SOA-C02 Networking and Content Delivery Practice Test 14 — 15 Questions

Question 1

A SysOps administrator is troubleshooting an issue where an EC2 instance in a private subnet cannot connect to the internet via a NAT Gateway. Which TWO components must be correctly configured for this to work? (Select TWO.)

Accepted Answer

The NAT Gateway must be placed in a public subnet with a route to an Internet Gateway.. The NAT Gateway must reside in a public subnet because it needs a direct route to an Internet Gateway (IGW) to translate private IP addresses to the NAT Gateway's Elastic IP for outbound internet traffic. Without this placement and route, the NAT Gateway cannot forward traffic to the internet, breaking connectivity for instances in private subnets.

Answer

The network ACL for the private subnet must have a rule allowing inbound traffic from the NAT Gateway.

Answer

The EC2 instance must have a public IP address.

Answer

The security group for the EC2 instance must allow inbound traffic on port 80.

Question 2

Refer to the exhibit. A VPC peering connection exists between VPC A (CIDR 10.0.0.0/16) and VPC B (CIDR 192.168.0.0/16). The command output shows the route table for VPC A (rtb-11111111) and VPC B (rtb-33333333). An instance in VPC A (private IP 10.0.1.5) cannot ping an instance in VPC B (private IP 192.168.1.10). What is the most likely reason?

Accepted Answer

The route table for VPC A is missing a route to 192.168.0.0/16 via the peering connection.. The route table for VPC A does not have a route to VPC B's CIDR (192.168.0.0/16) via the peering connection (pcx-44444444). It only has routes for local and IGW. The route table for VPC B has the peering route. Therefore, traffic from VPC A to VPC B is not routed correctly. Option B is incorrect because the peering status is active. Option C is incorrect because security groups are not shown. Option D is incorrect because NACLs are not shown.

Answer

The security group for the instance in VPC B blocks ICMP traffic.

Answer

The VPC peering connection status is not active.

Answer

The network ACL for the subnet in VPC A blocks outbound ICMP.

Question 3

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

Accepted Answer

The bucket ACL allows public read access, overriding the bucket policy Deny.. The Deny statement uses NotIpAddress condition, which denies access unless the source IP is not in the specified range. However, the Allow statement allows access from the specified IP range. But the Deny statement as written denies all actions (including GetObject) if the IP is NOT in the range. This should block all other IPs. The issue might be that the bucket policy has an explicit deny, but if the bucket is also configured with a bucket ACL that allows public access, the effective permissions may be confusing. However, the most common mistake is that the Deny statement is missing the effect on the same action? Actually, the Deny statement will override any Allow for IPs not in the range. The only scenario where other IPs can access is if the bucket policy is not the only authorization method, or if there is a separate bucket ACL that allows access. But given the options, the most plausible is that the bucket ACL allows public read access. Option A is plausible because bucket ACLs can grant access to everyone. Option B is not shown. Option D is not shown.

Answer

The bucket is not configured to use the bucket policy.

Answer

The bucket policy is malformed and is not being applied.

Answer

The Condition element in the Allow statement is incorrectly formatted.

Question 4

Refer to the exhibit. A SysOps administrator is troubleshooting a CloudFront distribution that serves content from an S3 bucket. Users are receiving 'Access Denied' errors when trying to access objects. The exhibit shows the distribution configuration. What is the most likely cause?

Accepted Answer

The CloudFront distribution is not using an Origin Access Identity (OAI) to authenticate with the S3 bucket.. The OriginAccessIdentity is empty, meaning CloudFront is not using an OAI to access the S3 bucket. The S3 bucket is not publicly accessible (by default), so CloudFront cannot access the objects. Option B is incorrect because the bucket policy is not shown. Option C is incorrect because the protocol policy is correct. Option D is incorrect because the distribution is enabled.

Answer

The S3 bucket policy does not grant read access to CloudFront.

Answer

The distribution is not enabled.

Answer

The viewer protocol policy is set to 'redirect-to-https', but users are using HTTP.

Question 5

A company has deployed a web application behind an Application Load Balancer (ALB) across multiple Availability Zones. Users in some regions report slow page load times. Which action should the SysOps Administrator take to improve performance for all users?

Accepted Answer

Use AWS Global Accelerator to route traffic over the AWS global network.. Option C is correct because using AWS Global Accelerator can improve performance by directing traffic through the AWS global network and optimizing the path to the application. Option A is wrong because increasing ALB capacity does not address latency from distant users. Option B is wrong because CloudFront is for static content, not dynamic web apps. Option D is wrong because moving to a single AZ reduces fault tolerance and may not improve latency for all users.

Answer

Increase the ALB capacity by adding more target instances.

Answer

Enable Amazon CloudFront to cache dynamic content.

Answer

Move the application to a single Availability Zone to reduce network hops.

Question 6

A SysOps Administrator needs to allow an EC2 instance in a private subnet to access the internet for software updates. Which AWS service should be used?

Accepted Answer

NAT Gateway. Option B is correct because a NAT Gateway allows instances in private subnets to access the internet. Option A is wrong because an Internet Gateway is for public subnets. Option C is wrong because a VPC Peering connection does not provide internet access. Option D is wrong because a VPN connection is for on-premises connectivity.

Answer

VPN Connection

Answer

Internet Gateway

Answer

VPC Peering

Question 7

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet has an EC2 instance that needs to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. Option D is correct because the NAT Gateway must be in a public subnet with an Internet Gateway route. If it's in a private subnet, it won't work. Option A is wrong because security groups control inbound/outbound traffic but the default outbound allows all; the issue is routing. Option B is wrong because NACLs are stateless but the default allows outbound. Option C is wrong because the NAT Gateway does not need an Elastic IP if it's in a public subnet, but it's not required for connectivity.

