SOA-C02 Networking and Content Delivery Practice Test 14 — 15 Questions

Question 1

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for EC2 instances to download updates. Which THREE components are required to achieve this? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Route table in the private subnets with a default route pointing to the NAT Gateway. A route table associated with private subnets must have a default route (0.0.0.0/0) pointing to a NAT Gateway to direct outbound internet traffic from EC2 instances through the NAT device. This allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet.

Answer

Egress-only Internet Gateway

Answer

AWS Site-to-Site VPN connection

Question 2

A company has deployed a global web application using AWS CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is in a single AWS region. Users in different geographic regions report high latency, and some users are unable to access the application. The SysOps administrator verifies that the CloudFront distribution is configured correctly and that the ALB is healthy. The administrator also confirms that the ALB's security group allows traffic from the CloudFront IP ranges. What is the most likely cause of the issue?

Accepted Answer

The ALB is overwhelmed by the number of concurrent connections from CloudFront. The ALB in a single region can become overwhelmed by the high volume of concurrent connections from CloudFront's global edge locations, even though the security group allows traffic from CloudFront IP ranges. This can cause high latency and access failures for users in different regions. Option B is incorrect because CloudFront caching typically reduces the load on the origin by serving cached content at edge locations. Option C is incorrect because CloudFront distributions support HTTP and HTTPS protocols, not TCP/UDP, and the protocol used does not explain the regional latency issue. Option D is incorrect because the SSL/TLS certificate on the ALB must be trusted by CloudFront for HTTPS connections, but this would not cause intermittent access issues across regions if the distribution is configured correctly.

Answer

CloudFront is not caching content, causing all requests to go to the origin

Answer

The CloudFront distribution is using TCP instead of HTTP, causing higher latency

Answer

The SSL/TLS certificate on the ALB is not trusted by CloudFront

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket to store logs. The instance currently has no internet access. The SysOps administrator has created a VPC endpoint for S3 (gateway type) and attached it to the VPC. The instance still cannot reach S3. What additional step is required?

Accepted Answer

Add a route in the private subnet's route table pointing to the S3 endpoint. After creating a gateway VPC endpoint for S3, you must add a route in the subnet's route table that points S3 traffic (using the prefix list pl-xxxxxxxx for S3) to the endpoint. Without this route, the private subnet has no path to the endpoint, so the instance cannot reach S3. The gateway endpoint is not automatically added to route tables; it must be explicitly associated.

Answer

Attach an Internet Gateway to the VPC and add a route to it

Answer

Add a security group rule to allow outbound HTTPS traffic to S3

Answer

Modify the endpoint policy to allow all S3 actions

Question 4

A company uses Amazon Route 53 as its DNS service. They have a domain example.com with an alias record pointing to an Application Load Balancer (ALB). Recently, they updated the ALB's DNS name, but the Route 53 record was not updated. Users are still being directed to the old ALB, which has been decommissioned. The SysOps administrator updates the alias record to point to the new ALB DNS name. However, users still experience errors for several hours. What is the most likely reason?

Accepted Answer

The TTL on the DNS record is set too high, causing client-side caching. Alias records in Route 53 are not subject to TTL-based caching for the alias target resolution itself, but the DNS query response from the resolver to the client still includes a TTL value. When the TTL is set too high, clients and intermediate resolvers cache the old DNS response (pointing to the decommissioned ALB) for the duration of that TTL, causing continued errors even after the Route 53 record is updated. The alias record update propagates instantly within Route 53's authoritative infrastructure, but cached records at clients and recursive resolvers must expire before users reach the new ALB.

Answer

Route 53 requires time to propagate changes globally

Answer

The alias record was not saved correctly

Answer

The domain is using DNSSEC, which delays updates

Question 5

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses sticky sessions (session affinity) based on cookies. Recently, the SysOps team noticed that user sessions are being lost intermittently, causing users to be logged out. The team checks the ALB configuration and finds that the stickiness is enabled with a cookie name 'AWSALB' and duration of 1 hour. The application also sets its own cookie. What is the most likely cause of session loss?

