SOA-C02 Networking and Content Delivery Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. An S3 bucket policy is configured for a CloudFront distribution using an OAI. The policy allows the OAI to get objects. Additionally, it allows anyone from the IP range 203.0.113.0/24 to get objects directly. Users from other IPs report they can still access objects directly via S3 URLs. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The S3 bucket has a bucket ACL that grants public read access.. The bucket policy has two Allow statements: one for the OAI and one for the IP range 203.0.113.0/24. For users from other IPs, there is no explicit Allow, so by default the policy implicitly denies access. However, S3 also evaluates bucket ACLs independently. If the bucket ACL grants public read access (e.g., AllUsers with READ permission), then users from any IP can access objects directly via S3 URLs, regardless of the bucket policy. Therefore, the most likely cause is that the bucket has a public-read ACL, which overrides the implicit deny in the policy.

Answer

The policy allows public access from the specified IP range, overriding the OAI restriction.

Answer

The OAI is not correctly associated with the CloudFront distribution.

Answer

The CloudFront distribution is using a custom origin instead of S3.

Question 2

Refer to the exhibit. The output shows the health status of two targets in a target group. One target is unhealthy with a 502 error. What is the most likely cause?

Accepted Answer

The web server on the target instance is returning HTTP 502 status codes.. A 502 Bad Gateway error from the target indicates that the web server on the instance is returning an invalid response, often due to an application error or misconfiguration. Option A is incorrect because a security group blocking health check traffic would result in a connection timeout or refusal, not a 502. Option B is incorrect because the health check is initiated by the ALB to the target instance, so outbound traffic from the instance is not relevant. Option D is incorrect because a misconfigured health check path would typically result in a 404 or other error, but not necessarily a 502. The 502 error is directly caused by the target's web server returning an HTTP 502 status code.

Answer

The target instance’s security group is blocking the health check traffic.

Answer

The target instance is not allowing outbound traffic to the ALB.

Answer

The ALB health check is misconfigured with an incorrect path.

Question 3

A company is using Amazon CloudFront to distribute its web application. Users in a specific geographic region are experiencing high latency. What is the most cost-effective solution to reduce latency for these users?

Accepted Answer

Add additional CloudFront edge locations in the affected region.. CloudFront's global edge network caches content at locations close to users, reducing latency. Adding more edge locations (or ensuring coverage) is cost-effective compared to other options. Option A (AWS Global Accelerator) improves routing via the AWS backbone but does not provide caching; it would add cost without addressing the need for cached content at the edge. Option B (Route 53 latency-based routing) directs traffic to a different origin, but if the origin is far, latency remains; it does not add edge caching. Option C (increasing origin server compute) does not reduce network latency; it only improves server processing.

Answer

Use AWS Global Accelerator to route traffic over the AWS global network.

Answer

Configure Route 53 latency-based routing to direct users to a different origin.

Answer

Increase the compute capacity of the origin server.

Question 4

An application running on an EC2 instance is unable to connect to an Amazon RDS database in the same VPC. The security groups allow traffic from the EC2 instance. What is the most likely cause?

Accepted Answer

The route table does not have a route to the RDS subnet.. The EC2 instance's subnet route table must contain a route to the RDS subnet for traffic to reach it. If this route is missing, connectivity fails even with correct security groups. Option A is incorrect because IAM roles control AWS API permissions, not network traffic. Option B is incorrect because VPC Flow Logs are a monitoring feature and do not affect connectivity. Option D is incorrect because the network ACL could block traffic, but the question states that security groups allow traffic; however, NACLs are stateless and could also block, but the most likely cause given the scenario is a missing route in the route table.

Answer

The IAM role attached to the EC2 instance does not have permissions to access RDS.

Answer

VPC Flow Logs are not enabled.

Answer

The network ACL is blocking the traffic.

Question 5

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. Users report intermittent 502 errors. What is the most likely cause?

