SOA-C02 Networking and Content Delivery Practice Test 10 — 15 Questions

Question 1

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot be accessed via SSH from the internet. The security group allows inbound SSH (port 22) from 0.0.0.0/0. The network ACL (NACL) for the subnet has an inbound rule allowing SSH from 0.0.0.0/0. What else could be blocking access?

Accepted Answer

The NACL outbound rule is blocking return traffic.. Option C is correct. The NACL must also have an outbound rule to allow return traffic. NACLs are stateless, so outbound rules must be explicitly set. Option A is wrong because the security group is already correct. Option B is wrong because NACL inbound is allowed. Option D is wrong because the internet gateway allows inbound traffic.

Answer

The NACL inbound rule is blocking traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group rule is misconfigured.

Question 2

A SysOps administrator is designing a highly available web application across multiple AWS regions. The application uses an Application Load Balancer in each region. Which TWO services can be used to route traffic to the closest regional load balancer based on latency?

Accepted Answer

Amazon Route 53 geoproximity routing. Option A (Route 53 latency routing) and Option E (Route 53 geoproximity routing) are correct. Latency routing directs traffic to the region with lowest latency. Geoproximity routing can also optimize based on user location. Option B is wrong because CloudFront with origin groups is for failover, not latency-based routing. Option C is wrong because Global Accelerator uses Anycast, not latency routing. Option D is wrong because Route 53 weighted routing distributes based on weights.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 weighted routing

Answer

Amazon CloudFront with origin groups

Question 3

A company uses a Network Load Balancer (NLB) with a static IP address. The SysOps administrator needs to enable client IP preservation for the NLB so that backend instances see the original client IP. Which TWO conditions are required for client IP preservation to work?

Accepted Answer

The target group must be of type 'instance'.. Option A is correct because client IP preservation for a Network Load Balancer (NLB) requires the target group to be of type 'instance'. When the target group is instance-based, the NLB can forward packets with the original source IP address intact, allowing backend instances to see the client's IP directly. This is not supported when the target group is of type 'IP' because the NLB must perform NAT to route to the specified IP addresses.

Answer

The NLB must have TLS listeners.

Answer

Proxy protocol must be enabled on the target group.

Answer

Cross-zone load balancing must be enabled.

Question 4

A SysOps administrator is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which THREE components are required to achieve this?

Accepted Answer

An Internet Gateway attached to the VPC. Option A, Option D, and Option E are correct. A NAT Gateway in a public subnet, an Internet Gateway attached to the VPC, and a route table in the private subnet with a default route to the NAT Gateway are all required. Option B is wrong because a VPN is not needed. Option C is wrong because a VPC Gateway Endpoint is for specific services like S3, not general internet access.

Answer

A VPC Gateway Endpoint

Answer

A Site-to-Site VPN connection

Question 5

Refer to the exhibit. A company has an S3 bucket policy as shown. The SysOps administrator notices that users from the allowed IP range (192.0.2.0/24) can access objects, but users outside that range are denied. However, a CloudFront distribution with an origin access identity (OAI) is also unable to access the bucket and receives 'Access Denied'. What is the MOST likely cause?

Accepted Answer

The condition aws:SourceIp restricts access based on the requestor's IP, not the CloudFront IP.. Option D is correct. The bucket policy uses aws:SourceIp condition, which blocks CloudFront because CloudFront's IPs are different from the client IP. To allow CloudFront access while restricting direct access, the policy should use aws:SourceArn or refer to the OAI. Option A is wrong because the OAI is not mentioned in the policy. Option B is wrong because the policy allows GetObject. Option C is wrong because the bucket policy allows from 192.0.2.0/24.

Answer

The policy does not allow 's3:GetObject' for the CloudFront OAI.

Answer

The CloudFront distribution is not in the allowed IP range.

Answer

The CloudFront OAI is not configured in the bucket policy.

Question 6

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) across three Availability Zones. Each AZ has one public and one private subnet. The EC2 instances are in the private subnets. The ALB is internet-facing. Recently, during a traffic spike, some users experienced intermittent timeouts. The SysOps administrator reviews the ALB access logs and finds that the timeouts correspond to periods when the target group had 'unhealthy' instances. The health check is configured to check a health endpoint on port 80 with a path of '/health'. The SysOps administrator checks the EC2 instances and finds that the health endpoint responds correctly. However, the health checks are failing intermittently. The administrator notices that the security group for the EC2 instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound HTTP and outbound ephemeral ports. What is the MOST likely cause of the health check failures?

