SOA-C02 Networking and Content Delivery — 10 Questions

Question 1

A company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, low-latency network connection from an on-premises data center to AWS, bypassing the public internet entirely. It uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a VPC, ensuring consistent network performance and reduced latency.

Answer

AWS Virtual Private Gateway

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 2

A company has two VPCs in different AWS regions (us-east-1 and eu-west-1) that are peered. Applications in both VPCs need to communicate using private IP addresses. The ping tests are successful, but the latency is significantly higher than expected. Which change is most likely to improve the latency between the VPCs?

Accepted Answer

Enable DNS resolution for the VPC peering connection.. Option A is correct because enabling DNS resolution for the VPC peering connection allows instances to resolve public DNS hostnames to the private IP addresses of the peered VPC. Without this, DNS queries may return public IP addresses, forcing traffic to traverse the internet or NAT gateways, which adds significant latency. By resolving to private IPs, traffic stays within the AWS backbone, reducing latency.

Answer

Use a Transit Gateway instead of VPC Peering for cross-region connectivity.

Answer

Increase the MTU on the instances' network interfaces to 9001.

Answer

Configure ECMP (Equal-Cost Multi-Path) routing on the VPC peering connection.

Question 3

A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's IP addresses are used by a third-party service to allowlist traffic. The EC2 instances are part of an Auto Scaling group that may scale up and down. The SysOps administrator needs to ensure that the third-party service always has the current IP addresses of the ALB without requiring manual updates. Which solution should the administrator implement?

Accepted Answer

Use AWS Global Accelerator and provide the static IP addresses to the third party. AWS Global Accelerator provides two static anycast IP addresses that serve as a fixed entry point for traffic. By pointing the ALB as an endpoint behind Global Accelerator, the third-party service can allowlist these static IPs, and any changes to the underlying EC2 instances (due to Auto Scaling) are handled transparently without requiring updates to the allowlist.

Answer

Use Amazon Route 53 with a simple routing policy pointing to the ALB DNS name

Answer

Use an Amazon CloudFront distribution with the ALB as the origin and provide the CloudFront IP addresses

Answer

Use an AWS Network Load Balancer (NLB) with static IP addresses in front of the ALB

Question 4

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. The company's SysOps administrator wants to ensure that traffic from the VPC destined for the on-premises network uses the Direct Connect connection instead of the internet. Which configuration should be used?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW). Option A is correct because a virtual private gateway (VGW) is the AWS-side endpoint for an AWS Direct Connect connection when using a private virtual interface. By adding a route in the VPC route table that points the on-premises network CIDR to the VGW, all traffic destined for the on-premises network is forced over the Direct Connect link, bypassing the internet. This ensures private, low-latency, and consistent connectivity as required.

Answer

Add a route in the VPC route table pointing to the on-premises network via a NAT gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via an internet gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection

Question 5

A company has two VPCs in the same AWS region. VPC A hosts a web application, and VPC B hosts a database. The SysOps administrator needs to enable private IP communication between the two VPCs without using the public internet. The administrator wants a simple, low-cost solution that uses the AWS network backbone. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering allows direct, private IP connectivity between two VPCs using the AWS network backbone without traversing the public internet. It is the simplest and most cost-effective solution for connecting exactly two VPCs in the same region, as there are no additional hourly charges beyond data transfer costs, and no intermediate devices or bandwidth limitations are introduced.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 6

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

Accepted Answer

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.. Option B is correct because placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Answer

Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

Answer

Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

Answer

Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

Question 7

A company hosts a web application on Amazon EC2 instances in two AWS regions: us-east-1 and eu-west-1. The application is behind an Application Load Balancer (ALB) in each region. The SysOps administrator wants to direct users to the region that provides the lowest latency, automatically routing traffic away from a region if it becomes unhealthy. Which Amazon Route 53 routing policy should be used?

Accepted Answer

Latency routing. Latency routing (B) is correct because it directs users to the region with the lowest network latency based on real-time measurements between the user and the AWS endpoints. When a region becomes unhealthy, Route 53 automatically stops routing traffic to that region's ALB, ensuring failover to the next lowest-latency healthy region. This meets the requirement of both low-latency and automatic health-based rerouting.

Answer

Geolocation routing

Answer

Weighted routing

Answer

Failover routing

Question 8

A company has three VPCs in the same AWS region: VPC A (production), VPC B (development), and VPC C (shared services). The VPCs have overlapping CIDR blocks (e.g., VPC A: 10.0.0.0/16, VPC B: 10.0.0.0/16, VPC C: 10.1.0.0/16). The SysOps administrator needs to enable private IP communication between VPC A and VPC C, and between VPC B and VPC C, but not between VPC A and VPC B. The solution must also support a growing number of VPCs in the future. Which AWS service should be used?

Accepted Answer

Use AWS PrivateLink by creating a Network Load Balancer in VPC C and configuring VPC endpoints in VPC A and VPC B to access the services.. AWS Transit Gateway (Option A) cannot be used because the VPCs have overlapping CIDR blocks (10.0.0.0/16 for both VPC A and VPC B), which prevents Transit Gateway from routing traffic correctly due to route conflicts. AWS PrivateLink (Option B) solves this by allowing VPC A and VPC B to access services in VPC C via VPC endpoints and a Network Load Balancer, without requiring direct IP routing between the VPCs, thus avoiding CIDR overlap issues and supporting future VPC growth.

Answer

Use AWS Transit Gateway with attachment route tables that isolate traffic between VPCs, ensuring that VPC A and VPC B routes are separate.

Answer

Create two VPC peering connections: one between VPC A and VPC C, and one between VPC B and VPC C.

Answer

Set up two AWS Site-to-Site VPN connections from VPC C to VPC A and VPC B using virtual private gateways.

Question 9

A company runs a gaming application that uses Amazon EC2 instances to handle real-time multiplayer sessions. The application requires low-latency communication with users around the world. The SysOps administrator needs to accelerate content delivery for non-cacheable, dynamic content (such as real-time game state updates) and also provide static asset delivery. The solution must support both TCP and UDP traffic. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network and Anycast IPs to route TCP and UDP traffic to the optimal endpoint, providing low-latency performance for non-cacheable dynamic content like real-time game state updates. It also supports static asset delivery by directing traffic to origins such as Application Load Balancers or EC2 instances, and it handles both TCP and UDP protocols natively, which is essential for real-time multiplayer gaming.

Answer

Amazon CloudFront with origins configured for both dynamic and static content

Answer

AWS Shield Advanced

Answer

AWS App Mesh

Question 10

A company has two VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The VPCs are in the same AWS region. The SysOps administrator needs to enable private IP connectivity between the two VPCs so that an EC2 instance in VPC-A can communicate with an EC2 instance in VPC-B using their private IP addresses. The administrator wants a simple, low-cost solution with high throughput. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it enables direct, private IP connectivity between two VPCs in the same AWS region using the existing AWS network infrastructure, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer. It meets the requirements for simplicity, low cost, and high throughput, as traffic stays within the AWS backbone and does not require a separate transit hub or VPN.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

Internet Gateway