Accepted Answer

The application's session cookie has a shorter expiration than the ALB's stickiness duration. The most likely cause is that the application's session cookie expires before the ALB's stickiness cookie, causing the user to be logged out even though the ALB still routes to the same instance. The ALB stickiness duration is 1 hour, but if the application cookie has a shorter lifespan, the session ends prematurely. This is a common misconfiguration when application and load balancer session timeouts are not aligned.

Answer

The ALB's health check interval is too short, causing instances to be marked unhealthy

Answer

The application cookie is overwriting the ALB's stickiness cookie

Answer

Cross-zone load balancing is disabled on the ALB

Question 6

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. Users report intermittent 503 errors. The SysOps Administrator checks the ALB metrics and sees that the Sum of HTTP 503s correlates with spikes in CPU utilization on the EC2 instances. What is the MOST likely cause and solution?

Accepted Answer

Configure the Auto Scaling group to scale out based on average CPU utilization and ensure sufficient capacity.. The most likely cause is that the EC2 instances are overwhelmed due to insufficient capacity, leading to 503 errors from the ALB. Configuring the Auto Scaling group to scale out based on average CPU utilization (B) ensures that additional instances are added when CPU spikes, providing sufficient capacity to handle the load and reducing 503 errors.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay on the ALB target group to allow in-flight requests to complete.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Question 7

A company has a VPC that requires DNS resolution for custom domain names within the VPC. They want to use a private hosted zone in Amazon Route 53. Which resource is required to associate the private hosted zone with the VPC?

Accepted Answer

A VPC. To associate a private hosted zone with a VPC in Amazon Route 53, you must specify the VPC ID and the AWS Region of the VPC. The VPC itself is the required resource because the private hosted zone is scoped to one or more VPCs, enabling DNS resolution for custom domain names only within those VPCs. Without a VPC association, the private hosted zone cannot serve DNS queries.

Answer

A resolver rule

Answer

A public hosted zone

Answer

A CNAME record

Question 8

A SysOps Administrator is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. After the peering connection is accepted, instances in VPC-A cannot ping instances in VPC-B. Both VPCs have non-overlapping CIDR blocks. What is the MOST likely cause?

Accepted Answer

The route tables in both VPCs do not have routes to the peer VPC CIDR.. The most likely cause is that the route tables in both VPCs do not have routes to the peer VPC CIDR. Even after a VPC peering connection is accepted, traffic cannot flow between the VPCs unless explicit routes are added to each VPC's route table pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, instances in VPC-A have no path to reach instances in VPC-B, so ping fails.

Answer

VPC peering does not support cross-account connections.

Answer

The CIDR blocks overlap, causing routing conflicts.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Question 9

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The application needs to authenticate users using an external identity provider (IdP). The SysOps Administrator recommends using Amazon Cognito as an identity broker. Which ALB action should be configured to authenticate users before forwarding requests to the target group?

Accepted Answer

An authenticate action using Amazon Cognito as the user pool.. Amazon Cognito integrates directly with Application Load Balancers via an authenticate action. When you configure an ALB rule with an authenticate action using a Cognito user pool, the ALB handles the OAuth 2.0 / OpenID Connect flow with the external IdP, obtains tokens, and only forwards authenticated requests to the target group. This eliminates the need for custom authentication logic in the application.

Answer

A fixed-response action to return a 401 status code.

Answer

A redirect action to the IdP login page.

Answer

A forward action to the target group.

Question 10

A SysOps Administrator is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. The instances can communicate over private IP addresses when security groups are set to allow all traffic, but fail when security groups are configured with specific rules. The Administrator wants to allow HTTP (port 80) and HTTPS (port 443) traffic from the client instance to the server instance. What security group rules are needed?

Accepted Answer

Add inbound rules on the server to allow HTTP and HTTPS from the client security group.. Security groups are stateful, meaning that if you allow inbound traffic, the response outbound is automatically allowed regardless of outbound rules. Therefore, you only need to add inbound rules on the server instance to allow HTTP and HTTPS traffic from the client security group. Option B is incorrect because no inbound rules are needed on the client. Option C is incorrect because no outbound rules are needed on either instance for this traffic. Option D is incorrect because outbound rules on the server are not required.

