SOA-C02 Networking and Content Delivery Practice Test 12 — 15 Questions

Question 1

A company hosts a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. Which step should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Verify the target group health check settings.. Intermittent 503 errors from an Application Load Balancer typically indicate that the target instances are failing health checks or are unable to handle the request load. Verifying the target group health check settings (e.g., path, interval, threshold, and protocol) is the first troubleshooting step because if the health checks are misconfigured or the targets are unhealthy, the ALB will stop routing traffic to them, resulting in 503 responses.

Answer

Enable cross-zone load balancing.

Answer

Increase the idle timeout on the load balancer.

Answer

Add more subnets to the load balancer.

Question 2

An organization uses Amazon CloudFront to serve static content from an S3 bucket. The content is updated frequently, but users are seeing stale files. What is the most efficient way to invalidate the cache for updated objects?

Accepted Answer

Create a CloudFront invalidation for the updated files.. CloudFront caches objects at edge locations based on the cache key (path, headers, query strings). When origin content changes, the edge cache still serves the old object until TTL expires. Creating an invalidation explicitly purges the specified paths from all edge locations, forcing CloudFront to fetch fresh content from the S3 origin on the next request. This is the fastest, most targeted way to serve updated files without waiting for TTL expiry.

Answer

Use the S3 console to set a new cache-control header.

Answer

Change the origin path in the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 3

A SysOps administrator needs to allow a Lambda function to access a DynamoDB table in the same AWS account. Which configuration is required?

Accepted Answer

Assign an IAM role to the Lambda function with DynamoDB permissions.. Lambda functions assume an IAM role (the execution role) that grants permissions to AWS services. To allow a Lambda function to access a DynamoDB table in the same account, you attach an IAM policy to that execution role granting the necessary DynamoDB actions (e.g., GetItem, PutItem) on the table's ARN. This is the standard, required configuration for same-account access.

Answer

Create a VPC endpoint for DynamoDB and attach it to the Lambda function.

Answer

Configure a network ACL to allow traffic from Lambda to DynamoDB.

Answer

Add the Lambda function as a principal in the DynamoDB table's resource-based policy.

Question 4

A web application on EC2 instances behind an ALB experiences increased latency during peak hours. The SysOps administrator notices that the ALB's RequestCount per target is high. What design change should improve performance?

Accepted Answer

Add more EC2 instances to the target group.. Increasing the number of targets (EC2 instances) spreads the load and reduces latency.

Answer

Switch to a Network Load Balancer.

Answer

Enable sticky sessions on the ALB.

Answer

Reduce the idle timeout on the ALB.

Question 5

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which step is necessary?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. To enable IPv6 communication in an existing VPC, you must first associate an Amazon-provided IPv6 CIDR block with the VPC. This is a prerequisite for configuring subnets, route tables, and internet gateways to support IPv6 traffic. Without an IPv6 CIDR block assigned to the VPC, no EC2 instance can obtain an IPv6 address or route IPv6 traffic.

Answer

Attach an internet gateway that supports IPv6.

Answer

Create a new VPC with an IPv6 CIDR block and migrate resources.

Answer

Enable DNS64 in the VPC.

Question 6

A SysOps administrator receives an alert that a VPN connection between a VPC and an on-premises network is down. The VPN uses static routing. After verifying the on-premises side is functioning, what should the administrator check in AWS?

Accepted Answer

Verify that the customer gateway device is configured with the correct IP address.. Since the VPN uses static routing, BGP is not in use, so checking BGP session status (Option A) is irrelevant. Rebooting the virtual private gateway (Option B) is a disruptive action that should not be a first step without identifying the root cause. Ensuring the route table has a route to the virtual private gateway (Option C) is important for traffic flow but does not address the VPN tunnel being down. The correct first step is to verify that the customer gateway device is configured with the correct IP address (Option D), because a mismatch in the public IP address of the on-premises VPN endpoint will prevent the IPsec tunnel from establishing, even if the on-premises side is functioning internally.

Answer

Check the BGP session status.

Answer

Reboot the virtual private gateway.

Answer

Ensure the route table has a route to the virtual private gateway.

Question 7

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A site-to-site VPN between on-premises and AWS requires a virtual private gateway (A), which is the AWS-side VPN concentrator attached to the VPC and terminating the IPSec tunnels; a customer gateway (D), which is the AWS resource representing the on-premises VPN device (its public IP and BGP ASN) that terminates the other end of the tunnels; and a VPN connection (C), which is the actual IPSec tunnel resource linking the virtual private gateway to the customer gateway and carrying traffic between the two networks. An internet gateway (B) is not required for this design because it provides internet access for public subnets, not the encrypted VPN termination, and a Direct Connect virtual interface (E) belongs to AWS Direct Connect private/public transit VIFs, which are a separate dedicated-connection service rather than an IPSec site-to-site VPN component.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 8

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Accepted Answer

Use AWS WAF with rate-based rules. AWS WAF with rate-based rules (option A) is correct because it can inspect incoming HTTP/HTTPS requests at the application layer and automatically block or throttle source IPs that exceed a defined request threshold, which directly mitigates application-layer (Layer 7) DDoS floods against resources like an ALB or CloudFront. AWS Shield Advanced (option B) is correct because it provides enhanced, always-on detection and automatic inline mitigation for Layer 3/4 (and Layer 7 with WAF integration) DDoS attacks, plus access to the AWS DDoS Response Team and cost protection for scaling charges incurred during an attack. The other options are not the intended answers: network ACLs with deny rules (C) and restrictive security groups (D) are stateful/stateless traffic filters that can block known bad ports or sources but cannot detect or absorb volumetric or application-layer DDoS patterns, and VPC Flow Logs (E) only capture IP traffic metadata for monitoring and forensics—they do not block or mitigate attacks.

