SOA-C02 Networking and Content Delivery Practice Test 17 — 15 Questions

Question 1

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.. Network ACLs are stateless, so the subnet's NACL must explicitly allow inbound traffic from the ALB's subnet CIDR. If it does not, health check traffic from the ALB will be blocked. Option B is incorrect because the instance's security group allows inbound traffic from the ALB security group, and security groups are stateful, so return traffic is allowed automatically. Option C is incorrect because the ALB security group does not need an outbound rule; security groups are stateful, and the ALB initiates connections to the instances. Option D is incorrect because the ALB can communicate within the VPC regardless of whether it is in a public subnet; an internet gateway is only needed for internet traffic, not for internal ALB-to-instance traffic.

Answer

The instance security group does not allow outbound traffic to the ALB.

Answer

The ALB security group does not allow outbound traffic to the instances.

Answer

The ALB is in a public subnet without an internet gateway.

Question 2

A SysOps administrator is configuring an Application Load Balancer to route traffic to multiple target groups based on the URL path. The ALB is not routing traffic correctly. Which listener rule configuration should be used to route requests with path /api/* to target group A and all other requests to target group B?

Accepted Answer

Create a rule with path pattern /api/* and forward to target group A with priority 10, and a default rule with path pattern /* and forward to target group B with priority 20.. The ALB listener rules are evaluated in order; the first rule with a path pattern /api/* will match, and then a default rule (catch-all) is needed for all other paths. Option A is incorrect because order is not automatically prioritized by pattern. Option B is incorrect because a single rule cannot have two conditions with different paths to different target groups. Option D is incorrect because while both rules with path patterns are valid, the priority must be explicitly set; the ALB does not automatically prioritize based on pattern length.

Answer

Create a rule with a host header condition matching 'api.example.com' and forward to target group A, and a default rule forward to target group B.

Answer

Create one rule with a condition that matches /api/* and forward to target group A, and another condition in the same rule for /* to forward to target group B.

Answer

Create two rules with path patterns /api/* and /*, and set priority based on the pattern length.

Question 3

A SysOps administrator needs to ensure high availability for a web application running on EC2 instances across multiple Availability Zones. Which TWO actions should the administrator take?

Accepted Answer

Launch EC2 instances in at least two different Availability Zones.. Options A and D are correct. Launching EC2 instances across multiple Availability Zones (A) provides fault isolation, and registering them with an Application Load Balancer that has health checks enabled (D) ensures traffic is routed only to healthy instances. Option B is incorrect because CloudFront is a CDN, not a load balancer; it improves performance but does not directly provide high availability by health checking instances. Option C is incorrect because all instances in a single Availability Zone creates a single point of failure. Option E is incorrect because EBS volumes are tied to a specific Availability Zone and real-time replication does not address instance-level failures across zones.

Answer

Place a CloudFront distribution in front of the instances.

Answer

Launch all EC2 instances in a single Availability Zone for consistency.

Answer

Attach an EBS volume to each instance and replicate data in real-time.

Question 4

A company is using Amazon CloudFront to distribute content globally. The company wants to restrict access to content so that only users from specific countries can access it. Which CloudFront feature should be used?

Accepted Answer

Geo restriction. CloudFront's geo restriction feature (also known as geo-blocking) allows you to allow or block access to your content based on the geographic location of the viewer's IP address. This is the correct choice because the requirement is specifically to restrict access by country, which is exactly what geo restriction does by using a country-level allowlist or blocklist.

Answer

AWS WAF

Answer

Signed URLs

Answer

Origin Access Identity (OAI)

Question 5

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A virtual private gateway (VGW) is the VPN concentrator on the AWS side of a site-to-site VPN connection. It attaches to the VPC and terminates the IPsec tunnels from the on-premises network. Without a VGW, the VPC has no endpoint to receive encrypted traffic from the customer gateway.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 6

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Accepted Answer

Use AWS WAF with rate-based rules. AWS Shield Advanced provides DDoS protection. Using a web application firewall (WAF) at the edge helps filter malicious traffic. Security groups and NACLs are not effective against DDoS at scale.

