SOA-C02 Networking and Content Delivery — 10 Questions

Question 1

A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's IP addresses are used by a third-party service to allowlist traffic. The EC2 instances are part of an Auto Scaling group that may scale up and down. The SysOps administrator needs to ensure that the third-party service always has the current IP addresses of the ALB without requiring manual updates. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Global Accelerator and provide the static IP addresses to the third party. AWS Global Accelerator and a Network Load Balancer (NLB) with Elastic IPs both provide static IP addresses in front of an ALB. The NLB can be placed in front of the ALB by setting the ALB as a target. This is a well-supported AWS pattern and satisfies the requirement without manual updates. Therefore, both A and D are correct.

Answer

Use Amazon Route 53 with a simple routing policy pointing to the ALB DNS name

Answer

Use an Amazon CloudFront distribution with the ALB as the origin and provide the CloudFront IP addresses

Question 2

A company has three VPCs in the same AWS region: VPC A (production), VPC B (development), and VPC C (shared services). The VPCs have overlapping CIDR blocks (e.g., VPC A: 10.0.0.0/16, VPC B: 10.0.0.0/16, VPC C: 10.1.0.0/16). The SysOps administrator needs to enable private IP communication between VPC A and VPC C, and between VPC B and VPC C, but not between VPC A and VPC B. The solution must also support a growing number of VPCs in the future. Which AWS service should be used?

Accepted Answer

Use AWS Transit Gateway with attachment route tables that isolate traffic between VPCs, ensuring that VPC A and VPC B routes are separate.. AWS Transit Gateway can handle VPCs with overlapping CIDR blocks by using separate route tables for each VPC attachment. This allows VPC A and VPC B to both communicate with VPC C while remaining isolated from each other. The service also scales easily as more VPCs are added. PrivateLink (option B) only provides access to specific services via VPC endpoints, not general private IP communication between all resources in the VPCs. VPC peering (option C) does not support overlapping CIDRs. Site-to-Site VPN (option D) is more complex and unnecessary for this use case.

Answer

Use AWS PrivateLink by creating a Network Load Balancer in VPC C and configuring VPC endpoints in VPC A and VPC B to access the services.

Answer

Create two VPC peering connections: one between VPC A and VPC C, and one between VPC B and VPC C.

Answer

Set up two AWS Site-to-Site VPN connections from VPC C to VPC A and VPC B using virtual private gateways.

Question 3

A company has an Amazon VPC with public and private subnets. The private subnets host database instances that should not have direct internet access. However, the database instances need to download patches from an Amazon S3 bucket. The SysOps administrator needs to enable access to S3 from the private subnets without traversing the internet. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and update the private route tables to add a route to the S3 prefix list.. A VPC endpoint for S3 of Gateway type allows private subnet resources to access S3 without traversing the internet by routing traffic through the AWS network. Adding a route to the S3 prefix list in the private route table directs S3-bound traffic to the endpoint, which is horizontally scaled and highly available. This solution meets the requirement of no direct internet access while enabling patch downloads from S3.

Answer

Create a NAT gateway in a public subnet and update the private route tables to point 0.0.0.0/0 to the NAT gateway.

Answer

Create a VPC endpoint for S3 (Interface type) and assign a security group to the endpoint.

Answer

Create an AWS Direct Connect connection and route traffic to S3 through the on-premises network.

Question 4

A company wants to host a static website using Amazon S3. The website files are stored in an S3 bucket. The SysOps administrator needs to make the website accessible via HTTP. Which action must be performed on the S3 bucket?

Accepted Answer

Enable static website hosting. To host a static website on Amazon S3, you must enable the 'Static website hosting' property on the bucket. This configures the bucket to serve HTTP responses for index and error documents, and provides a regional website endpoint (e.g., http://bucket-name.s3-website-region.amazonaws.com). Without this setting, the bucket only supports REST API access (via the S3 API endpoint), not standard HTTP browser requests.

Answer

Enable versioning

Answer

Configure a bucket policy to allow public read access

Answer

Attach a CloudFront distribution

Question 5

A company has an Application Load Balancer (ALB) that routes traffic to targets in private subnets. The SysOps administrator needs to log detailed information about HTTP requests, including client IP, request path, and response time. Which ALB feature should be enabled?