Accepted Answer

The network ACL for the private subnets is blocking the return traffic from health checks.. Option B is correct. The NACL is stateless and must allow inbound ephemeral ports for the return traffic from health checks. The current NACL allows inbound HTTP (port 80) but does not explicitly allow inbound ephemeral ports (1024-65535) from the ALB's IP range. This causes the health check responses to be dropped. Option A is wrong because the security group is configured correctly. Option C is wrong because the health endpoint works when tested locally. Option D is wrong because cross-zone load balancing does not affect health checks.

Answer

The health check endpoint on the EC2 instances is not responding correctly.

Answer

The security group on the EC2 instances is blocking health check traffic from the ALB.

Answer

The ALB does not have cross-zone load balancing enabled.

Question 7

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The VPC has an Internet Gateway (IGW) attached. The public subnets have a route to the IGW, and the private subnets have a route to a NAT Gateway in the public subnet 10.0.1.0/24. The SysOps administrator deploys a new EC2 instance in the private subnet 10.0.4.0/24. The instance needs to download software from the internet, but the download fails. The administrator can successfully ping the NAT Gateway from the instance. What is the MOST likely cause of the failure?

Accepted Answer

The route table for the private subnet does not have a default route to the NAT Gateway.. Option D is correct. The route table for the private subnet 10.0.4.0/24 is missing a default route (0.0.0.0/0) to the NAT Gateway. The ping to the NAT Gateway works because it is within the VPC, but internet traffic is not routed. Option A is wrong because the NAT Gateway is in the public subnet and has internet access. Option B is wrong because the security group only controls inbound/outbound for the instance, not routing. Option C is wrong because the NACL for the private subnet should allow outbound traffic, but the issue is routing.

Answer

The security group for the EC2 instance blocks outbound internet traffic.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The NAT Gateway is not associated with an Elastic IP address.

Question 8

A company uses Amazon CloudFront to deliver video content to users worldwide. The content is stored in an S3 bucket. The SysOps administrator notices that users in some geographic regions experience high latency when loading the video. The administrator wants to improve the performance for these users without changing the existing infrastructure. The CloudFront distribution is configured with the default cache behavior. What is the MOST cost-effective solution to reduce latency for users in those regions?

Accepted Answer

Change the CloudFront distribution's price class to include all edge locations.. Option A is correct. CloudFront's Price Class All uses all edge locations, reducing latency for users worldwide. If the distribution is currently using a limited price class, changing to Price Class All improves performance. Option B is wrong because adding more origins does not reduce latency. Option C is wrong because multiple distributions increase complexity and cost. Option D is wrong because increasing TTL does not reduce latency for initial requests.

Answer

Increase the cache TTL for the content.

Answer

Add additional S3 buckets in different regions and configure multiple origins.

Answer

Use multiple CloudFront distributions for different geographic regions.

Question 9

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. Users report slow load times. The SysOps team notices that all traffic goes to a single availability zone. Which action should be taken to improve performance and reliability?

Accepted Answer

Configure the ALB to use subnets in at least two Availability Zones. The correct action is to configure the ALB to use subnets in at least two Availability Zones. An ALB is a regional service that requires subnets in multiple AZs to distribute incoming traffic across healthy targets in those zones. When all traffic goes to a single AZ, it indicates the ALB is only attached to one subnet, creating a single point of failure and limiting the pool of EC2 instances that can serve traffic, which directly causes slow load times and reduced reliability.

Answer

Add more EC2 instances in the same Availability Zone

Answer

Replace the ALB with a Network Load Balancer (NLB)

Answer

Enable cross-zone load balancing on the ALB

Question 10

A SysOps administrator needs to allow an EC2 instance in a private subnet to download patches from the internet. Which AWS service should be used to achieve this securely?

Accepted Answer

NAT Gateway. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet, while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway is for public subnets. Option C is wrong because a VPC Peering connection connects VPCs, not to the internet. Option D is wrong because a VPN connection connects to on-premises networks, not the internet.

Answer

Internet Gateway (IGW)

Answer

AWS VPN

Answer

VPC Peering

Question 11

An application hosted on EC2 instances behind an ALB is experiencing intermittent connectivity errors. The ALB target group is configured with health checks on port 80. The SysOps team notices that the EC2 instances pass health checks but clients still receive 503 errors. What is the most likely cause?

Accepted Answer

Security groups or network ACLs are blocking traffic from the ALB to the instances. Option D is correct because if security groups or network ACLs block traffic from the ALB to the instances, the ALB may still mark them as healthy if the health check is coming from a different source IP, but actual client traffic is blocked. Option A is wrong because if health checks pass, the target group is not empty. Option B is wrong because deregistration delay does not cause 503s. Option C is wrong because if the ALB is not in multiple AZs, it would not cause 503 errors specifically.