Answer

The network ACL for the private subnet blocks outbound HTTP traffic.

Answer

The security group of the EC2 instance blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address.

Question 8

An organization has a VPC peering connection between VPC A and VPC B. Instances in VPC A can reach instances in VPC B, but not vice versa. What is the most likely cause?

Accepted Answer

The route table in VPC B does not have a route to VPC A's CIDR.. Option C is correct because VPC peering requires route table entries in both VPCs for bidirectional traffic. Option A is wrong because security groups are stateful but only affect inbound/outbound; the issue is routing. Option B is wrong because the peering connection is already established. Option D is wrong because DNS resolution settings don't affect basic connectivity.

Answer

DNS resolution is not enabled for the VPC peering connection.

Answer

Security groups in VPC B block inbound traffic from VPC A.

Answer

The VPC peering connection is in a 'pending-acceptance' state.

Question 9

A company wants to distribute content with low latency to users globally. The content is static and stored in an S3 bucket. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Option A is correct because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations for low latency. Option B is wrong because S3 Transfer Acceleration is for fast uploads. Option C is wrong because Global Accelerator is for dynamic content and TCP/UDP traffic. Option D is wrong because an ALB is for load balancing, not caching.

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Answer

S3 Transfer Acceleration

Question 10

A SysOps Administrator is configuring a VPC with a public subnet and a private subnet. The public subnet has an Internet Gateway. An EC2 instance in the private subnet needs to access an S3 bucket. What is the MOST secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 in the private subnet's route table.. Option D is correct because a VPC Gateway Endpoint for S3 provides private connectivity without traversing the internet. Option A is wrong because a NAT Gateway with a public subnet is less secure and incurs costs. Option B is wrong because an Internet Gateway would expose the instance. Option C is wrong because VPC peering does not provide S3 access.

Answer

Attach an Internet Gateway to the private subnet.

Answer

Use a VPC peering connection to an S3 bucket.

Answer

Create a NAT Gateway in the public subnet and route traffic through it.

Question 11

A company has deployed an Application Load Balancer (ALB) in a VPC. The ALB is configured with a target group pointing to EC2 instances in a private subnet. Clients receive HTTP 503 errors. What is the likely cause?

Accepted Answer

The target instances are unhealthy and the target group has zero healthy hosts.. Option B is correct because 503 indicates the target group has no healthy instances. Option A is wrong because security group not allowing HTTP would cause timeout or 502. Option C is wrong because a missing route table would cause no connectivity at all. Option D is wrong because the ALB does not need an Elastic IP.

Answer

The ALB does not have an Elastic IP address.

Answer

The security group for the ALB does not allow inbound HTTP traffic.

Answer

The route table for the private subnet does not have a route to the ALB.

Question 12

A SysOps Administrator needs to monitor network traffic in a VPC. Which AWS service provides packet-level information about IP traffic?

Accepted Answer

VPC Flow Logs. Option C is correct because VPC Flow Logs capture IP traffic information for network interfaces. Option A is wrong because CloudWatch Logs can store logs but not capture IP traffic directly. Option B is wrong because AWS Config records resource configuration changes. Option D is wrong because CloudTrail records API calls.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A company has a VPC with multiple subnets. An EC2 instance in a public subnet needs to communicate with an RDS database in a private subnet. The RDS security group allows inbound traffic from the EC2 instance's security group. However, the EC2 instance cannot connect. What is the most likely cause?

Accepted Answer

The VPC does not have DNS resolution enabled, so the RDS endpoint cannot be resolved.. Option C is correct because if the RDS is in a private subnet, it may not have a route to the internet or to the public subnet, but the issue is likely that the VPC does not have DNS resolution enabled, causing name resolution failure. Option A is wrong because the security group is already configured. Option B is wrong because the instance has a public IP. Option D is wrong because NACLs are stateless but default allows all.

Answer

The network ACL for the private subnet blocks inbound traffic from the public subnet.

Answer

The security group of the RDS database does not allow outbound traffic.

Answer

The EC2 instance does not have a public IP address.

Question 14

A company has a VPC with a public subnet and a private subnet. The private subnet contains an EC2 instance that must access the internet for software updates. Which TWO actions are required to enable this? (Choose TWO.)

Accepted Answer

Deploy a NAT Gateway in a public subnet.. Option A is correct because a NAT Gateway must be in a public subnet. Option C is correct because the private subnet's route table must have a default route to the NAT Gateway. Option B is wrong because the NAT Gateway does not need an Internet Gateway; the public subnet does. Option D is wrong because the EC2 instance does not need a public IP. Option E is wrong because an Internet Gateway is for public subnets, not private.

Answer

Add an Internet Gateway to the private subnet's route table.

Answer

Assign a public IP address to the EC2 instance.

Answer

Attach an Internet Gateway to the NAT Gateway.

Question 15

A SysOps Administrator is troubleshooting an issue where an Application Load Balancer (ALB) returns 502 Bad Gateway errors. Which THREE are possible causes? (Choose THREE.)

Accepted Answer

The target instance is taking too long to respond (e.g., more than the idle timeout).. Option A is correct because if the target group has no healthy instances, the ALB may return 502. Option B is correct because if the target's security group blocks traffic from the ALB, it can cause 502. Option C is correct because if the target's response times out, the ALB returns 502. Option D is wrong because an incorrect path would cause 404, not 502. Option E is wrong because HTTP methods are not the cause of 502 errors.

Answer

The target instance is configured to respond to a different URL path.

Answer

The ALB is configured with a different HTTP method than the target expects.