SOA-C02 Networking and Content Delivery Practice Test 12 — 15 Questions

Question 1

Which TWO AWS services can be used to improve the security of a VPC? (Choose TWO.)

Accepted Answer

Security Groups. Security Groups (A) act as a virtual firewall for instances, controlling inbound and outbound traffic at the instance level based on allow rules only. Network ACLs (D) provide a stateless firewall layer at the subnet level, supporting both allow and deny rules, and are evaluated in numeric order. Together, they offer defense-in-depth for VPC traffic filtering.

Answer

Internet Gateway

Answer

Route Tables

Answer

VPC Peering

Question 2

Refer to the exhibit. A VPC Gateway Endpoint for S3 is created and associated with route table rtb-11111111. However, an EC2 instance in a subnet that uses route table rtb-22222222 cannot access S3. What is the most likely cause?

Accepted Answer

The subnet's route table (rtb-22222222) does not have a route to the VPC endpoint.. The Gateway Endpoint is only associated with rtb-11111111, not rtb-22222222. Option A is wrong because the state is available. Option C is wrong because the policy allows s3:GetObject. Option D is wrong because S3 is a regional service, but the endpoint is in the correct region.

Answer

The VPC endpoint is not in the 'available' state.

Answer

The endpoint policy does not allow the s3:GetObject action.

Answer

The VPC endpoint is in a different region from the S3 bucket.

Question 3

Refer to the exhibit. An EC2 instance is registered with an ALB target group. The health check returns 502. What is the most likely cause?

Accepted Answer

The web server on the instance is returning an HTTP 502 response.. A 502 Bad Gateway from the ALB indicates that the target responded with an invalid or empty HTTP response, which is usually caused by the web server on the instance returning an HTTP 502 error. Option A is wrong because a network ACL blocking traffic would result in a connection timeout (504) or unreachable error, not a 502. Option B is wrong: if the instance were not registered, the ALB would not perform health checks on it; the fact that a health check is failing shows the instance is registered. Option D is wrong: a mismatch between HealthCheck protocol (HTTPS) and instance support (HTTP) would cause the ALB to fail to establish a TLS connection, resulting in a 504 Gateway Timeout or a connection error, not a 502.

Answer

The instance is not reachable from the ALB due to a network ACL.

Answer

The instance is not registered with the target group.

Answer

The health check path is configured for HTTPS but the instance only supports HTTP.

Question 4

A company's web application uses an Application Load Balancer (ALB) in front of multiple EC2 instances in an Auto Scaling group. Users report intermittent 503 errors. The ALB health checks are configured to check the /health endpoint every 30 seconds with a threshold of 2 successful checks to mark healthy. The Auto Scaling group’s health check grace period is set to 60 seconds. What is the most likely cause of the 503 errors?

Accepted Answer

The health check endpoint is returning a 500 status code intermittently.. 503 errors from an ALB occur when all healthy targets are unavailable. If the /health check endpoint intermittently returns a 500 status code, the ALB considers those instances unhealthy and stops routing traffic to them, resulting in 503 errors. Option A is incorrect because the ALB idle timeout affects idle connections, not health check failures. Option B is incorrect because the health check grace period is only relevant during instance launch; it does not affect ongoing health checks. Option C is incorrect while overloaded instances can cause performance degradation, the specific intermittent 503 errors point to health check failures rather than resource exhaustion.

Answer

The ALB’s idle timeout is set too low.

Answer

The Auto Scaling group health check grace period is too short.

Answer

The EC2 instances are of a small instance type and are overloaded.

Question 5

A SysOps administrator needs to route traffic to multiple AWS regions for a global application with low latency. Which AWS service should be used?

Accepted Answer

Amazon Route 53 with latency routing policy. Amazon Route 53 with a latency routing policy directs traffic to the AWS region that provides the lowest latency for each user, based on measurements of network round-trip time. This is the correct choice for routing traffic to multiple regions to minimize latency for a global application.

Answer

Amazon CloudFront

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Question 6

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet. Private EC2 instances need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT Gateway is not placed in a public subnet with a route to an internet gateway.. A NAT Gateway must be deployed in a public subnet that has a route to an internet gateway. Although the private subnet's route table points to the NAT Gateway for default traffic, if the NAT Gateway's subnet lacks a route to an internet gateway, the NAT Gateway cannot forward traffic to the internet. Option A is incorrect because network ACLs could block traffic, but the stated issue—instances cannot reach the internet via a properly configured route—points to the NAT Gateway's subnet configuration as the most likely cause. Option C is incorrect because even if the private instances' security group allows outbound HTTPS, the NAT Gateway still needs internet connectivity. Option D is incorrect because while a NAT Gateway requires an Elastic IP address, the scenario assumes the NAT Gateway is deployed; typically, an Elastic IP is assigned during creation, so the missing route to the internet gateway is the more probable cause.