Accepted Answer

Access logs. Access logs capture detailed information about each HTTP request processed by the ALB, including client IP, request path, response time, and many other fields. This feature stores the logs in an S3 bucket, providing a persistent, queryable record of all requests. CloudWatch metrics aggregate data but do not provide per-request details, making access logs the correct choice for the required granularity.

Answer

CloudWatch metrics

Answer

Connection logs

Answer

Request tracing

Question 6

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance cannot connect to the internet. The instance is in a public subnet with a route table that has a route to an internet gateway (IGW). The instance has a public IP assigned. What should the administrator check next?

Accepted Answer

Check the security group rules to ensure outbound traffic is allowed. The instance has a public IP and is in a public subnet with a route to an IGW, so network-level routing and addressing are already configured. The most common remaining cause for no internet connectivity is that the security group's outbound rules are blocking traffic. Security groups are stateful, so even if inbound rules allow return traffic, outbound rules must explicitly permit the instance to initiate connections to the internet (e.g., outbound HTTPS on port 443 or all traffic).

Answer

Verify the network ACL associated with the subnet allows inbound traffic from the internet

Answer

Confirm that the route table has a route to the IGW for 0.0.0.0/0

Answer

Ensure the instance has a public IP address

Question 7

Refer to the exhibit. A SysOps administrator created this S3 bucket policy to allow CloudFront to access objects in the bucket using an origin access identity (OAI). However, users are still receiving 403 Access Denied errors when accessing the CloudFront distribution. What is the most likely cause?

Accepted Answer

The OAI ARN in the policy is incorrect. The most likely cause is that the OAI ARN in the bucket policy is incorrect (option D). The OAI ARN must exactly match the CloudFront origin access identity used by the distribution. If it is wrong, CloudFront cannot access the S3 objects and returns 403. S3 Block Public Access settings only apply to anonymous public access and do not affect grants to specific principals like an OAI.

Answer

The CloudFront distribution uses the S3 bucket's regional domain name instead of the distribution domain name

Answer

The CloudFront distribution is in a different region than the S3 bucket

Answer

The S3 bucket has Block Public Access settings enabled that deny all access

Question 8

Refer to the exhibit. A SysOps administrator is troubleshooting internet connectivity for an EC2 instance in subnet subnet-0a1b2c3d4e5f6g7h8. The instance can reach other instances in the VPC but cannot access the internet. Based on the route table output, what is the most likely cause?

Accepted Answer

The NAT gateway does not have a route to an internet gateway. The NAT gateway does not have a route to an internet gateway is correct because, for an EC2 instance in a private subnet to access the internet, the NAT gateway must reside in a public subnet and have a route to an internet gateway. If the NAT gateway's route table lacks a 0.0.0.0/0 route pointing to an internet gateway, it cannot forward traffic from the private subnet to the internet. The exhibit likely shows the private subnet's route table with a default route to the NAT gateway, but the NAT gateway itself is misconfigured.

Answer

The default route (0.0.0.0/0) is missing

Answer

The route table is not associated with the subnet

Answer

The VPC CIDR route is misconfigured

Question 9

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

Accepted Answer

The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.. Network ACLs are stateless and evaluated at the subnet boundary. If the instance subnet's NACL does not allow inbound traffic from the ALB subnet on the ephemeral ports and port 80, health checks and traffic will fail intermittently, even though the security group allows it.

Answer

The instance security group does not allow outbound traffic to the ALB.

Answer

The ALB security group does not allow outbound traffic to the instances.

Answer

The ALB is in a public subnet without an internet gateway.

Question 10

A SysOps administrator is troubleshooting connectivity issues between two VPCs in different AWS Regions. Both VPCs are connected via a VPC Peering connection. The main route tables in both VPCs have routes pointing to the peering connection. Security groups allow all traffic. However, an EC2 instance in VPC A cannot ping an EC2 instance in VPC B. What is the most likely cause?

Accepted Answer

The route tables in the subnets where the instances reside do not include a route to the peered VPC's CIDR.. The most likely cause is that the route tables associated with the subnets where the EC2 instances reside do not include a route to the peered VPC's CIDR block. Even if the main VPC route tables have the peering route, each subnet must be explicitly associated with a route table that contains the route to the peered VPC's CIDR; otherwise, traffic from the instance will not be directed to the VPC peering connection.

Answer

The network ACLs in subnets are blocking ICMP traffic.

Answer

VPC Peering is not supported across AWS Regions.

Answer

The security groups do not allow traffic from the peered VPC's security group ID.