Answer

The deregistration delay is too high

Answer

The ALB is only configured in one Availability Zone

Answer

The target group is empty

Question 12

A SysOps administrator is troubleshooting DNS resolution issues for a custom domain used by an Application Load Balancer. Which TWO steps should the administrator take to diagnose the issue? (Choose two.)

Accepted Answer

Verify that the Route 53 alias record points to the ALB's DNS name. Option B is correct because a Route 53 alias record must point to the ALB's DNS name (e.g., my-alb-1234567890.us-east-1.elb.amazonaws.com) to properly route traffic to the load balancer. If the alias record is misconfigured or points to an incorrect resource, DNS resolution will fail or resolve to an unintended IP, causing the custom domain not to work.

Answer

Ensure the VPC's CIDR block does not overlap with the ALB's IP range

Answer

Verify that the ALB's security group allows inbound traffic on port 443

Answer

Check the health status of the ALB's target group

Question 13

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for EC2 instances to download updates. Which THREE components are required to achieve this? (Choose three.)

Accepted Answer

Route table in the private subnets with a default route pointing to the NAT Gateway. Option A is correct because a route table associated with private subnets must have a default route (0.0.0.0/0) pointing to a NAT Gateway to direct outbound internet traffic from EC2 instances through the NAT device. This allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet.

Answer

Egress-only Internet Gateway

Answer

AWS Site-to-Site VPN connection

Question 14

A SysOps administrator needs to troubleshoot connectivity between two EC2 instances in the same VPC but different subnets. The instances cannot communicate. Which THREE checks should the administrator perform? (Choose three.)

Accepted Answer

Verify that the network ACLs for both subnets allow the required traffic. Correct answers: A, B, and D. Option A is correct because security groups control traffic at the instance level. Option B is correct because network ACLs control traffic at the subnet level. Option D is correct because route tables determine if the subnets can route to each other. Option C is wrong because NAT Gateways are for internet access, not internal VPC communication. Option E is wrong because flow logs are for monitoring, not a direct cause.

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Verify that the NAT Gateway is configured correctly

Question 15

A SysOps administrator notices that an EC2 instance is not receiving traffic from an Application Load Balancer (ALB). The ALB is healthy and the target group shows the instance as healthy. The exhibit shows the network interface attached to the instance. What is the likely cause of the issue?

Accepted Answer

The instance's security group does not allow inbound traffic from the ALB. Option A is correct because the source/destination check is enabled (true) on the ENI. When an ALB sends traffic to an instance, the instance must have source/destination check disabled if it is acting as a NAT or routing device, but in this case the ALB's ENI is attached to the instance. Actually, the exhibit shows the ENI of the ALB? Wait, the description says "ELB app/alb-..." which indicates it's an ALB ENI. The issue is that the ALB's ENI has source/dest check enabled, which is normal for ALB? No, ALB ENIs are managed by AWS and source/dest check is typically disabled. However, the question states that the instance is not receiving traffic. The correct answer is that the security group of the instance may be blocking traffic. But the exhibit shows the ENI group is "default". Option A is correct because the source/destination check being enabled on the instance's ENI could cause the instance to drop traffic if it's not the intended destination. But more likely, the security group of the instance (sg-12345678) may not allow traffic from the ALB. However, given the options, Option A is the only one that fits. Let's choose A. Explanation: The source/destination check must be disabled for the instance to accept traffic from the ALB? Actually, that's wrong. The source/destination check is for the instance to process traffic that isn't destined to its own IP. For ALB traffic, the destination IP is the instance's IP, so source/dest check doesn't matter. The real issue is that the security group of the instance does not allow traffic from the ALB. But the exhibit shows the ENI's group is "default", which likely doesn't allow HTTP/HTTPS. Option C is also plausible. To align with the exhibit, let's pick Option C. I'll correct: The exhibit shows the network interface of the ALB, not the instance. The instance's ENI is not shown. The ALB ENI has source/dest check enabled, which is normal. The issue is that the instance's security group may not allow traffic. Option C is correct: The instance's security group is blocking traffic. Explanation: Option C is correct because the security group associated with the instance must allow inbound traffic from the ALB. Option A is wrong because source/dest check on the ALB ENI is fine. Option B is wrong because the ALB ENI is in a public subnet? Not necessarily. Option D is wrong because network ACLs are stateless and if inbound is allowed, outbound must also be allowed.

Answer

The source/destination check is enabled on the network interface

Answer

The network interface is in a private subnet

Answer

The network ACL of the subnet denies inbound traffic