SOA-C02 Networking and Content Delivery Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. A SysOps Administrator is reviewing the network ACL configuration. An instance in subnet 10.0.1.0/24 needs to receive HTTPS traffic from the internet. Why is the current configuration insufficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network ACLs are stateless and require an explicit outbound rule for the response traffic.. The current configuration is insufficient because network ACLs are stateless, so they do not automatically allow response traffic. For incoming HTTPS traffic (port 443) from the internet, the inbound rule must allow destination port 443. The response traffic from the instance will have source port 443 and destination ephemeral ports. The outbound rule must explicitly allow traffic with source port 443 to any destination. Simply allowing ephemeral ports as destination is not sufficient, as the response uses source port 443. Option A is incorrect because the outbound rule should allow source port 443, not destination port 443. Option B correctly identifies that a stateless network ACL requires an explicit outbound rule for the response traffic. Options C and D are incorrect because the inbound rule for HTTPS is assumed to be present and HTTP is not relevant.

Answer

The outbound rule should allow HTTPS (port 443) for response traffic.

Answer

The inbound rule for HTTPS (port 443) is missing from the network ACL.

Answer

The inbound rule for HTTP (port 80) is not needed for HTTPS traffic.

Question 2

Refer to the exhibit. This bucket policy is attached to an S3 bucket that is used as an origin for a CloudFront distribution. Users are reporting Access Denied errors when accessing objects via the CloudFront URL. What is the MOST likely cause?

Accepted Answer

The condition restricts access to a specific IP range, but CloudFront requests come from its own IP addresses.. The most likely cause. The bucket policy includes a condition that restricts access to a specific IP range (192.0.2.0/24). However, when CloudFront serves content from an S3 origin, the requests to S3 originate from CloudFront's own IP addresses, not the end user's IP. Therefore, the condition fails and blocks CloudFront, resulting in Access Denied errors. Option A is incorrect because the aws:SourceVpce condition is used for VPC endpoints, not CloudFront. Option B is incorrect because the bucket policy can use an Origin Access Identity (OAI) instead of granting access to the CloudFront service principal, but the issue here is the IP restriction. Option C is incorrect because the resource ARN includes /*, which is typically correct for bucket policies allowing access to all objects.

Answer

The condition is missing the aws:SourceVpce condition for VPC endpoints.

Answer

The bucket policy does not grant access to the CloudFront service principal.

Answer

The resource ARN is missing the bucket ARN for the bucket itself.

Question 3

A company hosts a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent timeouts. The web server logs show HTTP 503 errors. Which configuration is MOST likely causing the issue?

Accepted Answer

The target group health checks are misconfigured or the instances are unhealthy.. HTTP 503 errors from an ALB indicate that the load balancer cannot route requests to healthy targets. Misconfigured health checks or unhealthy instances cause the ALB to mark targets as unhealthy, leading to 503 responses even if the instances are running. This is the most direct cause of intermittent timeouts when the web server logs show 503 errors.

Answer

The ALB idle timeout is set too low.

Answer

The target group is not configured with enough capacity.

Answer

The security group for the ALB does not allow inbound traffic on port 80.

Question 4

A company wants to reduce latency for global users accessing static content stored in Amazon S3. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a CDN that caches content at edge locations to reduce latency. Option A is wrong because Global Accelerator improves TCP/UDP performance but not primarily for static content. Option C is wrong because S3 Transfer Acceleration speeds up uploads to S3. Option D is wrong because Amazon Route 53 is DNS, not a content delivery service.

Answer

Amazon Route 53

Answer

S3 Transfer Acceleration

Answer

AWS Global Accelerator

Question 5

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer (ALB) in the public subnets routes traffic to EC2 instances in the private subnets. The EC2 instances need to access the internet for software updates. Which solution is MOST secure and cost-effective?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables pointing 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing inbound connections from the internet. This is the most secure and cost-effective solution because it uses a managed AWS service that scales automatically and incurs charges only for usage and hourly uptime, avoiding the need for a bastion host or VPN.

Answer

Set up a VPN connection to an on-premises network and route internet traffic through it.

