SOA-C02 Networking and Content Delivery Practice Test 11 — 15 Questions

Question 1

A SysOps administrator is setting up a Network Load Balancer (NLB) to handle millions of requests per second. The target group consists of EC2 instances that are in a single Availability Zone. Which of the following is a potential issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

If the single AZ becomes unavailable, the NLB will not automatically fail over to other AZs.. Option A is the correct answer because if the NLB is provisioned in a single Availability Zone (AZ) and that AZ fails, the NLB will not automatically fail over to other AZs, which is a potential issue for high availability. Option B is incorrect because an NLB can be associated with only one AZ. Option C is incorrect because the NLB can preserve the source IP address when using instance targets. Option D is incorrect because the NLB can handle high throughput even in a single AZ.

Answer

The NLB cannot be associated with only one Availability Zone.

Answer

The NLB cannot preserve the source IP address of the client.

Answer

The NLB will not be able to handle the traffic volume due to the single AZ limitation.

Question 2

A company uses AWS Global Accelerator to improve the performance of a web application hosted in multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region as the endpoint. Users report that traffic is not being routed to the closest region. What could be the cause?

Accepted Answer

The health checks for the ALBs are failing, so traffic is diverted to other regions.. Global Accelerator uses health checks to determine endpoint availability. If the health checks for an ALB in a user's closest region are failing, Global Accelerator will consider that endpoint unhealthy and route traffic to the next closest healthy region. This causes users to be directed to a region farther away, even though a closer region exists.

Answer

The Global Accelerator is not configured with a custom routing accelerator.

Answer

The ALBs are not configured to allow cross-region communication.

Answer

The endpoints are configured in the same AWS region.

Question 3

A SysOps administrator is planning a VPC design with high availability for an application that must tolerate the failure of an entire Availability Zone. Which TWO configurations should be implemented? (Select TWO.)

Accepted Answer

Deploy a NAT Gateway in each Availability Zone.. Deploying a NAT Gateway in each Availability Zone ensures that private subnets in each AZ have a route to the internet via a NAT Gateway that resides in the same AZ, preventing cross-AZ data transfer costs and maintaining high availability if an entire AZ fails. Option C is correct because launching EC2 instances in at least two Availability Zones provides fault tolerance at the compute layer, allowing the application to continue serving traffic even if one AZ becomes unavailable.

Answer

Use a single NAT Gateway for all private subnets.

Answer

Use a placement group to ensure instances are in different AZs.

Answer

Use only one public subnet and one private subnet.

Question 4

A SysOps administrator is troubleshooting an issue where an EC2 instance in a private subnet cannot connect to the internet via a NAT Gateway. Which TWO components must be correctly configured for this to work? (Select TWO.)

Accepted Answer

The NAT Gateway must be placed in a public subnet with a route to an Internet Gateway.. The NAT Gateway must reside in a public subnet because it needs a direct route to an Internet Gateway (IGW) to translate private IP addresses to the NAT Gateway's Elastic IP for outbound internet traffic. Without this placement and route, the NAT Gateway cannot forward traffic to the internet, breaking connectivity for instances in private subnets.

Answer

The network ACL for the private subnet must have a rule allowing inbound traffic from the NAT Gateway.

Answer

The EC2 instance must have a public IP address.

Answer

The security group for the EC2 instance must allow inbound traffic on port 80.

Question 5

Refer to the exhibit. A VPC peering connection exists between VPC A (CIDR 10.0.0.0/16) and VPC B (CIDR 192.168.0.0/16). The command output shows the route table for VPC A (rtb-11111111) and VPC B (rtb-33333333). An instance in VPC A (private IP 10.0.1.5) cannot ping an instance in VPC B (private IP 192.168.1.10). What is the most likely reason?

Accepted Answer

The route table for VPC A is missing a route to 192.168.0.0/16 via the peering connection.. The route table for VPC A (rtb-11111111) does not have a route to VPC B's CIDR (192.168.0.0/16) via the peering connection (pcx-44444444). It only contains routes for the local VPC and an Internet Gateway. The route table for VPC B (rtb-33333333) includes a route to VPC A's CIDR via the peering connection, but the missing route in VPC A prevents traffic from VPC A to VPC B. Option B is incorrect because the security group for the instance in VPC B is not shown and cannot be determined from the exhibit. Option C is incorrect because the peering connection status is not shown, but the presence of routes indicates it is active (otherwise no routes would appear). Option D is incorrect because the network ACL for the subnet in VPC A is not shown, and the problem is a missing route, not a NACL rule.

Answer

The security group for the instance in VPC B blocks ICMP traffic.

Answer

The VPC peering connection status is not active.

Answer

The network ACL for the subnet in VPC A blocks outbound ICMP.

Question 6

Refer to the exhibit. A SysOps administrator is troubleshooting a CloudFront distribution that serves content from an S3 bucket. Users are receiving 'Access Denied' errors when trying to access objects. The exhibit shows the distribution configuration. What is the most likely cause?

Accepted Answer

The CloudFront distribution is not using an Origin Access Identity (OAI) to authenticate with the S3 bucket.. The exhibit shows that the Origin Access Identity (OAI) field is empty, meaning CloudFront is not using an OAI to authenticate with the S3 bucket. Without an OAI, CloudFront relies on the bucket being publicly accessible, but by default S3 buckets are private. Therefore, CloudFront cannot access the objects, resulting in 'Access Denied' errors. Option A is not evident from the exhibit; the bucket policy is not shown. Option B is incorrect because the distribution status is 'Enabled' in the exhibit. Option D is incorrect because the viewer protocol policy 'Redirect HTTP to HTTPS' would redirect users, not cause Access Denied.

Answer

The S3 bucket policy does not grant read access to CloudFront.

Answer

The distribution is not enabled.

