SOA-C02 Networking and Content Delivery Practice Test 11 — 15 Questions

Question 1

A company runs a multi-tier web application in a VPC with public and private subnets. The web servers (EC2 instances) are in public subnets, and the database servers (RDS MySQL) are in private subnets. The web servers need to connect to the database servers on port 3306. The security group for the RDS instances (sg-db) has an inbound rule allowing TCP port 3306 from the security group of the web servers (sg-web). The web servers can connect to the database, but the connection is intermittent and slow. The SysOps administrator checks the network ACLs and finds that both the public and private subnet network ACLs have default allow all entries. What is the most likely cause of the issue?

Accepted Answer

The network ACL for the private subnet does not have an outbound rule to allow return traffic on ephemeral ports. Option D is correct because the network ACL for the private subnet has no outbound rule to allow return traffic (ephemeral ports) from the database back to the web servers. Network ACLs are stateless, so despite the inbound rule allowing traffic from the web servers, the outbound rule must allow return traffic. Option A is wrong because the security group rule is correct. Option B is wrong because RDS is not a web server; it doesn't need a public subnet. Option C is wrong because NACLs are stateless, not stateful.

Answer

The RDS instances are in a private subnet and cannot receive traffic from public subnets

Answer

The security group for the RDS instances is missing an inbound rule for port 3306 from the web servers' IP range

Answer

The network ACLs are stateful and require an outbound rule for ephemeral ports

Question 2

A company has deployed a global web application using AWS CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is in a single AWS region. Users in different geographic regions report high latency, and some users are unable to access the application. The SysOps administrator verifies that the CloudFront distribution is configured correctly and that the ALB is healthy. The administrator also confirms that the ALB's security group allows traffic from the CloudFront IP ranges. What is the most likely cause of the issue?

Accepted Answer

The ALB is overwhelmed by the number of concurrent connections from CloudFront. Option B is correct because if the ALB is not configured to handle the volume of requests from CloudFront's edge locations, it can become overwhelmed, causing latency and errors. Option A is wrong because CloudFront caches content, reducing load on the origin. Option C is wrong because CloudFront uses HTTP/HTTPS, not TCP/UDP. Option D is wrong because while SSL/TLS adds overhead, it is not the primary cause of regional access issues.

Answer

CloudFront is not caching content, causing all requests to go to the origin

Answer

The CloudFront distribution is using TCP instead of HTTP, causing higher latency

Answer

The SSL/TLS certificate on the ALB is not trusted by CloudFront

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket to store logs. The instance currently has no internet access. The SysOps administrator has created a VPC endpoint for S3 (gateway type) and attached it to the VPC. The instance still cannot reach S3. What additional step is required?

Accepted Answer

Add a route in the private subnet's route table pointing to the S3 endpoint. Option A is correct because the route table for the private subnet must have a route to the S3 endpoint (prefix list). Option B is wrong because S3 endpoints do not require internet access. Option C is wrong because the endpoint policy is not the issue if it allows all actions. Option D is wrong because the instance's security group does not block traffic to S3 by default.

Answer

Attach an Internet Gateway to the VPC and add a route to it

Answer

Add a security group rule to allow outbound HTTPS traffic to S3

Answer

Modify the endpoint policy to allow all S3 actions

Question 4

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The VPC has a private subnet with EC2 instances that need to communicate with on-premises servers. The on-premises network team reports that they can ping the EC2 instances, but the EC2 instances cannot ping the on-premises servers. The SysOps administrator checks the route tables and finds that the VPC has a route to the on-premises CIDR via the virtual private gateway. The security groups allow all ICMP traffic. What is the most likely cause?

Accepted Answer

The on-premises network does not have a route back to the VPC CIDR through the Direct Connect. Option C is correct because the on-premises servers need to have a route back to the VPC CIDR through the Direct Connect. The fact that they can ping the EC2 instances indicates that traffic from on-premises to VPC is working, but the return traffic may be going through the internet instead of Direct Connect if the on-premises route is not configured. Option A is wrong because the VPC route is present. Option B is wrong because security groups allow ICMP. Option D is wrong because NACLs default to allow all.

Answer

The security group on the EC2 instances blocks outbound ICMP

Answer

The network ACL for the private subnet blocks outbound traffic

Answer

The VPC route table does not have a route to the on-premises CIDR via the virtual private gateway

Question 5

A company uses Amazon Route 53 as its DNS service. They have a domain example.com with an alias record pointing to an Application Load Balancer (ALB). Recently, they updated the ALB's DNS name, but the Route 53 record was not updated. Users are still being directed to the old ALB, which has been decommissioned. The SysOps administrator updates the alias record to point to the new ALB DNS name. However, users still experience errors for several hours. What is the most likely reason?