Answer

Apply network ACLs with deny rules

Answer

Use restrictive security groups

Answer

Enable VPC Flow Logs

Question 7

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. The first thing to check when private instances cannot reach an external service is the route table for the private subnet. The private subnet must have a route 0.0.0.0/0 pointing to the NAT Gateway to route internet-bound traffic through it. Option B is incorrect because the NAT Gateway must have an Elastic IP to be reachable from the internet, but the issue described is outbound access from private instances; the NAT Gateway's Elastic IP is necessary but not the first check. Option C is incorrect because security groups for NAT Gateways are not used; NAT Gateways do not have security groups; instead, network ACLs on the subnets control traffic. Option D is incorrect because the internet gateway must be attached to the VPC for the NAT Gateway to work, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.

Question 8

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows EC2 instances in a private subnet to access S3 privately without needing a NAT Gateway or internet gateway. Option A is incorrect because a NAT Gateway requires an internet gateway and does not provide private access. Option C is incorrect because S3 Transfer Acceleration is for faster transfers over the internet, not private connectivity. Option D is incorrect because although a VPC Interface Endpoint can also provide private access to S3, the Gateway Endpoint is the recommended solution for S3 due to lower cost and simpler configuration.

Answer

Set up a NAT Gateway in a public subnet and route traffic through it.

Answer

Use S3 Transfer Acceleration.

Answer

Create a VPC Interface Endpoint for S3.

Question 9

A SysOps administrator is designing a highly available web application across multiple AWS regions. The application uses an Application Load Balancer in each region. Which TWO services can be used to route traffic to the closest regional load balancer based on latency?

Accepted Answer

AWS Global Accelerator. For routing traffic to the closest regional load balancer based on latency, two appropriate services are AWS Global Accelerator (option A) and Amazon Route 53 latency-based routing (option D). AWS Global Accelerator uses anycast IPs to direct users to the nearest edge location, then routes traffic over the AWS global network to the closest regional load balancer, providing latency-based routing. Amazon Route 53 latency-based routing directs traffic to the AWS region with the lowest latency for the user. Geoproximity routing (option B) routes based on geographic location, not primarily latency. Weighted routing (option C) distributes traffic by weight, and CloudFront with origin groups (option E) is for failover and content delivery, not latency-based routing.

Answer

Amazon Route 53 geoproximity routing

Answer

Amazon Route 53 weighted routing

Answer

Amazon CloudFront with origin groups

Question 10

A SysOps Administrator manages a VPC with public and private subnets. The private subnets need to access the internet for software updates. The Administrator creates a NAT Gateway in a public subnet and updates the private subnet route table to point 0.0.0.0/0 to the NAT Gateway. However, instances in the private subnet still cannot reach the internet. What is the MOST likely reason?

Accepted Answer

The NAT Gateway does not have an Elastic IP address assigned.. A NAT Gateway must have an Elastic IP (EIP) address assigned to it in order to function as an internet gateway for private subnets. Without an EIP, the NAT Gateway cannot communicate with the internet. Option A is unlikely because security groups allow outbound traffic by default. Option B is incorrect because the internet gateway attaches to the VPC, not to the NAT Gateway. Option D is incorrect because NAT Gateways do not have security groups; they use network ACLs at the subnet level, but the issue here is the missing EIP.

Answer

The security group on the private instances blocks outbound HTTPS traffic.

Answer

The internet gateway is not attached to the NAT Gateway.

Answer

The NAT Gateway's security group is blocking inbound traffic from the private subnet.

Question 11

Refer to the exhibit. A SysOps Administrator runs the above command and sees that an EC2 instance is unhealthy. The health check is configured to check the HTTP endpoint '/health' on port 80. The instance's security group allows inbound HTTP traffic from the ALB's security group. What is the MOST likely cause?

