SOA-C02 Networking and Content Delivery Practice Test 17 — 15 Questions

Question 1

An organization wants to allow an on-premises data center to access an Amazon RDS database in a VPC. Which AWS service should be used to establish a dedicated, private, and high-bandwidth connection?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. It offers consistent high bandwidth (1 Gbps, 10 Gbps, or 100 Gbps dedicated ports) and lower latency than internet-based connections. This makes it the correct choice for a dedicated, private, high-bandwidth link to an RDS database inside a VPC.

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Answer

VPC Peering

Question 2

A SysOps administrator notices that traffic to an Application Load Balancer (ALB) is being rejected. The ALB has a security group that allows inbound HTTP (80) and HTTPS (443) from 0.0.0.0/0. The target group health checks are failing. What could be the issue?

Accepted Answer

The target instances' security group does not allow inbound traffic from the ALB security group.. For an ALB to route traffic to targets, the targets' security group must allow inbound traffic from the ALB's security group on the target port. Even if the ALB's security group allows inbound HTTP/HTTPS from the internet, the targets will reject traffic if their security group does not permit it. This is a common misconfiguration that causes health checks to fail.

Answer

The ALB security group does not allow outbound traffic to the targets.

Answer

The ALB’s security group is blocking health check traffic from the targets.

Answer

The target instances' security group does not allow inbound HTTP/HTTPS from the internet.

Question 3

A company uses Amazon CloudFront to serve static content from an S3 bucket. The S3 bucket is configured as an origin with RestrictBucketAccess set to Yes, and the origin access identity (OAI) is configured. Users can access the content via CloudFront, but direct S3 URLs return Access Denied. However, some users report that they can still access the content directly via S3 URLs. What is the most likely reason?

Accepted Answer

The S3 bucket policy allows public read access in addition to the OAI.. The most likely reason users can still access content directly via S3 URLs is that the S3 bucket policy allows public read access in addition to the OAI. Even though CloudFront is configured with OAI and RestrictBucketAccess, if the bucket policy grants public read permissions (e.g., via a statement with Principal: "*"), then direct S3 access remains possible. The OAI only restricts access when the bucket policy explicitly denies public access and allows only the OAI.

Answer

The OAI is not properly associated with the CloudFront distribution.

Answer

The CloudFront distribution is using a custom origin instead of S3.

Answer

CloudFront is using pre-signed URLs that are being shared.

Question 4

A company wants to distribute content globally with low latency and high transfer speeds. The content is stored in S3 buckets in multiple regions. Which AWS service should be used to accelerate content delivery?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is AWS's content delivery network (CDN), designed to cache and serve content from edge locations worldwide with low latency and high transfer speeds. It integrates natively with S3 origins across regions and can use origin groups or multiple origins for failover. This directly matches the requirement to accelerate global content delivery.

Answer

Amazon Route 53

Answer

AWS Global Accelerator

Answer

S3 Transfer Acceleration

Question 5

Which TWO actions can be taken to improve the availability of a web application hosted on EC2 instances behind an Application Load Balancer? (Select two.)

Accepted Answer

Configure an Auto Scaling group with health checks to replace unhealthy instances.. Option A is correct because an Auto Scaling group configured with health checks (ELB or EC2 health checks) automatically detects and replaces unhealthy instances, maintaining the desired capacity and thus improving availability. Option C is correct because deploying EC2 instances across multiple Availability Zones provides fault isolation; if one AZ fails, the Application Load Balancer routes traffic to healthy instances in other AZs, maintaining availability. Option B is incorrect because larger instance types increase capacity/performance but do not address redundancy or failure recovery. Option D is incorrect because using a single Region does not improve availability against AZ-level failures and is not a redundancy measure. Option E is incorrect because placing all instances in a single subnet concentrates them in one AZ, reducing availability and creating a single point of failure.

Answer

Use larger EC2 instance types.

Answer

Use a single AWS Region for all instances.

Answer

Place all EC2 instances in a single subnet.