Accepted Answer

The TTL on the DNS record is set too high, causing client-side caching. Option D is correct because the TTL (Time to Live) on the DNS record determines how long resolvers cache the response. If the TTL is high, clients and intermediate DNS resolvers will continue to use the old IP for the duration of the TTL. Option A is wrong because the alias record was updated. Option B is wrong because propagation is instant for alias records. Option C is wrong because DNSSEC does not cause caching issues.

Answer

Route 53 requires time to propagate changes globally

Answer

The alias record was not saved correctly

Answer

The domain is using DNSSEC, which delays updates

Question 6

A company has a VPC with both IPv4 and IPv6 CIDR blocks. They have a public subnet with an EC2 instance that needs to be accessible over IPv6 from the internet. The instance has an IPv6 address assigned. The SysOps administrator has attached an Internet Gateway (IGW) to the VPC and added a route to the IGW for the public subnet's IPv6 route table. However, the instance is not reachable over IPv6. What is the missing configuration?

Accepted Answer

The security group attached to the instance does not allow inbound IPv6 traffic. Option B is correct because for IPv6 traffic, an egress-only Internet Gateway (EIGW) is required for outbound, but for inbound, an IGW supports both IPv4 and IPv6. Actually, IGW supports IPv6 inbound. The issue might be that the route table needs a route for ::/0 to the IGW. Option A is correct: The route table must have a route for all IPv6 traffic (::/0) to the IGW. Option B is wrong because EIGW is for outbound only. Option C is wrong because security groups allow inbound by default? No, they block inbound by default. So the security group must allow IPv6 traffic. Actually, both A and C could be correct. But the stem says they added a route to the IGW, but maybe they added a specific route? The most likely missing configuration is the security group rule. Let's check: The question says they added a route to the IGW for the public subnet's IPv6 route table. But the route must be for ::/0. If they added a specific route, that might be the issue. But the most common oversight is the security group. I'll go with Option C as the most likely. Option A is also plausible. To differentiate, the question says they added a route to the IGW, but doesn't specify if it's a default route. If they added a specific route, the instance might still be unreachable. However, the typical missing step is updating the security group. So I'll choose C.

Answer

The instance does not have a public IPv6 address assigned

Answer

The route table for the subnet does not have a default route (::/0) to the IGW

Answer

An egress-only Internet Gateway is required for IPv6

Question 7

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses sticky sessions (session affinity) based on cookies. Recently, the SysOps team noticed that user sessions are being lost intermittently, causing users to be logged out. The team checks the ALB configuration and finds that the stickiness is enabled with a cookie name 'AWSALB' and duration of 1 hour. The application also sets its own cookie. What is the most likely cause of session loss?

Accepted Answer

The application's session cookie has a shorter expiration than the ALB's stickiness duration. Option A is correct because if the application's cookie is set to expire before the ALB's stickiness duration, the session may be lost when the application cookie expires. Option B is wrong because cross-zone load balancing does not affect stickiness. Option C is wrong because health checks do not remove stickiness unless the instance becomes unhealthy. Option D is wrong because the ALB generates its own cookie; the application setting a cookie does not interfere unless it overwrites.

Answer

The ALB's health check interval is too short, causing instances to be marked unhealthy

Answer

The application cookie is overwriting the ALB's stickiness cookie

Answer

Cross-zone load balancing is disabled on the ALB

Question 8

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. Users report intermittent 503 errors. The SysOps Administrator checks the ALB metrics and sees that the Sum of HTTP 503s correlates with spikes in CPU utilization on the EC2 instances. What is the MOST likely cause and solution?

Accepted Answer

Configure the Auto Scaling group to scale out based on average CPU utilization and ensure sufficient capacity.. Option C is correct because high CPU utilization on instances can cause them to become unhealthy, leading the ALB to stop sending traffic and returning 503 errors. Option A is wrong because cross-zone load balancing distributes traffic evenly across all zones; disabling it could worsen the issue. Option B is wrong because decreasing the health check interval would make the ALB check more frequently, potentially marking instances unhealthy faster. Option D is wrong because increasing the deregistration delay only affects instances being deregistered, not the current issue.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay on the ALB target group to allow in-flight requests to complete.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Question 9

A SysOps Administrator manages a VPC with public and private subnets. The private subnets need to access the internet for software updates. The Administrator creates a NAT Gateway in a public subnet and updates the private subnet route table to point 0.0.0.0/0 to the NAT Gateway. However, instances in the private subnet still cannot reach the internet. What is the MOST likely reason?

