SOA-C02 Networking and Content Delivery Practice Test 15 — 15 Questions

Question 1

A company wants to reduce latency for global users accessing static content stored in Amazon S3. Which AWS service should be used?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a global content delivery network that caches static content at edge locations close to users, dramatically reducing latency for S3-hosted objects. It integrates natively with S3 as an origin and is the standard AWS answer for global static content acceleration.

Answer

Amazon Route 53

Answer

S3 Transfer Acceleration

Answer

AWS Global Accelerator

Question 2

A company has a VPC with public and private subnets in two Availability Zones. An Application Load Balancer (ALB) in the public subnets routes traffic to EC2 instances in the private subnets. The EC2 instances need to access the internet for software updates. Which solution is MOST secure and cost-effective?

Accepted Answer

Deploy a NAT Gateway in a public subnet and add a route in the private subnet route tables pointing 0.0.0.0/0 to the NAT Gateway.. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing inbound connections from the internet. This is the most secure and cost-effective solution because it uses a managed AWS service that scales automatically and incurs charges only for usage and hourly uptime, avoiding the need for a bastion host or VPN.

Answer

Set up a VPN connection to an on-premises network and route internet traffic through it.

Answer

Assign public IP addresses to the EC2 instances and route traffic directly.

Answer

Attach an internet gateway to the private subnets and route 0.0.0.0/0 to it.

Question 3

A company needs to resolve DNS names for on-premises servers from AWS. They have set up a DHCP options set with the on-premises DNS server IP. Which additional step is required?

Accepted Answer

Configure Route 53 Resolver outbound endpoint to forward queries to on-premises DNS.. The DHCP options set configures VPC resources to use the on-premises DNS server IP. However, to actually forward DNS queries from the VPC to the on-premises DNS server for resolution of on-premises hostnames, you need a Route 53 Resolver outbound endpoint. This endpoint provides a forwarding path from the VPC to the on-premises network (over VPN or Direct Connect). Option D (inbound endpoint) is used for the reverse direction—allowing on-premises DNS to forward queries to AWS for resolving private hosted zones—and is not required here. Options A and C are incorrect because VPC peering does not enable DNS resolution to on-premises networks; dedicated connectivity and DNS forwarding via Route 53 Resolver are needed.

Answer

Create a VPC peering connection and use the on-premises DNS IP as the DHCP option set.

Answer

Create a VPC peering connection to the on-premises network.

Answer

Configure Route 53 Resolver inbound endpoint to forward DNS queries from on-premises to AWS.

Question 4

A sysadmin needs to block specific IP addresses from accessing an Application Load Balancer. Which approach is MOST efficient?

Accepted Answer

Create an AWS WAF web ACL with IP set rules and associate it with the ALB.. AWS WAF is the most efficient and appropriate service for blocking specific IP addresses from accessing an Application Load Balancer. You can create an IP set with the addresses to block and associate a web ACL with the ALB. WAF operates at Layer 7 and is designed for this purpose, providing granular control and scalability.

Answer

Modify the security group for the ALB to deny traffic from those IPs.

Answer

Add a route in the VPC route table to drop traffic from those IPs.

Answer

Update the network ACL for the ALB subnets.

Question 5

A company uses AWS Global Accelerator to improve performance of a TCP application. Users in Asia report higher latency than users in Europe. The endpoints are all in us-east-1. What is the BEST solution?

Accepted Answer

Deploy additional endpoints in an Asia region and configure Global Accelerator to route traffic to the closest endpoint.. VPC peering does not affect Global Accelerator routing; Global Accelerator uses Anycast IPs and routes to endpoints based on location, not VPC peering. Option B is incorrect because adding more endpoints in us-east-1 does not reduce latency for users in Asia; they still have to travel across the Atlantic and Pacific. Option C is incorrect because CloudFront is designed for HTTP/HTTPS (and WebSockets), not general TCP applications. Global Accelerator supports TCP/UDP. Option D is correct because deploying endpoints in an Asia region and configuring Global Accelerator to route traffic to the closest endpoint reduces latency for Asian users.

Answer

Create a VPC peering connection between us-east-1 and an Asia region.

Answer

Add more endpoints in us-east-1 to distribute load.

Answer

Switch to Amazon CloudFront for the TCP application.

Question 6

Which TWO AWS services can be used to provide a static IP address for an Application Load Balancer? (Choose two.)

Accepted Answer

Network Load Balancer (with Elastic IP). Option C is correct because an Application Load Balancer cannot have an Elastic IP directly, but you can place a Network Load Balancer in front of it; the NLB supports Elastic IP addresses (one per subnet/AZ), giving the ALB a static IP entry point. Option D is correct because AWS Global Accelerator provides two static anycast IPv4 addresses (and optionally IPv6) that route traffic to the ALB, effectively giving it fixed IP addresses. Option A is incorrect because a Route 53 static DNS name is still a DNS name, not a static IP address. Option B is incorrect because Elastic IP addresses cannot be assigned directly to an Application Load Balancer. Option E is incorrect because Application Load Balancers do not support Elastic IP addresses; their IPs are dynamic and can change.

Answer

Amazon Route 53 with static DNS name

Answer

Elastic IP address assigned to the ALB

Answer

Application Load Balancer (with Elastic IP)

Question 7

Which THREE components are required to set up a site-to-site VPN connection between a VPC and an on-premises network? (Choose three.)

Accepted Answer

Virtual private gateway or transit gateway. A virtual private gateway or transit gateway is required as the AWS-side VPN concentrator that terminates the VPN tunnels and routes traffic between the VPC and the on-premises network. It provides the target for the VPN connection and must be attached to the VPC to enable site-to-site VPN functionality.