Accepted Answer

The application on the instance is not configured to respond to the '/health' path.. The health check path is '/health', but the application on the instance might not have that endpoint configured, causing the health check to fail. Option A is incorrect because the instance is associated with the target group; otherwise it would not appear in the health check results. Option C is incorrect because the target group is configured to use port 80, as stated in the scenario. Option D is incorrect because the security group on the instance does allow inbound HTTP traffic from the ALB's security group, as stated in the scenario.

Answer

The instance is not associated with the target group.

Answer

The target group is configured to use port 8080 instead of port 80.

Answer

The security group on the instance does not allow inbound traffic from the ALB.

Question 12

A company has a VPC with a CIDR block of 10.0.0.0/16. They need to connect to an on-premises network using a site-to-site VPN. The on-premises network uses 10.0.0.0/16 as well. Which solution avoids routing conflicts?

Accepted Answer

Use a NAT instance to translate addresses for overlapping ranges.. A NAT instance can translate the overlapping IP addresses from the on-premises network (10.0.0.0/16) to a different IP range within the VPC, allowing communication without routing conflicts. The NAT instance performs destination NAT (DNAT) for inbound traffic and source NAT (SNAT) for outbound traffic, effectively hiding the overlap. This is a common workaround when both networks use the same CIDR block and cannot be renumbered.

Answer

Attach an Internet Gateway and use public IPs for communication.

Answer

Set up a second VPN connection to a different virtual private gateway.

Answer

Create a VPC peering connection between the VPC and on-premises network.

Question 13

A company has an application running on EC2 instances in a VPC. The application needs to access an S3 bucket in the same AWS region. Which configuration provides the MOST secure and cost-effective access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 and update the route tables for the private subnets.. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 directly over the AWS network without traversing the internet, eliminating the need for a NAT Gateway or Internet Gateway. This provides the most secure and cost-effective access by keeping traffic within the AWS backbone and avoiding data transfer costs associated with NAT Gateways or public endpoints.

Answer

Make the S3 bucket publicly accessible and use the public endpoint from the EC2 instances.

Answer

Set up a NAT Gateway in a public subnet and route traffic from the EC2 instances through it to the S3 endpoint.

Answer

Create an Internet Gateway and route traffic from the EC2 instances through it to a public S3 endpoint.

Question 14

A company uses AWS Direct Connect to connect its on-premises network to AWS. The SysOps team notices that traffic from the on-premises network to a VPC is not using the Direct Connect connection but instead is going over the internet. The VPC has a virtual private gateway attached and the on-premises router is advertising a specific route. What is the most likely cause?

Accepted Answer

The BGP session between the on-premises router and the Direct Connect router is down.. The BGP session between the on-premises router and the Direct Connect router is down. When BGP is down, the on-premises router cannot exchange routes with the AWS side over Direct Connect. Even though the on-premises router may be advertising a specific route, without an active BGP session, that route is not received by the Direct Connect router, and the virtual private gateway does not propagate it into the VPC. As a result, traffic from the on-premises network to the VPC falls back to using the internet route instead of Direct Connect. Option B is incorrect because the VPC route table controls outbound traffic from the VPC, not inbound traffic from on-premises; a default route to an Internet Gateway would cause asymmetric routing for return traffic but would not prevent inbound traffic from using Direct Connect if the BGP session is active.

Answer

The on-premises network does not have a route to the VPC CIDR.

Answer

The VPC route table has a more specific route (e.g., 0.0.0.0/0) pointing to an Internet Gateway.

Answer

The virtual private gateway is not attached to the VPC.

Question 15

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

Accepted Answer

The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.. HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Answer

The security group attached to the ALB does not allow inbound traffic on port 443.

Answer

The EC2 instances do not have the correct IAM role to register with the ALB.

Answer

The ALB idle timeout is set too low.