Accepted Answer

The ALB is experiencing health check failures or scaling issues.. When CloudFront uses an ALB as origin, 502 errors indicate that the origin is not responding properly. The most common cause is the ALB experiencing health check failures (e.g., unhealthy targets) or scaling issues (e.g., insufficient capacity to handle requests). Option A is incorrect because missing Cache-Control headers would affect caching behavior, not cause 502 errors. Option B is incorrect because AWS WAF blocking requests would result in 403 Forbidden errors, not 502. Option D is incorrect because an expired SSL/TLS certificate on the ALB would cause 502 errors only if CloudFront cannot establish a secure connection, but this is less likely than health check or scaling issues as the most common cause; moreover, certificate expiration typically leads to a specific error (e.g., 502 with SSL handshake failure), but the question asks for the most likely cause among the options.

Answer

The CloudFront distribution does not have Cache-Control headers configured.

Answer

AWS WAF is blocking requests from CloudFront.

Answer

The SSL/TLS certificate on the ALB is expired.

Question 6

An application uses Amazon Route 53 weighted routing to distribute traffic across two AWS regions. After a deployment, users in one region are experiencing errors. What should the administrator do to mitigate the issue immediately?

Accepted Answer

Set the weight of the affected region's record to 0 and verify health checks are configured.. Setting the weight of the affected region's record to 0 immediately stops traffic to that region, mitigating errors, and health checks ensure automatic failover. Option A is wrong because updating the alias record to point to a different load balancer requires DNS propagation time, which is not immediate. Option B is wrong because changing the routing policy from weighted to latency-based also requires DNS propagation and does not provide an immediate fix. Option C is wrong because restarting EC2 instances does not address underlying network or load balancer issues and may not resolve the problem quickly.

Answer

Update the alias record to point to a different load balancer.

Answer

Change the routing policy from weighted to latency-based.

Answer

Restart the EC2 instances in the affected region.

Question 7

A company wants to allow its employees to access internal applications using a custom domain name (app.example.com) that resolves to an internal ALB. Which AWS service should be used?

Accepted Answer

Amazon Route 53. Amazon Route 53 is the correct choice because it is a DNS service that can resolve a custom domain name (app.example.com) to an internal Application Load Balancer's DNS name. By creating a private hosted zone associated with the company's VPC, Route 53 can provide internal DNS resolution without exposing the ALB to the internet, which meets the requirement for internal application access.

Answer

AWS Global Accelerator

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 8

A SysOps administrator notices that traffic to an Amazon EC2 instance is being blocked even though the security group allows all inbound traffic. The subnet's network ACL allows all inbound and outbound traffic. What could be the issue?

Accepted Answer

The instance's operating system firewall is blocking the traffic.. The security group and network ACL both allow all traffic, so the issue must be at the instance level. The operating system's built-in firewall (e.g., iptables for Linux, Windows Firewall for Windows) can block inbound traffic independently of AWS networking constructs. Since the OS firewall is not managed by AWS, it can override security group rules, causing traffic to be dropped even when AWS-side configurations are permissive.

Answer

The network ACL is not associated with the subnet correctly.

Answer

VPC Flow Logs are misconfigured.

Answer

The route table does not have a default route to an internet gateway.

Question 9

A company is using Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. How should this be configured?

Accepted Answer

Configure Origin Access Control (OAC) with the S3 bucket policy.. Origin Access Control (OAC) is the recommended method to restrict access to an S3 bucket so that only CloudFront can retrieve objects. When OAC is enabled, CloudFront signs requests to S3 using a specific principal, and the S3 bucket policy is configured to allow access only to that principal. This prevents direct access to the bucket via S3 URLs or other AWS services, ensuring that content is served exclusively through CloudFront.

Answer

Use CloudFront signed URLs or cookies.

Answer

Attach an IAM role to CloudFront that grants S3 read access.

Answer

Create a bucket policy that allows access only from the CloudFront distribution's IP addresses.

Question 10

A SysOps administrator needs to design a VPC with public and private subnets for a web application. Which TWO components are required to allow instances in the private subnet to access the internet?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet is required because it allows instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The NAT gateway must be placed in a public subnet with an Internet Gateway (IGW) route to translate private IPs to the gateway's Elastic IP. Without the NAT gateway, private instances have no path to the internet.

