SOA-C02 Networking and Content Delivery Practice Test 11 — 15 Questions

Question 1

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The company needs to ensure that the ALB sends requests to instances that are healthy and can serve traffic. Which feature should be used to monitor the health of the instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Health checks. Health checks allow the ALB to monitor the health of EC2 instances by sending periodic requests to a specified endpoint (e.g., /health). If an instance fails consecutive health checks, the ALB stops sending traffic to it. Option B is incorrect because sticky sessions (session affinity) ensure a client's requests are sent to the same instance, not health monitoring. Option C is incorrect because cross-zone load balancing distributes traffic across instances in multiple Availability Zones. Option D is incorrect because connection draining (deregistration delay) allows in-flight requests to complete before an instance is removed from the target group.

Answer

Sticky sessions

Answer

Cross-zone load balancing

Answer

Connection draining

Question 2

A company has a CloudFront distribution with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible through CloudFront. Which configuration is required to ensure that direct access to the S3 bucket is blocked?

Accepted Answer

Create an Origin Access Identity (OAI) and add a bucket policy that grants access only to the OAI. The correct configuration is to create an Origin Access Identity (OAI) and grant it access via the S3 bucket policy. An OAI is a special CloudFront user that can be associated with a distribution. By updating the S3 bucket policy to allow only the OAI to perform s3:GetObject, you ensure that objects are only accessible through CloudFront. This effectively blocks direct public access to the bucket while allowing CloudFront to serve the content.

Answer

Attach an IAM role to CloudFront that allows S3 access

Answer

Set the S3 bucket policy to deny all access except from CloudFront's IP ranges

Answer

Use signed URLs for all requests

Question 3

A company has an EC2 instance that needs to have a static public IP address that does not change even if the instance is stopped and started. Which AWS resource should be attached to the instance?

Accepted Answer

An Elastic IP address. An Elastic IP address is a static, public IPv4 address designed for dynamic cloud computing. When associated with an EC2 instance, it remains fixed even if the instance is stopped and started, unlike automatically assigned public IPs which change on stop/start. This meets the requirement for a static public IP.

Answer

An automatically assigned public IP address

Answer

A secondary private IP address

Answer

A static private IP address

Question 4

Which TWO of the following are benefits of using Amazon CloudFront in front of an Application Load Balancer? (Select TWO.)

Accepted Answer

Protect the application against DDoS attacks. Amazon CloudFront provides AWS Shield Standard automatically, which mitigates common Layer 3/4 DDoS attacks at the edge before traffic reaches the ALB. By absorbing volumetric attacks at CloudFront's globally distributed edge locations, the ALB is shielded from malicious traffic, ensuring application availability. This is a key benefit because ALBs alone do not have built-in DDoS protection beyond basic security group rules.

Answer

Simplify VPC endpoint configuration

Answer

Offload SSL/TLS termination from the ALB

Answer

Provide a static IP address for the application

Question 5

Which THREE of the following are valid options for connecting a VPC to an on-premises network? (Select THREE.)

Accepted Answer

Transit gateway with VPN attachment. A Transit Gateway with a VPN attachment allows you to connect your VPC to an on-premises network by acting as a central hub that interconnects VPCs and on-premises networks via IPsec VPN tunnels. This is a valid option because the Transit Gateway can terminate multiple VPN connections, enabling hybrid connectivity with centralized routing and scalability.

Answer

VPC peering

Answer

VPC endpoint

Question 6

Which TWO of the following are features of Amazon Route 53? (Select TWO.)

Accepted Answer

Health checking of resources. Amazon Route 53 is a DNS web service that provides domain name resolution, domain registration, and health checking of resources. Health checking monitors the availability and performance of endpoints (e.g., web servers) via HTTP/HTTPS/TCP requests, and can automatically failover DNS responses to healthy resources, ensuring high availability.

Answer

SSL/TLS termination

Answer

SSL certificate management

Answer

Content caching at edge locations

Question 7

A company has an Application Load Balancer (ALB) that routes traffic to an Auto Scaling group of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The EC2 instances have a security group that allows inbound traffic from the ALB's security group. Users report intermittent 503 errors. What is the most likely cause?

Accepted Answer

The EC2 instances are not passing the ALB health checks.. The 503 Service Unavailable error from an Application Load Balancer typically indicates that the target instances are not healthy and are not passing the configured health checks. When the ALB's health checks fail, it stops routing traffic to those instances, resulting in 503 errors for users. Since the security group configurations appear correct (ALB allows inbound HTTP from 0.0.0.0/0 and EC2 allows traffic from the ALB's security group), the most likely cause is that the EC2 instances are failing health checks due to application-level issues, such as the web server not responding on the health check path or port.

Answer

The ALB is deployed in a private subnet without a NAT gateway.

Answer

The target group is configured with an incorrect protocol or port.

Answer

The security group on the ALB does not allow inbound traffic from the internet.

Question 8

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The data center has multiple VLANs that need to connect to separate VPCs in AWS. The company wants to maintain isolation between the VPCs while maximizing bandwidth utilization. Which solution should the SysOps administrator recommend?

Accepted Answer

Configure a single Direct Connect connection with multiple private virtual interfaces, each tagged with a different VLAN ID and associated with a different VPC.. A single Direct Connect connection can support multiple private virtual interfaces (VIFs), each tagged with a unique 802.1Q VLAN ID. This allows the on-premises data center to connect to separate VPCs while maintaining traffic isolation via VLAN tagging, and it maximizes bandwidth utilization by sharing the single connection's capacity across all VIFs.

Answer

Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway, then configure route tables to isolate traffic.

