SOA-C02 Networking and Content Delivery Practice Test 13 — 15 Questions

Question 1

A company uses AWS Global Accelerator to improve performance of a TCP application. Users in Asia report higher latency than users in Europe. The endpoints are all in us-east-1. What is the BEST solution?

Accepted Answer

Deploy additional endpoints in an Asia region and configure Global Accelerator to route traffic to the closest endpoint.. Option D is correct because Global Accelerator can route traffic to endpoints in multiple regions; adding endpoints in Asia reduces latency. Option A is wrong because CloudFront is for HTTP/HTTPS, not TCP. Option B is wrong because increasing endpoints in us-east-1 doesn't help. Option C is wrong because VPC peering doesn't change Global Accelerator routing.

Answer

Create a VPC peering connection between us-east-1 and an Asia region.

Answer

Add more endpoints in us-east-1 to distribute load.

Answer

Switch to Amazon CloudFront for the TCP application.

Question 2

Which TWO AWS services can be used to provide a static IP address for an Application Load Balancer? (Choose two.)

Accepted Answer

Network Load Balancer (with Elastic IP). Option A is correct because AWS Global Accelerator provides static anycast IP addresses that can be associated with an ALB. Option D is correct because Network Load Balancer provides a static IP per AZ and can be used in front of an ALB. Option B is wrong because ALB itself does not have static IPs. Option C is wrong because Elastic IP is for EC2 instances, not directly for ALB. Option E is wrong because Route 53 provides DNS, not static IP.

Answer

Amazon Route 53 with static DNS name

Answer

Elastic IP address assigned to the ALB

Answer

Application Load Balancer (with Elastic IP)

Question 3

Which THREE components are required to set up a site-to-site VPN connection between a VPC and an on-premises network? (Choose three.)

Accepted Answer

Virtual private gateway or transit gateway. A virtual private gateway or transit gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network. It provides the target for the VPN connection and must be attached to the VPC to enable site-to-site VPN functionality.

Answer

NAT Gateway

Answer

Internet gateway

Question 4

Which TWO statements about Amazon CloudFront origins are correct? (Choose two.)

Accepted Answer

CloudFront can use an Application Load Balancer as an origin.. Option C is correct because CloudFront can use an Application Load Balancer (ALB) as a custom origin. This allows you to distribute traffic from a web application running behind an ALB, enabling dynamic content delivery with CloudFront's edge caching and HTTPS termination.

Answer

CloudFront only supports HTTP origins, not HTTPS.

Answer

CloudFront can only use S3 buckets as origins.

Answer

CloudFront origins must be in the same region as the distribution.

Question 5

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.. Option C is correct because a VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Answer

Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.

Answer

Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.

Answer

Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.

Question 6

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not have 'Enable DNS Resolution' enabled.. VPC Peering does not support DNS resolution across VPCs by default unless the 'Enable DNS Resolution' option is enabled in the peering connection. Option A is irrelevant because route tables are correct (ping works). Option B is incorrect because DNS hostnames are separate from resolution. Option D is incorrect because security groups affect traffic, not DNS resolution.

Answer

The route tables in VPC A do not have a route to VPC B's CIDR.

Answer

The security groups in VPC B block DNS traffic (port 53).

Answer

The VPCs have overlapping CIDR blocks.

Question 7

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

Accepted Answer

The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.. Option B is correct because the VPC route table contains a more specific route (0.0.0.0/0) pointing to an Internet Gateway, which overrides the less specific route to the virtual private gateway for traffic destined to the on-premises network. When the on-premises router advertises a specific route (e.g., 10.0.0.0/16) via BGP, the VPC route table must have a matching route (or a more specific one) pointing to the virtual private gateway; otherwise, the default route to the Internet Gateway takes precedence, sending traffic over the internet instead of Direct Connect.

Answer

The on-premises network does not have a route to the VPC CIDR.

Answer

The BGP session between the on-premises router and the Direct Connect router is down.

Answer

The virtual private gateway is not attached to the VPC.

Question 8

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

Accepted Answer

The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.. HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Answer

The security group attached to the ALB does not allow inbound traffic on port 443.

Answer

The EC2 instances do not have the correct IAM role to register with the ALB.

Answer

The ALB idle timeout is set too low.

Question 9

A company has a web application deployed in a VPC with both public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The web servers need to access the internet for updates. Which configuration is required to provide internet access to the web servers while keeping the database servers private?