Answer

VPC endpoint for S3

Answer

Internet gateway attached to the VPC

Answer

Virtual private gateway

Question 11

A company uses Amazon CloudFront to distribute content globally. They need to restrict access to premium content to only authenticated users. Which THREE methods can be used to achieve this?

Accepted Answer

Lambda@Edge to validate JWT tokens. Options C, D, and E are correct. Lambda@Edge can validate JWT tokens to restrict access to authenticated users. CloudFront signed cookies and signed URLs allow access only to users who have valid credentials, effectively restricting access to authenticated users. Option A is wrong because AWS WAF IP set rules allow access based on IP addresses, which does not authenticate users; it only restricts by IP. Option B is wrong because AWS Shield Advanced is a DDoS protection service, not an authentication mechanism.

Answer

AWS WAF IP set rules to allow only known IPs

Answer

AWS Shield Advanced to protect against DDoS

Question 12

A SysOps administrator is troubleshooting a connectivity issue from an EC2 instance to an RDS database in the same VPC. The security groups are configured correctly. Which TWO steps should the administrator take to diagnose the issue?

Accepted Answer

Check the network ACL associated with the subnets for both instances. Network ACLs (NACLs) are stateless, meaning they filter traffic in both directions independently. Even if security groups allow traffic, a misconfigured NACL can block it. Checking the NACL associated with the subnets for both the EC2 instance and the RDS database is a critical step because NACLs can implicitly deny traffic if no matching allow rule exists.

Answer

Verify the CIDR block of the VPC

Answer

Enable VPC Flow Logs to capture traffic

Answer

Check the IAM policy attached to the EC2 instance

Question 13

A company has a VPC with public and private subnets across two Availability Zones. An application running on EC2 instances in the private subnets needs to access the internet for updates. Which configuration should be used to provide internet access while minimizing administrative overhead?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update private route tables to point to it.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing inbound traffic from the internet. This is a fully managed AWS service, so it requires no patching or scaling management, minimizing administrative overhead. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's network interface.

Answer

Assign public IP addresses to the private instances and update route tables accordingly.

Answer

Set up AWS Direct Connect to an internet gateway.

Answer

Launch a NAT instance in the private subnet and configure routing.

Question 14

A company wants to host a static website on AWS with high availability and low latency for global users. Which service should be used to serve the static content?

Accepted Answer

Amazon S3 bucket configured for static website hosting, with Amazon CloudFront.. The correct service to host a static website with high availability and low latency for global users is Amazon S3 configured for static website hosting, combined with Amazon CloudFront as a CDN. S3 provides durable and highly available storage, and CloudFront caches content at edge locations for low latency. Option A (Lambda + API Gateway) is for dynamic serverless applications, not for serving static files directly. Option B (Route 53 with simple routing) is a DNS service, not a content delivery or hosting service. Option C (EC2 with ALB) is overkill for static content and requires management of servers. Therefore, D is correct.

Answer

AWS Lambda with API Gateway.

Answer

Amazon Route 53 with a simple routing policy.

Answer

EC2 instances behind an Application Load Balancer.

Question 15

A SysOps administrator notices that traffic from an Application Load Balancer to targets is failing intermittently. The targets are EC2 instances in an Auto Scaling group. The health check settings on the target group are: ping path '/health', healthy threshold 2, unhealthy threshold 2, timeout 5 seconds, interval 30 seconds. Which change would most likely improve the stability of the health checks?

Accepted Answer

Increase the unhealthy threshold to 5.. Increasing the unhealthy threshold reduces flapping; currently 2 consecutive failures mark an instance unhealthy, which may be too sensitive. Option A is wrong because a longer interval would delay detection. Option B is wrong because a shorter timeout may cause false positives. Option C is wrong because decreasing healthy threshold increases sensitivity.

Answer

Increase the interval to 60 seconds.

Answer

Decrease the healthy threshold to 1.

Answer

Decrease the timeout to 2 seconds.