SOA-C02 Networking and Content Delivery Practice Test 14 — 15 Questions

Question 1

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They have a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. They launch an EC2 instance in the private subnet and need it to have a predictable, static private IP address for database replication. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Elastic IP and associate it with the primary network interface of the instance.. None of the provided options are correct. To achieve a static private IP address, you should assign a specific private IP address from the subnet's CIDR to the instance's ENI, either at launch or by attaching an ENI with that IP. An Elastic IP (option B) provides a static public IP, not a private IP. Modifying subnet IP assignment settings (option A) does not make IPs static. DHCP option sets (option C) do not assign IPs. Enabling auto-assign public IP (option D) only affects public IP assignment on public subnets.

Answer

Modify the subnet's IP assignment settings to make all IPs static.

Answer

Use a custom DHCP option set to assign a static IP.

Answer

Enable auto-assign public IP on the private subnet.

Question 2

A company wants to use Amazon CloudFront to serve content from an Application Load Balancer (ALB) that is internet-facing. Which type of origin should be configured in CloudFront?

Accepted Answer

Custom origin (HTTP/HTTPS) pointing to the ALB DNS name.. CloudFront requires a custom origin (HTTP/HTTPS) when the origin is an Application Load Balancer (ALB) because ALBs are not S3 buckets and do not support S3 origin configurations. The custom origin type allows CloudFront to forward requests to the ALB's public DNS name, which resolves to the ALB's IP addresses, enabling proper load balancing and content delivery.

Answer

S3 origin with the ALB's DNS name as the bucket name.

Answer

Custom origin with Origin Access Identity (OAI) to restrict access.

Answer

Custom origin pointing to the ALB's private IP address.

Question 3

A company has a VPC with an Internet Gateway and a NAT Gateway. They launch an EC2 instance in a private subnet. The instance needs to download updates from the internet, but the security team wants to prevent any inbound traffic from the internet. Which route table configuration is correct for the private subnet?

Accepted Answer

0.0.0.0/0 -> NAT Gateway. A private subnet requires a default route (0.0.0.0/0) to a NAT Gateway for outbound internet access while blocking inbound traffic. Option A is incorrect because a route to a VPC Peering connection does not provide internet access and is not relevant for internet updates. Option B is incorrect because a default route to an Internet Gateway would allow both inbound and outbound internet traffic, violating the security requirement. Option D is incorrect because without a default route, instances cannot reach the internet at all.

Answer

10.0.0.0/16 -> local; 0.0.0.0/0 -> VPC Peering

Answer

0.0.0.0/0 -> Internet Gateway

Answer

No default route; only local routes.

Question 4

A company has a web application behind an Application Load Balancer (ALB) with sticky sessions enabled. The ALB's target group contains EC2 instances in an Auto Scaling group. After a deployment, users report that they are being logged out frequently. What is the most likely cause?

Accepted Answer

The ALB's stickiness cookie is not configured or is being overwritten.. Sticky sessions (session affinity) rely on a cookie generated by the ALB (AWSALB) to route subsequent requests from a user to the same target. If the cookie is not configured or is overwritten (e.g., by the application after deployment), the ALB treats each request as new and may route to different instances, causing the user to be logged out. Option A is incorrect because deregistration delay controls how long the ALB waits before deregistering an instance, which does not affect existing sessions unless instances are being removed. Option C is incorrect because while frequent health checks may cause instances to be marked unhealthy, this would result in connection errors or routing to other instances, but it does not explain logouts due to sticky session loss. Option D is incorrect because cross-zone load balancing distributes traffic across zones but does not affect session stickiness.

Answer

The deregistration delay is set too low.

Answer

Health checks are too frequent and marking instances unhealthy.

Answer

Cross-zone load balancing is disabled.

Question 5

Which AWS service can be used to create a private, dedicated connection between an on-premises data center and AWS?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection between your on-premises data center and AWS, bypassing the public internet. Option A (AWS Site-to-Site VPN) is incorrect because it creates encrypted tunnels over the internet, not a dedicated physical connection. Option B (AWS Transit Gateway) is incorrect because it acts as a hub to interconnect VPCs and on-premises networks but uses VPN or Direct Connect as the actual connection—it is not the dedicated connection itself. Option C (VPC Peering) is incorrect because it connects VPCs within AWS, not on-premises to AWS.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 6

A company is using Amazon CloudFront to distribute content globally. They want to restrict access to their content so that only users from specific countries can access it. Which TWO actions can be taken to achieve this?

Accepted Answer

Configure CloudFront geo restriction (whitelist or blacklist) at the distribution level.. CloudFront geo restriction allows you to whitelist or blacklist countries at the distribution level, directly controlling access based on the geographic location of the viewer's IP address. This is a native CloudFront feature that does not require additional services, making it a straightforward solution for country-based access control.

Answer

Configure an S3 bucket policy with a condition for aws:SourceIp.

Answer

Use IAM policies to restrict access based on the user's location.

Answer

Set up an Application Load Balancer rule to deny traffic from certain IP ranges.

Question 7

A company is designing a multi-tier application in a VPC. The web tier must be in public subnets and the application tier in private subnets. The application tier needs to receive traffic only from the web tier. Which TWO configurations are required?