Accepted Answer

Attach an Internet Gateway to the VPC and add a route to it only in the route tables for the public subnets.. Option C is correct because an Internet Gateway (IGW) is required for any subnet that needs direct internet access. By attaching an IGW to the VPC and adding a default route (0.0.0.0/0) pointing to the IGW only in the public subnet route tables, web servers in those subnets can reach the internet. Database servers in private subnets remain isolated because their route tables lack the IGW route, preventing direct inbound or outbound internet traffic.

Answer

Place both web and database servers in private subnets and use a NAT Gateway for outbound internet access.

Answer

Attach an Internet Gateway to the VPC and add a route to it in the route tables for both public and private subnets.

Answer

Use a VPC Gateway Endpoint to provide internet access to the web servers.

Question 10

A SysOps administrator is setting up a Network Load Balancer (NLB) to handle millions of requests per second. The target group consists of EC2 instances that are in a single Availability Zone. Which of the following is a potential issue?

Answer

If the single AZ becomes unavailable, the NLB will fail over to other AZs automatically.

Answer

The NLB cannot be associated with only one Availability Zone.

Answer

The NLB cannot preserve the source IP address of the client.

Answer

The NLB will not be able to handle the traffic volume due to the single AZ limitation.

Question 11

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect to an on-premises network with a CIDR of 10.0.0.0/8. What is the issue?

Accepted Answer

The CIDR blocks overlap, causing routing conflicts.. Overlapping CIDR blocks prevent VPC peering or VPN connections because routes conflict. Option A is not the issue. Option B is not the primary issue. Option D is not directly a problem.

Answer

The on-premises CIDR is private and cannot be used with AWS.

Answer

AWS does not support /8 CIDR blocks.

Answer

The VPC CIDR is too large.

Question 12

A SysOps administrator is configuring a VPC with a public subnet and a private subnet. The private subnet needs to access the internet to download patches. The administrator creates a NAT Gateway in the public subnet and updates the private subnet route table. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the public subnet does not have a route to an Internet Gateway.. The NAT Gateway must be in a public subnet with an Internet Gateway route. If the route table for the public subnet does not have a route to an Internet Gateway, the NAT Gateway cannot send traffic to the internet. Option A is incorrect because EIP is required for NAT Gateway. Option B is incorrect because security groups do not apply to NAT Gateway. Option D is incorrect because NACLs affect traffic but not the core issue.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address attached.

Answer

The security group associated with the NAT Gateway blocks outbound traffic.

Question 13

A company uses AWS Global Accelerator to improve the performance of a web application hosted in multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region as the endpoint. Users report that traffic is not being routed to the closest region. What could be the cause?

Accepted Answer

The health checks for the ALBs are failing, so traffic is diverted to other regions.. Global Accelerator uses health checks to determine endpoint availability. If the health checks for an ALB in a user's closest region are failing, Global Accelerator will consider that endpoint unhealthy and route traffic to the next closest healthy region. This causes users to be directed to a region farther away, even though a closer region exists.

Answer

The Global Accelerator is not configured with a custom routing accelerator.

Answer

The ALBs are not configured to allow cross-region communication.

Answer

The endpoints are configured in the same AWS region.

Question 14

A SysOps administrator is planning a VPC design with high availability for an application that must tolerate the failure of an entire Availability Zone. Which TWO configurations should be implemented? (Select TWO.)

Accepted Answer

Deploy a NAT Gateway in each Availability Zone.. Option B is correct because deploying a NAT Gateway in each Availability Zone ensures that private subnets in each AZ have a route to the internet via a NAT Gateway that resides in the same AZ, preventing cross-AZ data transfer costs and maintaining high availability if an entire AZ fails. Option C is correct because launching EC2 instances in at least two Availability Zones provides fault tolerance at the compute layer, allowing the application to continue serving traffic even if one AZ becomes unavailable.

Answer

Use a single NAT Gateway for all private subnets.

Answer

Use a placement group to ensure instances are in different AZs.

Answer

Use only one public subnet and one private subnet.

Question 15

A company is using Amazon Route 53 as its DNS service. The SysOps team needs to route traffic to multiple resources based on the geographic location of the users. Which THREE routing policies can achieve this? (Select THREE.)

Accepted Answer

Geoproximity routing. Geoproximity routing (Option A) is correct because it allows traffic to be routed based on the geographic location of users and their resources, with the ability to shift traffic using a bias value. This policy is ideal for scenarios where you want to route users to the nearest resource but also have the flexibility to send more traffic to a specific region, such as for load balancing or disaster recovery.

Answer

Simple routing

Answer

Failover routing