correct because the source/destination check is enabled (true) on the ENI. When an ALB sends traffic to an instance, the instance must have source/destination check disabled if it is acting as a NAT or routing device, but in this case the ALB's ENI is attached to the instance. Actually, the exhibit shows the ENI of the ALB? Wait, the description says "ELB app/alb-..." which indicates it's an ALB ENI. The issue is that the ALB's ENI has source/dest check enabled, which is normal for ALB? No, ALB ENIs are managed by AWS and source/dest check is typically disabled. However, the question states that the instance is not receiving traffic. The correct answer is that the security group of the instance may be blocking traffic. But the exhibit shows the ENI group is "default". Option A is correct because the source/destination check being enabled on the instance's ENI could cause the instance to drop traffic if it's not the intended destination. But more likely, the security group of the instance (sg-12345678) may not allow traffic from the ALB. However, given the options, Option A is the only one that fits. Let's choose A. Explanation: The source/destination check must be disabled for the instance to accept traffic from the ALB? Actually, that's wrong. The source/destination check is for the instance to process traffic that isn't destined to its own IP. For ALB traffic, the destination IP is the instance's IP, so source/dest check doesn't matter. The real issue is that the security group of the instance does not allow traffic from the ALB. But the exhibit shows the ENI's group is "default", which likely doesn't allow HTTP/HTTPS. Option C is also plausible. To align with the exhibit, let's pick Option C. I'll correct: The exhibit shows the network interface of the ALB, not the instance. The instance's ENI is not shown. The ALB ENI has source/dest check enabled, which is normal. The issue is that the instance's security group may not allow traffic. Option C is correct: The instance's security group is blocking traffic. Explanation: Option C is correct because the security group associated with the instance must allow inbound traffic from the ALB. Option A is wrong because source/dest check on the ALB ENI is fine. Option B is wrong because the ALB ENI is in a public subnet? Not necessarily. Option D is wrong because network ACLs are stateless and if inbound is allowed, outbound must also be allowed.

Answer

The source/destination check is enabled on the network interface

Answer

The network interface is in a private subnet

Answer

The network ACL of the subnet denies inbound traffic

Question 16

A company has a VPC with a public subnet and a private subnet. An Amazon RDS for MySQL database is deployed in the private subnet. Which TWO steps are required to allow an EC2 instance in the public subnet to connect to the database? (Choose two.)

Accepted Answer

Update the security group for the RDS instance to allow inbound traffic on port 3306 from the EC2 instance's security group.. Options B and D are correct: The security group for the RDS instance must allow inbound MySQL traffic (port 3306) from the EC2 instance (or its security group). The route table for the private subnet does not need a NAT Gateway because the connection is initiated from the public subnet; however, the public subnet instance needs a route to the private subnet, which is automatically there because both are in the same VPC. Option A is wrong because the RDS instance does not need a public IP; it can be accessed from within the VPC using its private IP. Option C is wrong because the EC2 instance already has a public IP or can be accessed via internet, but the route to the private subnet is implicit. Option E is wrong because a NAT Gateway is for outbound internet access from private subnets, not for inbound connections.

Answer

Deploy a NAT Gateway in the public subnet to allow the EC2 instance to communicate with the RDS instance.

Answer

Assign a public IP address to the RDS instance.

Answer

Add a route to the public subnet's route table for the RDS subnet CIDR.

Question 17

A company's web application is hosted on EC2 instances behind a Network Load Balancer (NLB) with a static IP address. The application receives a sudden spike in traffic, and some clients report connection timeouts. Which NLB feature should the SysOps administrator configure to handle the increased load?

Accepted Answer

Enable cross-zone load balancing.. Option B is correct. NLB cross-zone load balancing distributes traffic across all registered instances in all AZs, improving capacity. Option A is wrong because health checks help identify unhealthy instances but do not increase capacity. Option C is wrong because stickiness is for session persistence. Option D is wrong because deletion protection prevents accidental deletion.

Answer

Enable sticky sessions.

Answer

Enable deletion protection.

Answer

Enable health checks to mark unhealthy instances.

Question 18

A company runs a multi-tier web application in a VPC with public and private subnets. The web servers (EC2 instances) are in public subnets, and the database servers (RDS MySQL) are in private subnets. The web servers need to connect to the database servers on port 3306. The security group for the RDS instances (sg-db) has an inbound rule allowing TCP port 3306 from the security group of the web servers (sg-web). The web servers can connect to the database, but the connection is intermittent and slow. The SysOps administrator checks the network ACLs and finds that both the public and private subnet network ACLs have default allow all entries. What is the most likely cause of the issue?

Accepted Answer

The network ACL for the private subnet does not have an outbound rule to allow return traffic on ephemeral ports. Option D is correct because the network ACL for the private subnet has no outbound rule to allow return traffic (ephemeral ports) from the database back to the web servers. Network ACLs are stateless, so despite the inbound rule allowing traffic from the web servers, the outbound rule must allow return traffic. Option A is wrong because the security group rule is correct. Option B is wrong because RDS is not a web server; it doesn't need a public subnet. Option C is wrong because NACLs are stateless, not stateful.

Answer

The RDS instances are in a private subnet and cannot receive traffic from public subnets

Answer

The security group for the RDS instances is missing an inbound rule for port 3306 from the web servers' IP range

Answer

The network ACLs are stateful and require an outbound rule for ephemeral ports

Question 19

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The VPC has a private subnet with EC2 instances that need to communicate with on-premises servers. The on-premises network team reports that they can ping the EC2 instances, but the EC2 instances cannot ping the on-premises servers. The SysOps administrator checks the route tables and finds that the VPC has a route to the on-premises CIDR via the virtual private gateway. The security groups allow all ICMP traffic. What is the most likely cause?

Accepted Answer

The on-premises network does not have a route back to the VPC CIDR through the Direct Connect. Option C is correct because the on-premises servers need to have a route back to the VPC CIDR through the Direct Connect. The fact that they can ping the EC2 instances indicates that traffic from on-premises to VPC is working, but the return traffic may be going through the internet instead of Direct Connect if the on-premises route is not configured. Option A is wrong because the VPC route is present. Option B is wrong because security groups allow ICMP. Option D is wrong because NACLs default to allow all.

Answer

The security group on the EC2 instances blocks outbound ICMP

Answer

The network ACL for the private subnet blocks outbound traffic

Answer

The VPC route table does not have a route to the on-premises CIDR via the virtual private gateway

Question 20

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. Users report intermittent 503 errors. The SysOps Administrator checks the ALB metrics and sees that the Sum of HTTP 503s correlates with spikes in CPU utilization on the EC2 instances. What is the MOST likely cause and solution?

Accepted Answer

Configure the Auto Scaling group to scale out based on average CPU utilization and ensure sufficient capacity.. Option C is correct because high CPU utilization on instances can cause them to become unhealthy, leading the ALB to stop sending traffic and returning 503 errors. Option A is wrong because cross-zone load balancing distributes traffic evenly across all zones; disabling it could worsen the issue. Option B is wrong because decreasing the health check interval would make the ALB check more frequently, potentially marking instances unhealthy faster. Option D is wrong because increasing the deregistration delay only affects instances being deregistered, not the current issue.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay on the ALB target group to allow in-flight requests to complete.

Answer

Decrease the health check interval to detect unhealthy instances faster.