SOA-C02 Networking and Content Delivery Practice Test 16 — 15 Questions

Question 1

A company has two Amazon VPCs (VPC-A and VPC-B) in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private IP connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VPC Peering. VPC Peering is the correct solution because it allows direct private IP connectivity between two VPCs in the same AWS Region using the AWS global network backbone, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer charges. Since the VPCs have non-overlapping CIDR blocks, they can be peered without route conflicts, and traffic flows entirely within AWS without traversing the public internet or requiring a transit hub.

Answer

AWS Transit Gateway

Answer

AWS VPN CloudHub

Answer

AWS Direct Connect

Question 2

A company has an on-premises data center connected to AWS via an AWS Direct Connect private virtual interface (VIF). The SysOps administrator needs to ensure that all traffic between the on-premises network and Amazon S3 in the same AWS Region stays within the AWS network and does not traverse the internet. Which solution should the administrator implement?

Accepted Answer

Use a Direct Connect gateway and a private VIF with VPC endpoints for S3. A private VIF with VPC endpoints for S3 (Gateway Endpoints) ensures that traffic from on-premises to S3 stays within the AWS network. The private VIF provides connectivity to the VPC, and the Gateway Endpoint routes S3 traffic through the AWS backbone without traversing the internet. This combination meets the requirement of keeping traffic within the AWS network.

Answer

Use a Direct Connect gateway and a public VIF with a route to S3 prefix lists

Answer

Use a VPN connection over Direct Connect to access S3

Answer

Use a Transit Gateway with a private VIF and route S3 traffic through a NAT instance

Question 3

A company has a VPC with public and private subnets. The private subnets need outbound internet access to download software updates while preventing any inbound internet traffic. The SysOps administrator must minimize costs. Which solution should the administrator implement?

Accepted Answer

Launch a NAT instance in a public subnet with an Elastic IP and disable source/destination check, then update private subnet route tables. A NAT instance, when launched in a public subnet with an Elastic IP and source/destination check disabled, can route outbound traffic from private subnets to the internet while blocking unsolicited inbound connections. This solution minimizes costs compared to a NAT Gateway, as NAT instances use existing EC2 instance pricing and can be further reduced with spot instances or smaller instance types.

Answer

Create a NAT Gateway in a public subnet and update the private subnet route table to use it

Answer

Attach an Internet Gateway to the VPC and add a default route to the Internet Gateway in the private subnets

Answer

Use AWS Transit Gateway with a VPN connection to an on-premises data center for internet access

Question 4

A company has an Amazon VPC with public and private subnets across two Availability Zones. The company hosts a web application on EC2 instances in the private subnets. The application needs to access an Amazon S3 bucket to upload and download files. The SysOps administrator must ensure that traffic to S3 does not traverse the internet and minimizes data transfer costs. Which solution should the administrator implement?

Accepted Answer

Create an S3 VPC Gateway Endpoint in the VPC and associate it with the route tables of the private subnets.. An S3 VPC Gateway Endpoint provides a private, cost-effective connection to S3 from within the VPC without traversing the internet. By associating the endpoint with the route tables of the private subnets, traffic destined for S3 is routed directly through AWS's internal network, avoiding data transfer costs and internet egress charges.

Answer

Create an S3 VPC Interface Endpoint in the VPC and associate it with the security groups of the private subnets.

Answer

Set up a NAT Gateway in the public subnets and add a route to the private subnets' route tables pointing to the NAT Gateway for S3 traffic.

Answer

Use AWS PrivateLink with an S3 endpoint service hosted in a different VPC.

Question 5

A company has an Amazon CloudFront distribution that delivers static content from an Amazon S3 bucket. The SysOps administrator needs to ensure that the content can only be accessed through CloudFront and not directly from the S3 bucket URL. The solution should use AWS managed services with minimal configuration. Which solution should the administrator implement?

Accepted Answer

Configure the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI).. Configuring the S3 bucket policy to deny all access except from the CloudFront distribution's origin access identity (OAI) ensures that only CloudFront can retrieve objects from the S3 bucket. The OAI is a special CloudFront user that authenticates requests to S3, and the bucket policy explicitly grants GetObject access only to that principal, blocking any direct S3 URL access. This uses AWS managed services (CloudFront and S3) with minimal configuration—no custom code or additional infrastructure.

Answer

Make the S3 bucket private and use pre-signed URLs for CloudFront.

Answer

Use AWS WAF on CloudFront to block direct access to S3 by checking the Referer header.

Answer

Create a VPC endpoint for S3 and restrict access to the bucket from the CloudFront IP addresses.

