SOA-C02 Networking and Content Delivery Practice Test 15 — 15 Questions

Question 1

A company has an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The company wants to enable path-based routing to send requests to different target groups. Which TWO resources must be created to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Target group for each backend service. (Target group for each backend service) and Option D (Listener rule with a path pattern condition) are correct. Path-based routing requires creating target groups for each backend service and a listener rule with a path pattern condition to direct requests to the appropriate target group. Option A is incorrect because subnets are needed for the ALB, but they are not specifically required for path-based routing. Option C is incorrect because a Network Load Balancer is not used; the ALB itself handles path-based routing. Option E is incorrect because a security group controls traffic but does not enable path-based routing.

Answer

Subnet for the ALB

Answer

Network Load Balancer (NLB)

Answer

Security group for the ALB

Question 2

A SysOps administrator manages a web application hosted on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. Recently, the development team deployed a new version that increases the load time for certain pages. Users report that they are randomly seeing other users' data. The administrator suspects that the sticky session configuration is not working correctly. The ALB target group is configured with stickiness enabled using the AWSALB cookie. What should the administrator do to verify that sticky sessions are being honored?

Accepted Answer

Use a browser's developer tools to inspect the cookies on the client side and verify the AWSALB cookie is being set and includes the correct target group identifier. To verify sticky sessions, inspect browser developer tools to confirm the AWSALB cookie is set and remains unchanged across requests. The cookie value is opaque and cannot be decoded to reveal the target group identifier. ALB access logs can also be used to correlate the cookie with the target IP, and the presence of the cookie in access logs does prove the client sent it.

Answer

Increase the stickiness duration to 7 days and test again

Answer

Check the ALB access logs for the presence of the stickiness cookie

Answer

Check the target group health check settings to ensure all instances are healthy

Question 3

A company uses Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access to content based on geographic location. Some countries should be blocked entirely. The administrator configured a CloudFront geographic restriction (whitelist/blacklist) and updated the S3 bucket policy to allow only CloudFront access via Origin Access Identity (OAI). However, users from blocked countries are still able to access some content. What is the most likely cause?

Accepted Answer

CloudFront geographic restrictions only block access to the CloudFront distribution, but the S3 bucket is still publicly accessible. The most likely cause is that the S3 bucket is still publicly accessible. CloudFront geographic restrictions only block access to content delivered through CloudFront. If the S3 bucket is directly accessible (e.g., the bucket policy does not properly restrict access to only the CloudFront OAI, or the OAI is not correctly configured), users from blocked countries can bypass CloudFront and access content directly from S3. The scenario states that the bucket policy was updated to allow only CloudFront access via OAI, but if the policy is misconfigured or the OAI is not set up correctly, the bucket may remain public. Therefore, option A is correct.

Answer

The S3 bucket policy does not include a condition to restrict access to only CloudFront

Answer

The geographic restriction is configured as a whitelist instead of a blacklist

Answer

CloudFront geographic restrictions are applied at the edge location, but some edge locations may not have the restriction updated

Question 4

A company has a VPC with public and private subnets across two Availability Zones. They have a NAT Gateway in each public subnet for high availability. EC2 instances in the private subnets need to access an external service that requires a fixed IP address for whitelisting. The administrator configured the route tables to use the NAT Gateway in the same Availability Zone. However, when the NAT Gateway in AZ-A fails, instances in AZ-A lose internet connectivity. What should the administrator do to ensure high availability with fixed IP addresses?

Accepted Answer

Use a single NAT Gateway with an Elastic IP and create a route table with a route to the NAT Gateway for all private subnets, but also configure a second NAT Gateway in another AZ and update route tables to failover. It provides a fixed source IP address using a single NAT Gateway with an Elastic IP, which meets the requirement for whitelisting. The second NAT Gateway in another Availability Zone serves as a failover target; in the event of the primary NAT Gateway failure, route tables can be updated to direct traffic through the secondary NAT Gateway. While this does change the source IP during failover, it is the only option that both maintains a fixed IP under normal operation and offers high availability. Other options either introduce a single point of failure, do not provide internet access, or do not ensure a fixed IP.