Answer

Apply network ACLs with deny rules

Answer

Use restrictive security groups

Answer

Enable VPC Flow Logs

Question 9

A company wants to host a static website on AWS with high availability and low latency for global users. Which combination of services should be used?

Accepted Answer

Amazon S3 and Amazon CloudFront. Amazon S3 provides durable, highly available object storage ideal for hosting static website content, and Amazon CloudFront is a global CDN that caches content at edge locations worldwide, delivering low-latency access for global users. Together they form the canonical AWS static website architecture with no servers to manage.

Answer

Amazon EC2 and Elastic Load Balancing

Answer

Amazon Route 53 and Amazon S3

Answer

Elastic Load Balancing and Amazon CloudFront

Question 10

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. The most common cause of private instances failing to reach the internet via a NAT Gateway is a missing or incorrect route in the private subnet's route table. The private subnet must have a route for 0.0.0.0/0 pointing to the NAT Gateway; otherwise, traffic has no path out. This is the first thing to verify because it is the fundamental routing requirement for NAT Gateway functionality.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.

Question 11

A company uses Amazon CloudFront to serve content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Users report that they can access the content via CloudFront but also directly via the S3 bucket URL. How can the company restrict direct access to the S3 bucket?

Accepted Answer

Update the S3 bucket policy to deny access to any principal other than the CloudFront service.. With Origin Access Control (OAC), CloudFront signs requests to S3, and the S3 bucket policy must be updated to allow only the CloudFront distribution (via the cloudfront.amazonaws.com service principal with a condition on the distribution ARN) and deny all other principals. This blocks direct access via the S3 URL while preserving CloudFront access.

Answer

Disable OAC and use Origin Access Identity (OAI) instead.

Answer

Use pre-signed URLs for all S3 requests.

Answer

Remove the bucket policy and rely on ACLs.

Question 12

A company has deployed a web application across multiple Availability Zones using an Application Load Balancer. The application experiences increased latency during peak hours. Which action would be MOST effective in reducing latency?

Accepted Answer

Add more EC2 instances to the target group.. Adding more EC2 instances to the target group increases aggregate capacity, distributing the request load across more targets and reducing per-instance queueing and response time. During peak-hour latency spikes, horizontal scaling is the most direct and effective remedy because the bottleneck is typically compute or connection saturation on existing targets.

Answer

Update the health check to use a more frequent interval.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay for the target group.

Question 13

A company wants to provide low-latency access to a web application for users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. Which AWS service should be used to route users to the nearest region?

Accepted Answer

Amazon Route 53 with latency-based routing. Amazon Route 53 with latency-based routing directs user traffic to the AWS region that provides the lowest latency for the end user. By configuring latency records for the EC2 instances in us-east-1 and eu-west-1, Route 53 responds to DNS queries with the IP address of the region that offers the best network performance, effectively routing users to the nearest region.

Answer

Application Load Balancer with cross-region load balancing

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 14

A company is using Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is configured with HTTPS listeners. Users report that some requests are failing with a 502 error. Which THREE steps should the SysOps administrator take to troubleshoot the issue? (Choose three.)

Accepted Answer

Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.. The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.

Answer

Configure the CloudFront distribution to use a custom error response for 502 errors.

Answer

Verify that the ALB is configured to use the X-Forwarded-For header to route requests.

Question 15

A company is using Amazon Route 53 with a private hosted zone for internal DNS resolution within a VPC. The VPC is connected to an on-premises network via a VPN. On-premises resources cannot resolve DNS names in the private hosted zone. Which TWO actions should be taken to resolve this issue? (Choose two.)

Accepted Answer

Enable DNS resolution and DNS hostnames for the VPC.. To allow on-premises resources to resolve DNS names in a private hosted zone, you need to create a Route 53 inbound resolver endpoint in the VPC (option E). This endpoint allows DNS queries from on-premises to be forwarded to Route 53. Additionally, you must enable DNS resolution and DNS hostnames for the VPC (option C) to ensure that the VPC's DNS settings support internal resolution. Option A is incorrect because route propagation affects network routing, not DNS resolution. Option B is incorrect because private hosted zones cannot be associated with on-premises networks directly. Option D is incorrect because a public hosted zone is used for public DNS and does not resolve private DNS queries.

Answer

Configure route propagation from the VPN to the VPC's route table.

Answer

Associate the private hosted zone with the on-premises network.

Answer

Create a public hosted zone with the same name and associate it with the VPC.