Answer

Assign public IP addresses to the EC2 instances and route traffic directly.

Answer

Attach an internet gateway to the private subnets and route 0.0.0.0/0 to it.

Question 6

A sysadmin receives an alert that a Network Load Balancer (NLB) is not passing traffic to targets. The target group health checks are passing. What is the MOST likely cause?

Accepted Answer

The listener is not configured for the correct protocol.. When health checks are passing but traffic is not reaching targets, a common cause is a mismatch between the listener protocol and the application protocol expected by the targets. For example, a TCP listener sending traffic to a UDP-based service will cause the NLB to establish TCP connections that the targets cannot handle, resulting in traffic failure while health checks (which may use a different protocol like HTTP) still succeed. Other options like cross-zone load balancing or routing issues would typically affect health checks as well.

Answer

Cross-zone load balancing is disabled.

Answer

The instances are in a private subnet without a route to the NLB's subnet.

Answer

The target group health check interval is too long.

Question 7

A company needs to resolve DNS names for on-premises servers from AWS. They have set up a DHCP options set with the on-premises DNS server IP. Which additional step is required?

Accepted Answer

Configure Route 53 Resolver outbound endpoint to forward queries to on-premises DNS.. The DHCP options set configures VPC resources to use the on-premises DNS server IP. However, to actually forward DNS queries from the VPC to the on-premises DNS server for resolution of on-premises hostnames, you need a Route 53 Resolver outbound endpoint. This endpoint provides a forwarding path from the VPC to the on-premises network (over VPN or Direct Connect). Option D (inbound endpoint) is used for the reverse direction—allowing on-premises DNS to forward queries to AWS for resolving private hosted zones—and is not required here. Options A and C are incorrect because VPC peering does not enable DNS resolution to on-premises networks; dedicated connectivity and DNS forwarding via Route 53 Resolver are needed.

Answer

Create a VPC peering connection and use the on-premises DNS IP as the DHCP option set.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS.

Question 8

A company uses an Application Load Balancer (ALB) to route traffic to a web application. The security team requires that all traffic be encrypted in transit. The ALB currently uses a TLS certificate from AWS Certificate Manager (ACM). Users report that some browsers show a certificate warning. What is the MOST likely cause?

Accepted Answer

The certificate is self-signed or issued by an untrusted CA.. A self-signed certificate or one issued by an untrusted CA is not recognized by browser trust stores, causing a certificate warning. Option A is incorrect because using different certificates per target group is valid and does not cause warnings. Option B is incorrect: TLS 1.0 is outdated but some browsers may still support it; the warning would not be specifically due to TLS version alone. Option D is incorrect because if the ALB were not terminating TLS, traffic would be unencrypted, not cause a certificate warning.

Answer

The listener is using a different certificate for each target group.

Answer

The ALB is configured to use TLS 1.0 only.

Answer

The ALB is not configured to terminate TLS.

Question 9

A sysadmin needs to block specific IP addresses from accessing an Application Load Balancer. Which approach is MOST efficient?

Accepted Answer

Create an AWS WAF web ACL with IP set rules and associate it with the ALB.. AWS WAF is purpose-built for web traffic filtering and can be directly associated with an Application Load Balancer to efficiently block specific IP addresses using IP set rules. Option A is wrong because security groups only support allow rules and cannot explicitly deny traffic from specific IPs. Option B is wrong because VPC route tables route traffic based on destinations; they do not filter traffic. Option D is wrong because network ACLs (NACLs) are stateless and require careful inbound/outbound rule management, making them less efficient for blocking specific IPs at the application layer.

Answer

Modify the security group for the ALB to deny traffic from those IPs.

Answer

Add a route in the VPC route table to drop traffic from those IPs.

Answer

Update the network ACL for the ALB subnets.

Question 10

A company uses AWS Global Accelerator to improve performance of a TCP application. Users in Asia report higher latency than users in Europe. The endpoints are all in us-east-1. What is the BEST solution?