Answer

Configure a proxy server in the private subnets and route traffic through it

Answer

Replace the NAT Gateways with an Internet Gateway in each public subnet

Answer

Use a VPN connection to the external service instead of the internet

Question 5

A company has a web application that uses Amazon CloudFront and an Application Load Balancer as origin. The application requires HTTPS between CloudFront and the ALB. The ALB uses a certificate from AWS Certificate Manager (ACM) for the custom domain. The administrator notices that CloudFront returns HTTP 502 errors occasionally. The ALB target group shows healthy instances. What is the most likely cause of the 502 errors?

Accepted Answer

The SSL/TLS certificate on the ALB does not match the origin domain name configured in CloudFront. CloudFront validates that the SSL/TLS certificate presented by the ALB matches the origin domain name configured in the CloudFront distribution. If there is a mismatch (e.g., wildcard certificate not covering the domain, or using a different domain), CloudFront will fail to establish the HTTPS connection, resulting in HTTP 502 errors. Option A is incorrect: the ALB is configured with an ACM certificate and supports HTTPS. Option B is incorrect: a timeout would cause a 504 error, not a 502, and the default origin response timeout (30 seconds) is usually sufficient. Option C is incorrect: while security group misconfiguration can cause connectivity issues, the target group shows healthy instances, meaning traffic can reach the ALB but CloudFront's HTTPS handshake fails due to certificate mismatch.

Answer

The ALB is not configured to support HTTPS

Answer

The CloudFront origin response timeout is set too low

Answer

The ALB security group denies traffic from CloudFront IP addresses

Question 6

A company has a multi-tier application with a web tier, application tier, and database tier. All tiers are in the same VPC. The web tier is in public subnets, application tier in private subnets, and database tier in private subnets. The security groups are configured as follows: Web SG allows HTTP/HTTPS from 0.0.0.0/0; App SG allows HTTP from Web SG; DB SG allows MySQL from App SG. The application tier instances cannot connect to the database tier. What is the most likely cause?

Accepted Answer

The network ACLs on the database subnets are blocking inbound MySQL traffic. The application instances cannot connect to the database tier despite the security group rules being correctly configured (DB SG allows MySQL from App SG). Since security groups are stateful and allow return traffic automatically, the issue must be with the network ACLs (NACLs) on the database subnets, which are stateless and require explicit inbound and outbound rules. By default, custom NACLs deny all traffic, so unless they allow MySQL (port 3306) inbound and ephemeral ports outbound, the connection is blocked. Option A is incorrect because overlapping CIDRs are not mentioned and routing within the same VPC is unaffected. Option B is incorrect because route tables in private subnets automatically include a local route to other subnets in the VPC. Option D is incorrect because security groups are stateful and allow return traffic for established connections.

Answer

The VPC CIDR blocks overlap and cause routing issues

Answer

The route tables in the private subnets do not have a route to the database subnets

Answer

The security group for the database tier does not allow return traffic from the application tier

Question 7

A company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, low-latency network connection from an on-premises data center to AWS, bypassing the public internet entirely. It uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a VPC, ensuring consistent network performance and reduced latency.

Answer

AWS Virtual Private Gateway

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 8

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. The company's SysOps administrator wants to ensure that traffic from the VPC destined for the on-premises network uses the Direct Connect connection instead of the internet. Which configuration should be used?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW). A virtual private gateway (VGW) is the AWS-side endpoint for an AWS Direct Connect connection when using a private virtual interface. By adding a route in the VPC route table that points the on-premises network CIDR to the VGW, all traffic destined for the on-premises network is forced over the Direct Connect link, bypassing the internet. This ensures private, low-latency, and consistent connectivity as required.

Answer

Add a route in the VPC route table pointing to the on-premises network via a NAT gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via an internet gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection

Question 9

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

Accepted Answer

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.. Placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Answer

Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

Answer

Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

Answer

Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

Question 10

A company hosts a web application on Amazon EC2 instances in two AWS regions: us-east-1 and eu-west-1. The application is behind an Application Load Balancer (ALB) in each region. The SysOps administrator wants to direct users to the region that provides the lowest latency, automatically routing traffic away from a region if it becomes unhealthy. Which Amazon Route 53 routing policy should be used?