Answer

The viewer protocol policy is set to 'redirect-to-https', but users are using HTTP.

Question 7

A company has deployed a web application behind an Application Load Balancer (ALB) across multiple Availability Zones. Users in some regions report slow page load times. Which action should the SysOps Administrator take to improve performance for all users?

Accepted Answer

Use AWS Global Accelerator to route traffic over the AWS global network.. AWS Global Accelerator improves performance by directing traffic over the AWS global network and using edge locations close to users, reducing latency for all users. Option A is correct because it optimizes the path from users to the application. Option B is incorrect because increasing ALB capacity only helps with handling more requests, not latency for geographically distant users. Option C is incorrect because CloudFront is primarily for caching static content, and the application serves dynamic content that may not be cacheable. Option D is incorrect because moving to a single Availability Zone reduces fault tolerance and does not address latency for users far from that zone.

Answer

Increase the ALB capacity by adding more target instances.

Answer

Enable Amazon CloudFront to cache dynamic content.

Answer

Move the application to a single Availability Zone to reduce network hops.

Question 8

A SysOps Administrator needs to allow an EC2 instance in a private subnet to access the internet for software updates. Which AWS service should be used?

Accepted Answer

NAT Gateway. A NAT Gateway enables EC2 instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet. It translates the private IP of the instance to the NAT Gateway's Elastic IP using Source Network Address Translation (SNAT). This is the correct service because the instance is in a private subnet and requires internet access without being directly reachable.

Answer

VPN Connection

Answer

Internet Gateway

Answer

VPC Peering

Question 9

An organization has a VPC peering connection between VPC A and VPC B. Instances in VPC A can reach instances in VPC B, but not vice versa. What is the most likely cause?

Accepted Answer

The route table in VPC B does not have a route to VPC A's CIDR.. For a VPC peering connection to allow bidirectional traffic, both VPCs must have routes in their route tables pointing to the other VPC's CIDR block. Since instances in VPC A can reach VPC B but not vice versa, the most likely cause is that VPC B's route table lacks a route to VPC A's CIDR. Without this route, VPC B's subnet does not know how to forward return traffic to VPC A, even though the peering connection itself is active.

Answer

DNS resolution is not enabled for the VPC peering connection.

Answer

Security groups in VPC B block inbound traffic from VPC A.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 10

A company wants to distribute content with low latency to users globally. The content is static and stored in an S3 bucket. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users by serving data from the nearest edge. It integrates directly with S3 buckets as an origin, providing low-latency distribution of static content without requiring any changes to the S3 bucket configuration.

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Answer

S3 Transfer Acceleration

Question 11

A company has deployed an Application Load Balancer (ALB) in a VPC. The ALB is configured with a target group pointing to EC2 instances in a private subnet. Clients receive HTTP 503 errors. What is the likely cause?

Accepted Answer

The target instances are unhealthy and the target group has zero healthy hosts.. HTTP 503 errors from an Application Load Balancer indicate that the target group has no healthy registered targets to forward traffic to. When all EC2 instances in the target group are unhealthy (e.g., failing health checks), the ALB cannot route requests, resulting in a 503 response. This is the most common cause of 503 errors in ALB deployments.

Answer

The ALB does not have an Elastic IP address.

Answer

The security group for the ALB does not allow inbound HTTP traffic.

Answer

The route table for the private subnet does not have a route to the ALB.

Question 12

A SysOps Administrator needs to monitor network traffic in a VPC. Which AWS service provides packet-level information about IP traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing through network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and packet-level details such as packet counts and byte counts. This provides the packet-level information needed for network traffic analysis, unlike higher-level logging services.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A company has a VPC with multiple subnets. An EC2 instance in a public subnet needs to communicate with an RDS database in a private subnet. The RDS security group allows inbound traffic from the EC2 instance's security group. However, the EC2 instance cannot connect. What is the most likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, so the RDS endpoint cannot be resolved.. The RDS database is in a private subnet and its endpoint is a DNS name. If DNS resolution is disabled on the VPC, the EC2 instance cannot resolve the RDS endpoint's hostname to an IP address, preventing the TCP connection from being established even though security group rules are correctly configured.

Answer

The network ACL for the private subnet blocks inbound traffic from the public subnet.

Answer

The security group of the RDS database does not allow outbound traffic.

Answer

The EC2 instance does not have a public IP address.

Question 14

A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)

Accepted Answer

Deploy a NAT Gateway in a public subnet.. A NAT Gateway in a public subnet provides outbound internet access for private instances while preventing inbound connections. The private subnet's route table must include a default route (0.0.0.0/0) pointing to the NAT Gateway, enabling traffic to be forwarded to the internet via the Internet Gateway attached to the VPC.

Answer

Add an Internet Gateway to the private subnet's route table.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach an Internet Gateway to the NAT Gateway.

Question 15

A SysOps Administrator is troubleshooting an issue where an Application Load Balancer (ALB) returns 502 Bad Gateway errors. Which THREE are possible causes? (Choose THREE.)

Accepted Answer

The ALB is configured with a different HTTP method than the target expects.. ALB returns 502 Bad Gateway when it receives an invalid response from the target or cannot establish a connection to a healthy target. Option C is correct: if the ALB sends an HTTP method that the target does not support, the target may close the connection or send an invalid response, leading to a 502. Option D is correct: if the target security group does not allow traffic from the ALB, the connection fails, resulting in 502. Option E is incorrect: when no healthy targets exist, the ALB returns a 503 Service Unavailable, not a 502. Option A causes a 504 Gateway Timeout, and option B typically results in a 404 or similar error, not a 502.

Answer

The target instance is taking too long to respond (e.g., more than the idle timeout).

Answer

The target instance is configured to respond to a different URL path.

Answer

The target group has no healthy instances.