Accepted Answer

The NAT Gateway does not have an Elastic IP address assigned.. Option B is correct because the NAT Gateway must have a public IP and the route table for the private subnet must point to the NAT Gateway ID. Option A is wrong because security group rules for private instances should allow outbound traffic (e.g., HTTPS), but by default outbound is allowed; the issue is likely the route. Option C is wrong because the NAT Gateway's security group is not used; NAT Gateways do not have security groups. Option D is wrong because the internet gateway must be attached to the VPC, not to the NAT Gateway.

Answer

The security group on the private instances blocks outbound HTTPS traffic.

Answer

The internet gateway is not attached to the NAT Gateway.

Answer

The NAT Gateway's security group is blocking inbound traffic from the private subnet.

Question 10

A company has a VPC that requires DNS resolution for custom domain names within the VPC. They want to use a private hosted zone in Amazon Route 53. Which resource is required to associate the private hosted zone with the VPC?

Accepted Answer

A VPC. To associate a private hosted zone with a VPC in Amazon Route 53, you must specify the VPC ID and the AWS Region of the VPC. The VPC itself is the required resource because the private hosted zone is scoped to one or more VPCs, enabling DNS resolution for custom domain names only within those VPCs. Without a VPC association, the private hosted zone cannot serve DNS queries.

Answer

A resolver rule

Answer

A public hosted zone

Answer

A CNAME record

Question 11

A SysOps Administrator is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. After the peering connection is accepted, instances in VPC-A cannot ping instances in VPC-B. Both VPCs have non-overlapping CIDR blocks. What is the MOST likely cause?

Accepted Answer

The route tables in both VPCs do not have routes to the peer VPC CIDR.. The most likely cause is that the route tables in both VPCs do not have routes to the peer VPC CIDR. Even after a VPC peering connection is accepted, traffic cannot flow between the VPCs unless explicit routes are added to each VPC's route table pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, instances in VPC-A have no path to reach instances in VPC-B, so ping fails.

Answer

VPC peering does not support cross-account connections.

Answer

The CIDR blocks overlap, causing routing conflicts.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Question 12

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The application needs to authenticate users using an external identity provider (IdP). The SysOps Administrator recommends using Amazon Cognito as an identity broker. Which ALB action should be configured to authenticate users before forwarding requests to the target group?

Accepted Answer

An authenticate action using Amazon Cognito as the user pool.. Amazon Cognito integrates directly with Application Load Balancers via an authenticate action. When you configure an ALB rule with an authenticate action using a Cognito user pool, the ALB handles the OAuth 2.0 / OpenID Connect flow with the external IdP, obtains tokens, and only forwards authenticated requests to the target group. This eliminates the need for custom authentication logic in the application.

Answer

A fixed-response action to return a 401 status code.

Answer

A redirect action to the IdP login page.

Answer

A forward action to the target group.

Question 13

A company uses Amazon CloudFront to deliver static content from an Amazon S3 bucket. Users in Europe report slow load times. Which CloudFront feature would MOST effectively improve performance for these users?

Accepted Answer

Add additional edge locations in Europe and use regional edge caches.. Adding additional edge locations in Europe and using regional edge caches (Option B) reduces latency by serving content from geographically closer points of presence (PoPs) and by caching objects at a regional layer that aggregates requests from multiple edge locations, which improves cache hit ratios and reduces the load on the origin. This directly addresses the slow load times reported by European users by minimizing the distance data must travel.

Answer

Enable origin shield.

Answer

Enable HTTP/3 (QUIC) support on the distribution.

Answer

Configure geo restriction to allow only European users.

Question 14

A SysOps Administrator is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. The instances can communicate over private IP addresses when security groups are set to allow all traffic, but fail when security groups are configured with specific rules. The Administrator wants to allow HTTP (port 80) and HTTPS (port 443) traffic from the client instance to the server instance. What security group rules are needed?

Accepted Answer

Add inbound rules on the server to allow HTTP and HTTPS from the client security group.. Option D is correct because security groups are stateful; you only need inbound rules on the server to allow HTTP/HTTPS from the client. The outbound response is automatically allowed. Option A is wrong because outbound rules on the client are not needed for response. Option B is wrong because inbound rules on the client are not needed. Option C is wrong because outbound rules on the server are not needed for response.

Answer

Add inbound rules on both the client and server.

Answer

Add outbound rules on both the client and server.

Answer

Add inbound rules on the client and outbound rules on the server.

Question 15

A company is using Amazon Route 53 for DNS and wants to route traffic to multiple endpoints based on the geographic location of the user. Which routing policy should the SysOps Administrator use?

Accepted Answer

Geolocation routing. Geolocation routing (Option A) is correct because it allows Route 53 to route traffic based on the geographic location of the DNS query's source IP address. This is ideal for scenarios where you need to direct users to specific endpoints based on their country, continent, or even US state, such as complying with data sovereignty laws or delivering localized content.

Answer

Weighted routing

Answer

Failover routing

Answer

Latency routing