Answer

NAT Gateway

Answer

Internet gateway

Question 8

Which TWO statements about Amazon CloudFront origins are correct? (Choose two.)

Accepted Answer

CloudFront can use an Application Load Balancer as an origin.. CloudFront can use an Application Load Balancer (ALB) as a custom origin. This allows you to distribute traffic from a web application running behind an ALB, enabling dynamic content delivery with CloudFront's edge caching and HTTPS termination.

Answer

CloudFront only supports HTTP origins, not HTTPS.

Answer

CloudFront can only use S3 buckets as origins.

Answer

CloudFront origins must be in the same region as the distribution.

Question 9

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Answer

Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.

Answer

Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.

Answer

Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.

Question 10

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered using a VPC Peering connection. The instances in VPC A can ping the private IP of instances in VPC B, but not the DNS names. What is the most likely cause?

Accepted Answer

The VPC Peering connection does not have 'Enable DNS Resolution' enabled.. The 'Enable DNS Resolution' setting on a VPC Peering connection allows instances in one VPC to resolve the private DNS hostnames of instances in the peered VPC. Without this setting enabled, the DNS resolver in the requester VPC will not return the private IP of the peered instance, causing DNS name resolution to fail even though direct ICMP (ping) to the private IP works. This setting must be enabled on both sides of the peering connection for cross-VPC DNS resolution to function.

Answer

The route tables in VPC A do not have a route to VPC B's CIDR.

Answer

The security groups in VPC B block DNS traffic (port 53).

Answer

The VPCs have overlapping CIDR blocks.

Question 11

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

Accepted Answer

The BGP session between the on-premises router and the Direct Connect router is down.. The BGP session between the on-premises router and the Direct Connect router is down. When BGP is down, the on-premises router cannot exchange routes with the AWS side over Direct Connect. Even though the on-premises router may be advertising a specific route, without an active BGP session, that route is not received by the Direct Connect router, and the virtual private gateway does not propagate it into the VPC. As a result, traffic from the on-premises network to the VPC falls back to using the internet route instead of Direct Connect. Option B is incorrect because the VPC route table controls outbound traffic from the VPC, not inbound traffic from on-premises; a default route to an Internet Gateway would cause asymmetric routing for return traffic but would not prevent inbound traffic from using Direct Connect if the BGP session is active.

Answer

The on-premises network does not have a route to the VPC CIDR.

Answer

The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.

Answer

The virtual private gateway is not attached to the VPC.

Question 12

A company has a web application deployed in a VPC with both public and private subnets. The web servers are in public subnets and the database servers are in private subnets. The web servers need to access the internet for updates. Which configuration is required to provide internet access to the web servers while keeping the database servers private?

Accepted Answer

Attach an Internet Gateway to the VPC and add a route to it only in the route tables for the public subnets.. An Internet Gateway (IGW) is required for any subnet that needs direct internet access. By attaching an IGW to the VPC and adding a default route (0.0.0.0/0) pointing to the IGW only in the public subnet route tables, web servers in those subnets can reach the internet. Database servers in private subnets remain isolated because their route tables lack the IGW route, preventing direct inbound or outbound internet traffic.

Answer

Place both web and database servers in private subnets and use a NAT Gateway for outbound internet access.

Answer

Attach an Internet Gateway to the VPC and add a route to it in the route tables for both public and private subnets.

Answer

Use a VPC Gateway Endpoint to provide internet access to the web servers.

Question 13

A SysOps administrator is setting up a Network Load Balancer (NLB) to handle millions of requests per second. The target group consists of EC2 instances that are in a single Availability Zone. Which of the following is a potential issue?

Accepted Answer

If the single AZ becomes unavailable, the NLB will not automatically fail over to other AZs.. Option A is the correct answer because if the NLB is provisioned in a single Availability Zone (AZ) and that AZ fails, the NLB will not automatically fail over to other AZs, which is a potential issue for high availability. Option B is incorrect because an NLB can be associated with only one AZ. Option C is incorrect because the NLB can preserve the source IP address when using instance targets. Option D is incorrect because the NLB can handle high throughput even in a single AZ.

Answer

The NLB cannot be associated with only one Availability Zone.

Answer

The NLB cannot preserve the source IP address of the client.

Answer

The NLB will not be able to handle the traffic volume due to the single AZ limitation.

Question 14

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to connect to an on-premises network with a CIDR of 10.0.0.0/8. What is the issue?

Accepted Answer

The CIDR blocks overlap, causing routing conflicts.. Overlapping CIDR blocks prevent VPC peering or VPN connections because routes conflict. Option A is not the issue. Option B is not the primary issue. Option D is not directly a problem.

Answer

The on-premises CIDR is private and cannot be used with AWS.

Answer

AWS does not support /8 CIDR blocks.

Answer

The VPC CIDR is too large.

Question 15

A company uses AWS Global Accelerator to improve the performance of a web application hosted in multiple AWS regions. The application uses an Application Load Balancer (ALB) in each region as the endpoint. Users report that traffic is not being routed to the closest region. What could be the cause?

Accepted Answer

The health checks for the ALBs are failing, so traffic is diverted to other regions.. Global Accelerator uses health checks to determine endpoint availability. If the health checks for an ALB in a user's closest region are failing, Global Accelerator will consider that endpoint unhealthy and route traffic to the next closest healthy region. This causes users to be directed to a region farther away, even though a closer region exists.

Answer

The Global Accelerator is not configured with a custom routing accelerator.

Answer

The ALBs are not configured to allow cross-region communication.

Answer

The endpoints are configured in the same AWS region.