Answer

The private subnet’s network ACL is blocking outbound traffic.

Answer

The security group for the private instances does not allow outbound HTTPS.

Answer

The NAT Gateway does not have an Elastic IP address assigned.

Question 7

An organization wants to allow an on-premises data center to access an Amazon RDS database in a VPC. Which AWS service should be used to establish a dedicated, private, and high-bandwidth connection?

Accepted Answer

AWS Direct Connect. (AWS Direct Connect) is correct because it provides a dedicated, private, high-bandwidth connection from on-premises to AWS. Option B (AWS Transit Gateway) is used to interconnect VPCs and on-premises networks but does not itself provide a dedicated connection; it relies on other connections like VPN or Direct Connect. Option C (AWS Site-to-Site VPN) provides encrypted connectivity over the internet, not a dedicated private connection. Option D (VPC Peering) allows connectivity between VPCs, not between on-premises and AWS.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 8

A SysOps administrator notices that traffic to an Application Load Balancer (ALB) is being rejected. The ALB has a security group that allows inbound HTTP (80) and HTTPS (443) from 0.0.0.0/0. The target group health checks are failing. What could be the issue?

Accepted Answer

The target instances' security group does not allow inbound traffic from the ALB security group.. The issue is that the target instances' security group must allow inbound traffic from the ALB's security group (or the ALB's private IP addresses) for health checks to succeed. The ALB's security group allows inbound from 0.0.0.0/0 on ports 80/443 for client traffic, but health checks are initiated by the ALB to the targets. If the target security group does not permit this traffic, health checks fail. Option A correctly identifies this issue. Option B is incorrect because the ALB's security group does not need to explicitly allow outbound to targets; security groups are stateful. Option C is incorrect because the ALB's security group controls inbound from clients, not inbound to targets. Option D is incorrect because target instances do not need to allow inbound from the internet directly; traffic is forwarded by the ALB.

Answer

The ALB security group does not allow outbound traffic to the targets.

Answer

The ALB’s security group is blocking health check traffic from the targets.

Answer

The target instances' security group does not allow inbound HTTP/HTTPS from the internet.

Question 9

A company uses Amazon CloudFront to serve static content from an S3 bucket. The S3 bucket is configured as an origin with RestrictBucketAccess set to Yes, and the origin access identity (OAI) is configured. Users can access the content via CloudFront, but direct S3 URLs return Access Denied. However, some users report that they can still access the content directly via S3 URLs. What is the most likely reason?

Accepted Answer

The S3 bucket policy allows public read access in addition to the OAI.. If the bucket policy allows public read access, it overrides the OAI restriction. The OAI only restricts access if the bucket policy explicitly denies all principals except the OAI. Option A is wrong because the OAI is properly set up. Option C is wrong because CloudFront does not use pre-signed URLs for OAI. Option D is wrong because if the OAI is not in the bucket policy, the default is public access if the bucket is public.

Answer

The OAI is not properly associated with the CloudFront distribution.

Answer

The CloudFront distribution is using a custom origin instead of S3.

Answer

CloudFront is using pre-signed URLs that are being shared.

Question 10

A SysOps administrator needs to monitor the amount of data transferred through a VPC’s internet gateway. Which Amazon CloudWatch metric should be used?

Accepted Answer

NetworkIn (AWS/EC2 namespace). The correct metric is NetworkIn under the AWS/EC2 namespace, which measures the number of bytes received by an EC2 instance from the network, including traffic from the internet gateway. BytesOutToSource is not a valid CloudWatch metric for internet gateways; the only available metrics in the AWS/VPC namespace are for NAT gateways, not internet gateways. Options A and D are invalid. Option B measures packets, not bytes, and is less appropriate for monitoring data transfer volume.

Answer

InternetGatewayBytes (AWS/VPC namespace)

Answer

NetworkPackets (AWS/EC2 namespace)

Answer

BytesOutToSource (AWS/VPC namespace)

Question 11

A company wants to distribute content globally with low latency and high transfer speeds. The content is stored in S3 buckets in multiple regions. Which AWS service should be used to accelerate content delivery?