Accepted Answer

Configure the security group for the application tier to allow inbound traffic from the web tier's security group.. Security groups support stateful, rule-based traffic control using logical references to other security groups. By specifying the web tier's security group as the source in the application tier's inbound rule, traffic is allowed only from instances associated with that web tier security group, regardless of IP address changes. This provides a more secure and manageable configuration than using CIDR blocks, as it automatically adapts to scaling or instance replacements.

Answer

Use a network ACL on the private subnet to deny all inbound traffic except from the public subnet CIDR.

Answer

Add a route to the Internet Gateway in the private subnet's route table.

Answer

Assign public IP addresses to the application tier instances for outbound access.

Question 8

A company wants to use Amazon Route 53 to route traffic to multiple endpoints for high availability. Which THREE routing policies can be used for this purpose?

Accepted Answer

Latency routing policy. Weighted routing policy allows distributing traffic across multiple endpoints based on weights. Latency routing policy routes traffic to the endpoint with the lowest latency and supports multiple endpoints. Failover routing policy directs traffic to a primary endpoint and fails over to a secondary, enabling high availability. Simple routing policy does not support health checks and therefore is not suitable for high availability. Geoproximity routing policy routes based on geographic location, which is not primarily for high availability.

Answer

Geoproximity routing policy

Answer

Simple routing policy

Question 9

A company has a production application running on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application uses an RDS MySQL database in the same VPC. The SysOps team recently implemented a change to the network ACLs to improve security. After the change, the application became unreachable from the internet, but the EC2 instances can still communicate with the RDS database. The ALB is in a public subnet, and the EC2 instances and RDS are in private subnets. The ALB's security group allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances' security group allows inbound from the ALB's security group. The RDS security group allows inbound from the EC2 instances' security group. The network ACLs for the public subnet allow inbound HTTP/HTTPS from 0.0.0.0/0 and all outbound traffic. The network ACLs for the private subnets were modified to deny all inbound traffic except from the public subnet CIDR (10.0.1.0/24) and allow all outbound traffic. Which change should be made to restore internet access to the application?

Accepted Answer

Add an inbound rule to the private subnet NACL to allow ephemeral ports (1024-65535) from the public subnet CIDR (10.0.1.0/24).. The private subnet NACL currently denies all inbound traffic except from the public subnet CIDR (10.0.1.0/24). However, the ALB uses ephemeral ports (1024-65535) to forward traffic to the EC2 instances and to perform health checks. Without allowing inbound traffic on these ports from the ALB's subnet, the ALB cannot successfully route traffic to the instances, making the application unreachable from the internet. Adding an inbound rule to the private subnet NACL that allows ephemeral ports from the ALB subnet CIDR resolves the issue.

Option A is incorrect because adding a route to the private subnet route table pointing to the Internet Gateway would not help; the issue is with the NACL, not routing. The private instances do not need direct internet access.

Option B is incorrect because the EC2 instances' security group already allows inbound traffic from the ALB's security group, which is sufficient. Allowing inbound from 0.0.0.0/0 on port 80 would bypass the ALB and is not necessary.

Option D is incorrect because the public subnet NACL already allows inbound HTTP/HTTPS from 0.0.0.0/0, which is correct. Adding a rule for the ALB's security group is not possible (NACLs do not support security group references), and the issue lies in the private subnet NACL, not the public one.

Answer

Add a route to the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

Answer

Modify the EC2 instance security group to allow inbound traffic from 0.0.0.0/0 on port 80.

Answer

Add an inbound rule to the public subnet NACL to allow HTTP/HTTPS from the ALB's security group.

Question 10

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom domain name, 'app.example.com'. The SysOps team configured Amazon Route 53 with an alias record to the ALB DNS name. Users report that occasionally they are directed to a different website. The team suspects DNS resolution issues. They check the Route 53 hosted zone and find the alias record is correctly configured. The ALB is healthy. What is the most likely cause of the intermittent misdirection?

Accepted Answer

There is a conflicting DNS record for 'app.example.com' in the same hosted zone, such as a CNAME pointing elsewhere.. If there is a conflicting DNS record, such as a CNAME record for the same name, it can cause intermittent misdirection because DNS resolution may resolve to different targets depending on caching or record priority. Option B is incorrect because an alias record can be of type A or AAAA, and using a CNAME at the zone apex would be invalid. Option C is incorrect because a low TTL would cause more frequent lookups, not misdirection to a different site. Option D is incorrect because ALB redirects are application-level, not DNS-level.

Answer

The alias record is not of type A but type CNAME.

Answer

The TTL on the alias record is set too low, causing DNS changes to propagate slowly.

Answer

The ALB is configured to redirect traffic to another domain.

Question 11

A company has deployed a static website on Amazon S3 with public read access. They want to use Amazon CloudFront to serve the content with HTTPS. They create a CloudFront distribution with the S3 bucket as an origin. After configuring the distribution, users report that they are unable to access the website via the CloudFront URL. The CloudFront distribution status is 'Deployed'. The S3 bucket policy allows GetObject for any principal. What is the most likely reason for the issue?

