SOA-C02 Networking and Content Delivery Practice Test 17 — 15 Questions

Question 1

A SysOps administrator is troubleshooting a connectivity issue from an EC2 instance to an RDS database in the same VPC. The security groups are configured correctly. Which TWO steps should the administrator take to diagnose the issue?

Accepted Answer

Check the network ACL associated with the subnets for both instances. Options B and D are correct. Checking route tables ensures the subnet routes are correct, and verifying NACL rules ensures they are not blocking traffic. Option A is wrong because flow logs do not affect connectivity. Option C is wrong because IAM permissions do not control network connectivity. Option E is wrong because subnet CIDR is unrelated to connectivity.

Answer

Verify the CIDR block of the VPC

Answer

Enable VPC Flow Logs to capture traffic

Answer

Check the IAM policy attached to the EC2 instance

Question 2

A company has a VPC with public and private subnets across two Availability Zones. An application running on EC2 instances in the private subnets needs to access the internet for updates. Which configuration should be used to provide internet access while minimizing administrative overhead?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update private route tables to point to it.. Option C is correct because a NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing inbound traffic from the internet. This is a fully managed AWS service, so it requires no patching or scaling management, minimizing administrative overhead. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's network interface.

Answer

Assign public IP addresses to the private instances and update route tables accordingly.

Answer

Set up AWS Direct Connect to an internet gateway.

Answer

Launch a NAT instance in the private subnet and configure routing.

Question 3

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The security team reports that the ALB is receiving a high number of requests with suspicious User-Agent strings. The SysOps team needs to block these requests at the load balancer level without changing the application code. Which action should be taken?

Accepted Answer

Add a listener rule on the ALB that checks the User-Agent header and returns a fixed response.. Option C is correct because ALB supports rules that evaluate conditions like User-Agent header and perform actions such as fixed-response to block requests. Option A is wrong because WAF is a separate service, not directly on ALB rules. Option B is wrong because modifying target group health checks does not block requests. Option D is wrong because security group rules do not inspect HTTP headers.

Answer

Modify the security group of the ALB to deny traffic from User-Agent strings.

Answer

Update the target group health check to filter out suspicious User-Agent strings.

Answer

Deploy AWS WAF and associate it with the ALB.

Question 4

A company wants to host a static website on AWS with high availability and low latency for global users. Which service should be used to serve the static content?

Accepted Answer

Amazon S3 bucket configured for static website hosting, with Amazon CloudFront.. Option B is correct because S3 can host static websites and CloudFront provides CDN with low latency and high availability. Option A is wrong because EC2 is not necessary for static content. Option C is wrong because Route 53 is DNS, not content delivery. Option D is wrong because Lambda is for compute, not serving static files.

Answer

AWS Lambda with API Gateway.

Answer

Amazon Route 53 with a simple routing policy.

Answer

EC2 instances behind an Application Load Balancer.

Question 5

A SysOps administrator notices that traffic from an Application Load Balancer to targets is failing intermittently. The targets are EC2 instances in an Auto Scaling group. The health check settings on the target group are: ping path '/health', healthy threshold 2, unhealthy threshold 2, timeout 5 seconds, interval 30 seconds. Which change would most likely improve the stability of the health checks?

Accepted Answer

Increase the unhealthy threshold to 5.. Option D is correct because increasing the unhealthy threshold reduces flapping; currently 2 consecutive failures mark an instance unhealthy, which may be too sensitive. Option A is wrong because a longer interval would delay detection. Option B is wrong because a shorter timeout may cause false positives. Option C is wrong because decreasing healthy threshold increases sensitivity.

Answer

Increase the interval to 60 seconds.

Answer

Decrease the healthy threshold to 1.

Answer

Decrease the timeout to 2 seconds.

Question 6

A company has a VPC with an IPv4 CIDR of 10.0.0.0/16. They have a public subnet 10.0.1.0/24 and a private subnet 10.0.2.0/24. They launch an EC2 instance in the private subnet and need it to have a predictable, static private IP address for database replication. Which action should be taken?

Accepted Answer

Create an Elastic IP and associate it with the primary network interface of the instance.. Option B is correct because an Elastic IP attached to an ENI in the private subnet provides a static private IP (through the ENI). Option A is wrong because auto-assign public IP does not affect private IP. Option C is wrong because DHCP option set does not assign static IP. Option D is wrong because modifying the subnet does not assign a specific IP to an instance.