Accepted Answer

Amazon CloudFront. (Amazon CloudFront) is correct because it is a CDN that caches content at edge locations for low latency and high transfer speeds. Option A (Amazon Route 53) is DNS and does not accelerate content delivery. Option C (AWS Global Accelerator) improves TCP/UDP performance but is not primarily for caching static content. Option D (S3 Transfer Acceleration) speeds up uploads to S3, not content distribution.

Answer

Amazon Route 53

Answer

AWS Global Accelerator

Answer

S3 Transfer Acceleration

Question 12

A SysOps administrator is troubleshooting an issue where an EC2 instance in a private subnet cannot connect to the internet. The instance has a security group allowing outbound HTTPS traffic. The subnet’s route table has a default route (0.0.0.0/0) to a NAT Gateway. The NAT Gateway is in a public subnet with an Elastic IP and a route to an internet gateway. What is a likely cause of the issue?

Accepted Answer

The subnet’s network ACL is blocking outbound ephemeral ports.. Network ACLs are stateless. When the EC2 instance initiates HTTPS (port 443) to the internet, the return traffic arrives on a random ephemeral port (1024-65535). The NACL must allow inbound traffic on those ephemeral ports. If the NACL blocks inbound ephemeral ports, the connection fails even though the security group is stateful and allows return traffic. Outbound ephemeral ports are not relevant because the outbound packet's destination port is 443.

Answer

The NAT Gateway does not have an Elastic IP.

Answer

The private subnet has a route to an internet gateway.

Answer

The security group is blocking inbound traffic from the NAT Gateway.

Question 13

Which THREE AWS services can be used to improve security and performance for a web application that uses an Application Load Balancer? (Select three.)

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protection against Distributed Denial of Service (DDoS) attacks, including application-layer attacks targeting the Application Load Balancer (ALB). It integrates directly with ALB to offer always-on detection and automatic mitigation, improving security without requiring changes to the application architecture.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 14

Which TWO methods can be used to secure an S3 bucket that is used as an origin for Amazon CloudFront? (Select two.)

Accepted Answer

Write a bucket policy that allows only the CloudFront distribution’s OAI.. A bucket policy that grants access only to the CloudFront distribution's OAI ensures that only CloudFront can retrieve objects, preventing direct public access. Option D is correct because configuring an origin access identity (OAI) and restricting bucket access is the standard method to secure the S3 origin. Option B is incorrect because granting public read access via bucket ACLs would allow anyone to access the bucket, defeating security. Option C is incorrect because S3 server-side encryption protects data at rest but does not control access to the bucket. Option E is incorrect because pre-signed URLs provide temporary access to individual objects but are not a method to secure the origin bucket itself.

Answer

Use bucket ACLs to grant public read access.

Answer

Enable S3 server-side encryption.

Answer

Generate pre-signed URLs for all objects.

Question 15

Refer to the exhibit. A SysOps administrator is troubleshooting connectivity issues for a web application that uses an ALB. The ALB sends health check requests to targets on port 443. The network ACL shown is associated with the target subnet. Based on the exhibit, what is causing the health checks to fail?

Accepted Answer

The network ACL allows inbound HTTPS (443) from 0.0.0.0/0, which includes the ALB, so this should work. The issue is likely elsewhere.. The network ACL has an inbound rule (Rule 120) that denies all traffic (protocol -1) after allowing specific ports. However, health checks originate from the ALB's private IP addresses, which are not 0.0.0.0/0? Actually, the ALB's health check traffic comes from the ALB's subnet IPs, which might be in the same VPC or different? The NACL rule 100 allows TCP 443 from 0.0.0.0/0, which should include the ALB's IPs. But the deny rule 120 will block traffic not matching the allow rules. However, health check traffic on port 443 should be allowed by rule 100. The issue might be that the NACL is stateless, and the ephemeral ports for response are not allowed. But the question is about health checks failing. Option B is wrong because the ALB does not send health checks on port 80 unless configured. Option C is wrong because health checks originate from ALB, not internet. Option D is wrong because the NACL allows inbound 443 from 0.0.0.0/0.

Answer

The network ACL does not allow inbound traffic from the ALB on ephemeral ports.

Answer

The network ACL is blocking inbound traffic from the internet, but health checks come from the ALB.

Answer

The network ACL does not allow inbound HTTP (port 80) from the ALB.