Accepted Answer

Latency routing. Latency routing (B) is correct because it directs users to the region with the lowest network latency based on real-time measurements between the user and the AWS endpoints. When a region becomes unhealthy, Route 53 automatically stops routing traffic to that region's ALB, ensuring failover to the next lowest-latency healthy region. This meets the requirement of both low-latency and automatic health-based rerouting.

Answer

Geolocation routing

Answer

Weighted routing

Answer

Failover routing

Question 11

A company has an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The company wants to enable path-based routing to send requests to different target groups. Which TWO resources must be created to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the ALB as an endpoint group in a Global Accelerator accelerator.. AWS Global Accelerator uses the AWS global network to route traffic to the closest edge location, then forwards it over the AWS backbone to the ALB endpoint. To integrate, you must configure the ALB as an endpoint in an endpoint group within the accelerator, which allows Global Accelerator to direct traffic to the ALB based on proximity and health. This reduces latency for users in Asia by minimizing internet hops.

Answer

Create a CloudFront distribution and point it to the ALB as an origin.

Answer

Set up a Route 53 geoproximity routing policy for the ALB.

Answer

Use AWS WAF to allow traffic from Global Accelerator edge locations.

Question 12

A company has two Amazon VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16) in the same AWS Region. The SysOps administrator needs to enable private IP connectivity between the two VPCs without using the public internet. The solution must be simple, low-cost, and provide high throughput. Which AWS service should the administrator use?

Accepted Answer

VPC peering. VPC peering is the correct choice because it enables direct private IP connectivity between two VPCs using the AWS global network, without requiring internet gateways, VPNs, or physical connections. It is simple to set up (no additional hardware or software), low-cost (no per-hour charges, only data transfer costs), and provides high throughput (bandwidth is limited only by the instance types, not by the peering connection itself).

Answer

AWS Site-to-Site VPN

Answer

AWS Direct Connect

Answer

AWS Transit Gateway

Question 13

A company has multiple on-premises branch offices, each with a site-to-site VPN connection to a single VPC in AWS. The SysOps administrator needs to enable communication between the branch offices using the AWS cloud as a hub. Which configuration should be implemented to achieve this with the least operational overhead?

Accepted Answer

Use dynamic routing (BGP) on all VPN connections and enable route propagation on the virtual private gateway (VGW).. Enabling dynamic routing (BGP) on all VPN connections and propagating routes from the virtual private gateway (VGW) into the VPC route table allows each branch office to learn the CIDR blocks of all other branch offices automatically. This eliminates the need for manual static route entries and ensures that traffic between branch offices is routed through the VPC hub with minimal operational overhead, as BGP handles failover and route updates dynamically.

Answer

Configure static routes in the VPC route table pointing to each VPN connection.

Answer

Create a separate Transit VPC with EC2-based VPN appliances to route traffic between branch offices.

Answer

Place all branch offices in the same IPsec tunnel by configuring identical pre-shared keys.

Question 14

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB) in the us-west-2 Region. Users are distributed globally and experience high latency. The SysOps administrator wants to improve latency and offload SSL termination to the edge. Which AWS service should be used with the ALB as the origin?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations worldwide, reducing latency for global users. It can offload SSL termination at the edge by accepting HTTPS requests from clients and forwarding them to the ALB over HTTP or HTTPS, thereby reducing the load on the origin. This directly addresses the requirements of improving latency and offloading SSL termination.

Answer

AWS Global Accelerator

Answer

AWS WAF (Web Application Firewall)

Answer

Amazon Route 53 with Latency Based Routing

Question 15

A company hosts a static website on Amazon S3. Users access the website from around the world. The SysOps administrator needs to deliver content with low latency and support HTTPS with a custom domain. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It natively supports HTTPS with custom domains via SSL/TLS certificates from AWS Certificate Manager (ACM) and integrates with S3 as an origin. This combination of low-latency delivery and HTTPS termination makes CloudFront the correct choice for this scenario.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 latency-based routing

Answer

S3 Transfer Acceleration