Answer

Modify the subnet's IP assignment settings to make all IPs static.

Answer

Use a custom DHCP option set to assign a static IP.

Answer

Enable auto-assign public IP on the private subnet.

Question 7

A company wants to use Amazon CloudFront to serve content from an Application Load Balancer (ALB) that is internet-facing. Which type of origin should be configured in CloudFront?

Accepted Answer

Custom origin (HTTP/HTTPS) pointing to the ALB DNS name.. CloudFront requires a custom origin (HTTP/HTTPS) when the origin is an Application Load Balancer (ALB) because ALBs are not S3 buckets and do not support S3 origin configurations. The custom origin type allows CloudFront to forward requests to the ALB's public DNS name, which resolves to the ALB's IP addresses, enabling proper load balancing and content delivery.

Answer

S3 origin with the ALB's DNS name as the bucket name.

Answer

Custom origin with Origin Access Identity (OAI) to restrict access.

Answer

Custom origin pointing to the ALB's private IP address.

Question 8

A company has a VPC with an Internet Gateway and a NAT Gateway. They launch an EC2 instance in a private subnet. The instance needs to download updates from the internet, but the security team wants to prevent any inbound traffic from the internet. Which route table configuration is correct for the private subnet?

Accepted Answer

0.0.0.0/0 -> NAT Gateway. Option C is correct because the private subnet route table should have a default route (0.0.0.0/0) pointing to the NAT Gateway for outbound traffic, and no route to the Internet Gateway. Option A is wrong because pointing to the Internet Gateway would allow inbound traffic. Option B is wrong because no route would block all traffic. Option D is wrong because directing to the VPC CIDR is for internal traffic.

Answer

10.0.0.0/16 -> local; 0.0.0.0/0 -> VPC Peering

Answer

0.0.0.0/0 -> Internet Gateway

Answer

No default route; only local routes.

Question 9

A company has a web application behind an Application Load Balancer (ALB) with sticky sessions enabled. The ALB's target group contains EC2 instances in an Auto Scaling group. After a deployment, users report that they are being logged out frequently. What is the most likely cause?

Accepted Answer

The ALB's stickiness cookie is not configured or is being overwritten.. Option C is correct because sticky sessions (session affinity) are based on cookies; if the cookie is not set or is invalid, requests may be routed to different instances, causing logout. Option A is wrong because cross-zone load balancing does not affect session stickiness. Option B is wrong because deregistration delay helps but does not cause logouts. Option D is wrong because health checks do not affect routing of existing sessions.

Answer

The deregistration delay is set too low.

Answer

Health checks are too frequent and marking instances unhealthy.

Answer

Cross-zone load balancing is disabled.

Question 10

Which AWS service can be used to create a private, dedicated connection between an on-premises data center and AWS?

Accepted Answer

AWS Direct Connect. Option C is correct because AWS Direct Connect provides a dedicated private connection. Option A is wrong because VPN provides encrypted tunnels over the internet, not dedicated. Option B is wrong because VPC Peering connects VPCs. Option D is wrong because Transit Gateway connects multiple VPCs and on-premises via VPN or Direct Connect.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 11

A company is using Amazon CloudFront to distribute content globally. They want to restrict access to their content so that only users from specific countries can access it. Which TWO actions can be taken to achieve this?

Accepted Answer

Configure CloudFront geo restriction (whitelist or blacklist) at the distribution level.. Option B is correct because CloudFront geo restriction allows you to whitelist or blacklist countries at the distribution level, directly controlling access based on the geographic location of the viewer's IP address. This is a native CloudFront feature that does not require additional services, making it a straightforward solution for country-based access control.

Answer

Configure an S3 bucket policy with a condition for aws:SourceIp.

Answer

Use IAM policies to restrict access based on the user's location.

Answer

Set up an Application Load Balancer rule to deny traffic from certain IP ranges.

Question 12

A company is designing a multi-tier application in a VPC. The web tier must be in public subnets and the application tier in private subnets. The application tier needs to receive traffic only from the web tier. Which TWO configurations are required?

Accepted Answer

Configure the security group for the application tier to allow inbound traffic from the web tier's security group.. Option A is correct because security groups support stateful, rule-based traffic control using logical references to other security groups. By specifying the web tier's security group as the source in the application tier's inbound rule, traffic is allowed only from instances associated with that web tier security group, regardless of IP address changes. This provides a more secure and manageable configuration than using CIDR blocks, as it automatically adapts to scaling or instance replacements.