Accepted Answer

Deploy additional endpoints in an Asia region and configure Global Accelerator to route traffic to the closest endpoint.. VPC peering does not affect Global Accelerator routing; Global Accelerator uses Anycast IPs and routes to endpoints based on location, not VPC peering. Option B is incorrect because adding more endpoints in us-east-1 does not reduce latency for users in Asia; they still have to travel across the Atlantic and Pacific. Option C is incorrect because CloudFront is designed for HTTP/HTTPS (and WebSockets), not general TCP applications. Global Accelerator supports TCP/UDP. Option D is correct because deploying endpoints in an Asia region and configuring Global Accelerator to route traffic to the closest endpoint reduces latency for Asian users.

Answer

Create a VPC peering connection between us-east-1 and an Asia region.

Answer

Add more endpoints in us-east-1 to distribute load.

Answer

Switch to Amazon CloudFront for the TCP application.

Question 11

Which TWO AWS services can be used to provide a static IP address for an Application Load Balancer? (Choose two.)

Accepted Answer

Network Load Balancer (with Elastic IP). A Network Load Balancer (NLB) can have Elastic IP addresses assigned per Availability Zone, providing static IPs. Option D is correct because AWS Global Accelerator provides static anycast IP addresses that can be associated with an Application Load Balancer. Option A is wrong because Amazon Route 53 provides DNS resolution, not static IP addresses directly. Option B is wrong because Elastic IP addresses cannot be assigned directly to an Application Load Balancer; they are used for EC2 instances or NLBs. Option E is wrong because Application Load Balancers do not support Elastic IP assignment; they use a dynamic hostname.

Answer

Amazon Route 53 with static DNS name

Answer

Elastic IP address assigned to the ALB

Answer

Application Load Balancer (with Elastic IP)

Question 12

Which THREE components are required to set up a site-to-site VPN connection between a VPC and an on-premises network? (Choose three.)

Accepted Answer

Virtual private gateway or transit gateway. A virtual private gateway or transit gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network. It provides the target for the VPN connection and must be attached to the VPC to enable site-to-site VPN functionality.

Answer

NAT Gateway

Answer

Internet gateway

Question 13

Which TWO statements about Amazon CloudFront origins are correct? (Choose two.)

Accepted Answer

CloudFront can use an Application Load Balancer as an origin.. CloudFront can use an Application Load Balancer (ALB) as a custom origin. This allows you to distribute traffic from a web application running behind an ALB, enabling dynamic content delivery with CloudFront's edge caching and HTTPS termination.

Answer

CloudFront only supports HTTP origins, not HTTPS.

Answer

CloudFront can only use S3 buckets as origins.

Answer

CloudFront origins must be in the same region as the distribution.

Question 14

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not have 'Enable DNS Resolution' enabled.. The 'Enable DNS Resolution' setting on a VPC Peering connection allows instances in one VPC to resolve the private DNS hostnames of instances in the peered VPC. Without this setting enabled, the DNS resolver in the requester VPC will not return the private IP of the peered instance, causing DNS name resolution to fail even though direct ICMP (ping) to the private IP works. This setting must be enabled on both sides of the peering connection for cross-VPC DNS resolution to function.

Answer

The route tables in VPC A do not have a route to VPC B's CIDR.

Answer

The security groups in VPC B block DNS traffic (port 53).

Answer

The VPCs have overlapping CIDR blocks.

Question 15

A company has a web application deployed in a VPC with both public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The web servers need to access the internet for updates. Which configuration is required to provide internet access to the web servers while keeping the database servers private?

Accepted Answer

Attach an Internet Gateway to the VPC and add a route to it only in the route tables for the public subnets.. An Internet Gateway (IGW) is required for any subnet that needs direct internet access. By attaching an IGW to the VPC and adding a default route (0.0.0.0/0) pointing to the IGW only in the public subnet route tables, web servers in those subnets can reach the internet. Database servers in private subnets remain isolated because their route tables lack the IGW route, preventing direct inbound or outbound internet traffic.

Answer

Place both web and database servers in private subnets and use a NAT Gateway for outbound internet access.

Answer

Attach an Internet Gateway to the VPC and add a route to it in the route tables for both public and private subnets.

Answer

Use a VPC Gateway Endpoint to provide internet access to the web servers.