Question 6

A company runs an application across multiple Availability Zones. The application servers are in private subnets and need outbound internet access to download software updates and patches. The SysOps administrator needs a highly available, fully managed solution to provide this outbound connectivity. Which solution should be used?

Accepted Answer

Deploy a NAT Gateway in each public subnet. Deploying a NAT Gateway in each public subnet provides a highly available, fully managed solution for outbound internet access from private subnets. NAT Gateways are managed by AWS, automatically scale, and are resilient within an Availability Zone; using one per AZ ensures that if one AZ fails, the others continue to provide outbound connectivity. This meets the requirement for high availability without the operational overhead of managing NAT instances.

Answer

Deploy a NAT instance in each private subnet

Answer

Deploy a single NAT Gateway in one public subnet

Answer

Attach an Internet Gateway directly to the private subnets

Question 7

A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?

Accepted Answer

Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.. VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.

Answer

Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.

Answer

Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.

Answer

Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.

Question 8

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB terminates SSL/TLS and forwards traffic to the instances over HTTP. The SysOps administrator needs to capture the original client IP address in the instance logs. How should the administrator configure this?

Accepted Answer

Enable the X-Forwarded-For header on the ALB.. When an Application Load Balancer terminates SSL/TLS and forwards traffic to EC2 instances over HTTP, the original client IP address is preserved by the ALB in the X-Forwarded-For header. By enabling this header on the ALB, the SysOps administrator ensures that the web server or application can log the true client IP, which is essential for analytics, security, and troubleshooting.

Answer

Enable stickiness on the ALB target group.

Answer

Configure the ALB to use Proxy Protocol v2.

Answer

Enable access logs on the ALB and store them in Amazon S3.

Question 9

A company uses Amazon CloudFront to deliver content from an Application Load Balancer (ALB) origin. The SysOps administrator needs to restrict access to the content so that only users from a specific geographic location can view it. Which CloudFront feature should be used?

Accepted Answer

Geographic restrictions (geo-blocking) in CloudFront. CloudFront's geographic restrictions (geo-blocking) feature allows you to restrict access to content based on the geographic location of the viewer's IP address. This is the simplest and most direct method to ensure only users from a specific country or region can access the content delivered through CloudFront, without requiring any changes to the origin or additional authentication mechanisms.

Answer

Origin Access Identity (OAI)

Answer

Signed URLs

Answer

AWS WAF web ACL associated with the CloudFront distribution

Question 10

Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?

Accepted Answer

Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.. A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.

Answer

Attach an internet gateway directly to the private subnet instances.

Answer

Replace all security groups with network ACLs.

Answer

Enable VPC peering to another account.

Question 11

EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?

Accepted Answer

Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway. An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.

Answer

Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately

Answer

Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway

Answer

Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT

Question 12

Users are intermittently reporting 502 Bad Gateway errors when accessing the application through an Application Load Balancer. The team needs to identify which target IPs are associated with the failures and the request processing time for those requests. Application logs on instances do not capture failures before the ALB connection. What should be enabled?

Accepted Answer

Enable ALB access logs, specify an S3 bucket destination, and query the logs to filter on elb_status_code=502. ALB access logs capture detailed information about each request, including the target IP address, request processing time, and the HTTP status code returned by the ALB. By enabling these logs and querying for `elb_status_code=502`, you can identify which target IPs were associated with the failures and the `request_processing_time` for those requests. This directly addresses the need to correlate failures with specific targets and timing, without relying on application instance logs that miss pre-connection failures.

Answer

Enable AWS X-Ray on the ALB to trace each request end-to-end from client to target

Answer

Configure a VPC Flow Log on the subnets containing the ALB to capture all network traffic

Answer

Install an agent on the application instances that logs all incoming connection attempts from the ALB

Question 13

A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?

Accepted Answer

Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports. Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.

Answer

Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console

Answer

Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic

Answer

Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule

Question 14

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Accepted Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.. First create a log bucket with proper policy, then create the trail and configure it to log events for the target bucket.

Answer

Step 2: Create a CloudTrail trail.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.

Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 2: Create a CloudTrail trail.

Answer

Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.

Question 15

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

Accepted Answer

The NAT gateway's subnet does not have a route to an internet gateway. The NAT gateway must be in a public subnet with a route table that includes a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, because the IGW is the only way to reach public IP addresses. The question states the NAT gateway is deployed in a public subnet, but if that subnet's route table lacks the IGW route, outbound traffic from the NAT gateway will fail.

Answer

The private subnet's network ACL blocks outbound HTTPS traffic

Answer

The security group attached to the NAT gateway does not allow outbound traffic

Answer

The private instances do not have a public IP address assigned