Accepted Answer

The S3 bucket is not configured for static website hosting; CloudFront should use the bucket's website endpoint as the origin.. The most likely reason is that the S3 bucket is not configured for static website hosting. CloudFront can use either the S3 REST endpoint or the static website hosting endpoint as the origin. If the bucket is not enabled for static website hosting, the website endpoint is not available. Without the website endpoint, CloudFront cannot serve the index document or handle error pages, which are essential for a static website. Even though the distribution is deployed and the bucket policy allows public read access, using the REST endpoint will not serve the website correctly. To resolve this, the company should enable static website hosting on the S3 bucket and configure the CloudFront origin to use the bucket's website endpoint. Option B is incorrect because the bucket policy already allows public read, so CloudFront does not need additional access unless an Origin Access Identity is used. Option C is incorrect because CloudFront supports HTTPS by default for its default domain. Option D is incorrect because an OAI is not required when the bucket allows public access.

Answer

The S3 bucket policy does not grant CloudFront access.

Answer

The CloudFront distribution is not configured to use HTTPS.

Answer

The CloudFront distribution is not associated with an origin access identity (OAI).

Question 12

A company has an application running on EC2 instances behind an Application Load Balancer. Users report intermittent timeout errors. The ALB target group shows healthy instances, and CloudWatch metrics show no spikes in CPU or memory. Which configuration is most likely causing the timeouts?

Accepted Answer

The ALB idle timeout is set too low. The ALB idle timeout determines how long the load balancer waits for data from the application before closing the connection. If the idle timeout is set too low and the application takes longer to respond (e.g., due to long-running queries or processing), the load balancer terminates the connection, causing intermittent timeout errors. Option A is incorrect because connection draining only applies when a target is deregistering, allowing in-flight requests to complete; it does not affect active connections to healthy instances. Option C is incorrect: a longer health check interval delays detection of unhealthy instances, but the target group shows all instances as healthy, so health checks are not the cause. Option D is incorrect because cross-zone load balancing only affects how traffic is distributed across Availability Zones; disabling it may lead to uneven load but does not directly cause timeouts.

Answer

Connection draining is set too low

Answer

The target group health check interval is too long

Answer

Cross-zone load balancing is disabled

Question 13

A SysOps administrator needs to route traffic to multiple AWS regions for disaster recovery using Amazon Route 53. The primary region should receive all traffic unless it becomes unhealthy. Which routing policy should be used?

Accepted Answer

Failover routing policy. Failover routing policy is correct because it allows you to configure an active-passive setup where all traffic is directed to a primary resource (e.g., an Elastic Load Balancer in the primary region) unless Route 53 health checks determine that the primary is unhealthy. When the primary fails, Route 53 automatically routes traffic to the secondary (disaster recovery) resource in another region. This directly meets the requirement of sending all traffic to the primary region unless it becomes unhealthy.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 14

A company has an Amazon CloudFront distribution with an S3 bucket as origin. The bucket contains sensitive data. Which configuration ensures that users access the content only through CloudFront and not directly via the S3 URL?

Accepted Answer

Configure an Origin Access Identity (OAI) in CloudFront and update the bucket policy. By using an Origin Access Identity (OAI) to restrict S3 bucket access to only CloudFront. Option A is wrong because blocking public access alone doesn't allow CloudFront access. Option C is wrong because CloudFront signed URLs control access to CloudFront, but the bucket still needs permission. Option D is wrong because server-side encryption doesn't restrict access paths.

Answer

Enable S3 server-side encryption

Answer

Use CloudFront signed URLs or signed cookies

Answer

Enable S3 Block Public Access on the bucket

Question 15

A SysOps administrator is troubleshooting connectivity between two VPCs (VPC-A and VPC-B) connected via a VPC Peering connection. An EC2 instance in VPC-A cannot ping an EC2 instance in VPC-B. The route tables and security groups are correctly configured. Which THREE steps should the administrator take to resolve the issue?

Accepted Answer

Verify that VPC-B does not have a VPN connection to an on-premises network. The correct steps are C, D, and E. Option C: If VPC-B has a VPN connection to an on-premises network, traffic from VPC-A to VPC-B could be routed asymmetrically or via the VPN, disrupting the VPC peering connectivity. Verifying that VPC-B does not have such a VPN connection ensures traffic intended for VPC-B stays within the peering connection. Option D: The VPC peering connection must be in the 'active' state for traffic to flow. If it is pending acceptance or rejected, no traffic can pass. The administrator should verify the state and accept the request if necessary. Option E: Network ACLs are stateless and can block ICMP traffic. Even if security groups allow ICMP, NACLs must allow both inbound and outbound ICMP (echo request and reply) for ping to work. Option A is incorrect because the route tables are already correctly configured (as stated in the problem), so adding another route is unnecessary and could cause issues. Option B is incorrect because a VPC peering connection is not a transit gateway; it is a direct one-to-one connection and does not support transitive routing.

Answer

Add a route in VPC-A's subnet route table pointing to the VPC Peering connection for VPC-B's CIDR

Answer

Configure VPC Peering as a transit gateway