Answer

Add inbound rules on both the client and server.

Answer

Add outbound rules on both the client and server.

Answer

Add inbound rules on the client and outbound rules on the server.

Question 11

A company is using Amazon Route 53 for DNS and wants to route traffic to multiple endpoints based on the geographic location of the user. Which routing policy should the SysOps Administrator use?

Accepted Answer

Geolocation routing. Geolocation routing (Option A) is correct because it allows Route 53 to route traffic based on the geographic location of the DNS query's source IP address. This is ideal for scenarios where you need to direct users to specific endpoints based on their country, continent, or even US state, such as complying with data sovereignty laws or delivering localized content.

Answer

Weighted routing

Answer

Failover routing

Answer

Latency routing

Question 12

A SysOps Administrator is configuring a Network Load Balancer (NLB) for a TCP-based application. The application requires that clients see the original source IP address of the request. Which configuration should the Administrator use?

Accepted Answer

Use the NLB default behavior; no additional configuration needed.. Network Load Balancers (NLBs) preserve the original source IP address of clients by default when forwarding TCP traffic to targets. This is because NLBs operate at Layer 4 and do not terminate the TCP connection; instead, they pass packets directly to the backend, allowing the target to see the client's IP. No additional configuration is required for this behavior.

Answer

Use an Application Load Balancer instead, which preserves the source IP.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Enable Proxy Protocol v2 on the target group.

Question 13

A SysOps Administrator is configuring VPC Flow Logs to monitor network traffic. Which THREE pieces of information are included in VPC Flow Log records?

Accepted Answer

Protocol number. VPC Flow Logs capture metadata about network traffic, including source IP address (C), destination IP address (E), and protocol number (B). They do not include HTTP status codes (A) or DNS query names (D), as those are application-layer details beyond the scope of network flows.

Answer

HTTP status code

Answer

DNS query name

Question 14

A company wants to use Amazon CloudFront to distribute content globally with low latency. Which TWO features of CloudFront help achieve this?

Accepted Answer

Regional edge caches that provide additional caching layers. Option B is correct because CloudFront's global network of edge locations caches content at sites physically close to end users, so requests are served from the nearest point of presence and round-trip latency is minimized. Option A is correct because regional edge caches sit between the edge locations and the origin, providing an additional, larger caching layer that keeps less-popular content cached longer and reduces the number of origin fetches, which further lowers latency and improves hit ratios. Option C is not correct because S3 Transfer Acceleration speeds up uploads to S3 buckets over the AWS backbone and is not a CloudFront content-delivery feature. Option D is not correct because VPC peering connects VPCs privately and does not provide global edge caching or low-latency content distribution. Option E is not correct because AWS Global Accelerator is a separate service that routes traffic over the AWS global network using static anycast IPs; it is not a CloudFront feature used to achieve edge caching.

Answer

Use of S3 Transfer Acceleration

Answer

VPC peering to connect to origins

Answer

Integration with AWS Global Accelerator

Question 15

Refer to the exhibit. This bucket policy is attached to an S3 bucket that is used as an origin for a CloudFront distribution. Users are reporting Access Denied errors when accessing objects via the CloudFront URL. What is the MOST likely cause?

Accepted Answer

The condition restricts access to a specific IP range, but CloudFront requests come from its own IP addresses.. The bucket policy condition restricts access to a specific IP range (likely the corporate CIDR), but CloudFront fetches objects from its own globally distributed edge IP addresses, not the end user's IP. CloudFront forwards the viewer's IP in the X-Forwarded-For header, but the actual TCP connection to S3 originates from CloudFront's IPs, so the IpAddress condition blocks all CloudFront requests, causing Access Denied.

Answer

The condition is missing the aws:SourceVpce condition for VPC endpoints.

Answer

The bucket policy does not grant access to the CloudFront service principal.

Answer

The resource ARN is missing the bucket ARN for the bucket itself.