Answer

Use a network ACL on the private subnet to deny all inbound traffic except from the public subnet CIDR.

Answer

Add a route to the Internet Gateway in the private subnet's route table.

Answer

Assign public IP addresses to the application tier instances for outbound access.

Question 13

A company wants to use Amazon Route 53 to route traffic to multiple endpoints for high availability. Which THREE routing policies can be used for this purpose?

Accepted Answer

Latency routing policy. Options A, B, and D are correct. Weighted, Latency, and Failover routing policies distribute traffic across multiple endpoints. Option C (Simple) can only route to a single endpoint. Option E (Geoproximity) can route to multiple endpoints but is more for location-based routing.

Answer

Geoproximity routing policy

Answer

Simple routing policy

Question 14

A company has a production application running on EC2 instances behind an Application Load Balancer (ALB) in a VPC. The application uses an RDS MySQL database in the same VPC. The SysOps team recently implemented a change to the network ACLs to improve security. After the change, the application became unreachable from the internet, but the EC2 instances can still communicate with the RDS database. The ALB is in a public subnet, and the EC2 instances and RDS are in private subnets. The ALB's security group allows inbound HTTP/HTTPS from 0.0.0.0/0. The EC2 instances' security group allows inbound from the ALB's security group. The RDS security group allows inbound from the EC2 instances' security group. The network ACLs for the public subnet allow inbound HTTP/HTTPS from 0.0.0.0/0 and all outbound traffic. The network ACLs for the private subnets were modified to deny all inbound traffic except from the public subnet CIDR (10.0.1.0/24) and allow all outbound traffic. Which change should be made to restore internet access to the application?

Accepted Answer

Add an inbound rule to the private subnet NACL to allow ephemeral ports (1024-65535) from the public subnet CIDR (10.0.1.0/24).. Option C is correct. The private subnet NACL should allow inbound traffic from the ALB's security group, but NACLs do not support security group references; they use CIDR. The ALB's subnet CIDR is 10.0.1.0/24, but the ALB also uses ephemeral ports for health checks and traffic. However, the issue is that the private subnet NACL currently denies all inbound except from 10.0.1.0/24, which should allow traffic from the ALB. But the problem states that EC2 can communicate with RDS, so the NACL is not blocking that. The application is unreachable from the internet, meaning the ALB cannot forward traffic to EC2. The ALB's health checks might be failing because the private subnet NACL is blocking health check traffic from the ALB on ephemeral ports. The correct action is to allow inbound traffic on ephemeral ports from the ALB subnet. Option A is wrong because the public subnet NACL already allows HTTP/HTTPS inbound. Option B is wrong because the EC2 security group is correct. Option D is wrong because adding a route to the private subnet would not help; the issue is NACL.

Answer

Add a route to the private subnet route table pointing 0.0.0.0/0 to the Internet Gateway.

Answer

Modify the EC2 instance security group to allow inbound traffic from 0.0.0.0/0 on port 80.

Answer

Add an inbound rule to the public subnet NACL to allow HTTP/HTTPS from the ALB's security group.

Question 15

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application uses a custom domain name, 'app.example.com'. The SysOps team configured Amazon Route 53 with an alias record to the ALB DNS name. Users report that occasionally they are directed to a different website. The team suspects DNS resolution issues. They check the Route 53 hosted zone and find the alias record is correctly configured. The ALB is healthy. What is the most likely cause of the intermittent misdirection?

Accepted Answer

There is a conflicting DNS record for 'app.example.com' in the same hosted zone, such as a CNAME pointing elsewhere.. Option B is correct. If the alias record points to the ALB DNS name, Route 53 will resolve to the ALB's IP addresses. However, if there is another DNS record (e.g., a CNAME) that is cached or has a different TTL, it may cause misdirection. Option A is wrong because a missing A record would cause failure, not misdirection. Option C is wrong because ALB does not redirect to other sites. Option D is wrong because TTL being too low would cause frequent changes, but not misdirection.

Answer

The alias record is not of type A but type CNAME.

Answer

The TTL on the alias record is set too low, causing DNS changes to propagate slowly.

Answer

The ALB is configured to redirect traffic to another domain.