Answer

Provision multiple Direct Connect connections, one for each VPC, and use a different VLAN on each connection.

Answer

Establish a single Direct Connect connection and use IPsec VPN tunnels over it to connect to each VPC.

Question 9

A company hosts a static website on Amazon S3 with public read access enabled. The website is accessed via a custom domain name that uses Amazon Route 53. The domain name points to the S3 bucket's website endpoint. Users report that they can access the website using the S3 bucket URL but not the custom domain name. What is the most likely cause?

Accepted Answer

The Route 53 alias record points to the S3 bucket's regional endpoint instead of the website endpoint.. For an S3 static website behind a custom domain, the Route 53 alias record must point to the bucket's S3 website endpoint (for example, bucket.s3-website-us-east-1.amazonaws.com), not the regional REST endpoint (bucket.s3.us-east-1.amazonaws.com). The regional endpoint does not serve index documents or support website redirects, so requests via the custom domain fail even though the bucket URL works. This mismatch is the most likely cause of the reported behavior.

Answer

The S3 bucket policy does not allow public access.

Answer

The website does not support HTTPS and the browser blocks it.

Answer

The DNS TTL is too long and the changes have not propagated.

Question 10

A company deploys a web application on EC2 instances behind an Application Load Balancer. The SysOps administrator needs to allow inbound traffic only from the ALB to the EC2 instances. Currently, the EC2 security group allows inbound HTTP from 0.0.0.0/0. Which security group configuration should the administrator apply?

Accepted Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's security group.. Security groups can reference other security groups as sources, so allowing inbound HTTP on the EC2 instances' security group from the ALB's security group automatically permits traffic from all current and future ALB nodes. This is the AWS-recommended pattern because ALB IP addresses change dynamically and cannot be reliably hardcoded. It also ensures only traffic that passed through the load balancer reaches the instances.

Answer

Keep the existing rule that allows inbound HTTP from 0.0.0.0/0, but add a network ACL to block traffic from the internet.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's public IP addresses.

Question 11

A SysOps administrator needs to create a VPC with both public and private subnets. The public subnet will host a NAT gateway and a bastion host. The private subnet will host application servers that need outbound internet access for updates. Which routing configuration should the administrator implement?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> NAT Gateway.. The public subnet needs a route to the Internet Gateway so the NAT gateway and bastion host are reachable from the internet. The private subnet needs a route to the NAT gateway (which itself lives in the public subnet) so application servers can initiate outbound internet traffic without being directly reachable inbound.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway via the NAT Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

Question 12

A company is using Amazon CloudFront with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible via CloudFront. The SysOps administrator has configured an Origin Access Identity (OAI) and updated the bucket policy to allow access only to the OAI. However, users are still able to access the S3 bucket directly via the S3 URL. What is the most likely reason?

Accepted Answer

The bucket policy allows public read access in addition to the OAI access.. The most likely reason users can still access the S3 bucket directly is that the bucket policy contains a statement granting public read access (e.g., 'Principal': '*') in addition to the OAI allow statement. Even with OAI configured, an explicit public allow overrides the restriction. The bucket policy must be reviewed to remove any public access grants.

Answer

The bucket policy does not include a condition to require the OAI.

Answer

The OAI is not properly associated with the CloudFront distribution.

Answer

The S3 bucket is configured as a static website.

Question 13

Which TWO actions should a SysOps administrator take to improve the availability and reduce latency for a web application hosted on EC2 instances behind an Application Load Balancer?

Accepted Answer

Implement Auto Scaling to add instances based on CPU utilization.. Auto Scaling based on CPU utilization dynamically adjusts the number of EC2 instances to match demand, improving availability by ensuring sufficient capacity during traffic spikes and reducing latency by distributing load across more instances. Option E is correct because deploying EC2 instances in multiple Availability Zones (AZs) provides fault tolerance: if one AZ fails, the ALB continues routing traffic to healthy instances in other AZs, which also reduces latency by serving users from the closest AZ.

Answer

Use larger EC2 instance types to handle more traffic.

Answer

Configure the ALB health check to have a shorter interval.

Answer

Use an Amazon CloudFront distribution in front of the ALB to cache content at edge locations.

Question 14

Which THREE configurations are required to enable an EC2 instance in a private subnet to access the internet for software updates while preventing inbound internet traffic?

Accepted Answer

Attach an Internet Gateway to the VPC.. An Internet Gateway (IGW) is required for any VPC to enable internet connectivity. Without an IGW, traffic cannot leave or enter the VPC from the internet. For a private subnet EC2 instance to reach the internet for software updates, the VPC must have an IGW attached, and the NAT Gateway (placed in a public subnet) uses the IGW to forward outbound traffic while blocking inbound connections.

Answer

Assign an Elastic IP address to the EC2 instance.

Answer

Deploy a bastion host in the private subnet.

Question 15

Which TWO are valid methods to secure traffic between a client and an Application Load Balancer?

Accepted Answer

Configure a listener on port 443 with an SSL certificate from AWS Certificate Manager.. Configuring a listener on port 443 with an SSL certificate from ACM enables TLS encryption between the client and the ALB. Option B is also correct: using a security group that only allows HTTPS traffic enforces that all traffic must be encrypted, securing the communication by blocking unencrypted HTTP traffic. Options C, D, and E are incorrect: IPsec VPN is not terminated on an ALB (C), network ACLs do not provide encryption (D), and SSL/TLS encryption requires a valid certificate (E).

Answer

Set up an IPsec VPN connection between the client and the ALB.

Answer

Configure a network ACL to allow only port 443.

Answer

Enable the ALB's built-in SSL/TLS encryption without a certificate.