Question 6

Which THREE AWS services can be used to improve security and performance for a web application that uses an Application Load Balancer? (Select three.)

Accepted Answer

AWS Shield Advanced. AWS Shield Advanced provides enhanced protection against Distributed Denial of Service (DDoS) attacks, including application-layer attacks targeting the Application Load Balancer (ALB). It integrates directly with ALB to offer always-on detection and automatic mitigation, improving security without requiring changes to the application architecture.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 7

Refer to the exhibit. The output shows the health status of two targets in a target group. One target is unhealthy with a 502 error. What is the most likely cause?

Accepted Answer

The web server on the target instance is returning HTTP 502 status codes.. A 502 Bad Gateway error from the target indicates that the web server on the instance is returning an invalid response, often due to an application error or misconfiguration. Option A is incorrect because a security group blocking health check traffic would result in a connection timeout or refusal, not a 502. Option B is incorrect because the health check is initiated by the ALB to the target instance, so outbound traffic from the instance is not relevant. Option D is incorrect because a misconfigured health check path would typically result in a 404 or other error, but not necessarily a 502. The 502 error is directly caused by the target's web server returning an HTTP 502 status code.

Answer

The target instance’s security group is blocking the health check traffic.

Answer

The target instance is not allowing outbound traffic to the ALB.

Answer

The ALB health check is misconfigured with an incorrect path.

Question 8

A SysOps administrator needs to allow traffic from a specific IP address range (203.0.113.0/24) to access an Amazon EC2 instance in a VPC. Which configuration step should be performed?

Accepted Answer

Add an inbound rule to the security group associated with the EC2 instance allowing traffic from 203.0.113.0/24.. Security groups are the stateful, instance-level virtual firewalls in AWS that control inbound and outbound traffic to EC2 instances. To permit traffic from a specific CIDR block like 203.0.113.0/24 to reach an EC2 instance, you must add an inbound rule to the security group attached to that instance, specifying the source as the CIDR. This is the most direct and correct configuration step because security groups operate at the ENI level and are required for any inbound traffic to be allowed.

Answer

Create an IAM policy that allows inbound traffic from 203.0.113.0/24.

Answer

Add a rule to the network ACL associated with the subnet to allow inbound traffic from 203.0.113.0/24.

Answer

Modify the route table of the subnet to include a route for 203.0.113.0/24 to the internet gateway.

Question 9

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. Users report intermittent 502 errors. What is the most likely cause?

Accepted Answer

The ALB is experiencing health check failures or scaling issues.. CloudFront returns HTTP 502 (Bad Gateway) when the origin — here an ALB — cannot successfully serve the request, most commonly because the ALB has no healthy targets registered. Health check failures or scaling events that leave the ALB without healthy backend instances cause CloudFront to receive an error response or no response, resulting in intermittent 502s.

Answer

The CloudFront distribution does not have Cache-Control headers configured.

Answer

AWS WAF is blocking requests from CloudFront.

Answer

The SSL/TLS certificate on the ALB is expired.

Question 10

A SysOps administrator needs to ensure that all traffic to an Amazon S3 bucket is encrypted in transit. Which configuration should be used?

Accepted Answer

Add a bucket policy that denies requests where aws:SecureTransport is false.. A bucket policy that denies requests where the aws:SecureTransport condition key is false enforces encryption in transit at the S3 API layer, rejecting any HTTP (non-TLS) request regardless of client. This is the canonical AWS-documented method for requiring TLS on an S3 bucket.

Answer

Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.

Answer

Create a VPC endpoint for S3 and route all traffic through it.

Answer

Enable default encryption on the S3 bucket.

Question 11

An application uses Amazon Route 53 weighted routing to distribute traffic across two AWS regions. After a deployment, users in one region are experiencing errors. What should the administrator do to mitigate the issue immediately?

Accepted Answer

Set the weight of the affected region's record to 0 and verify health checks are configured.. Setting the weight of the affected region's Route 53 record to 0 immediately removes that region from the weighted routing rotation, diverting all traffic to the healthy region. Verifying that health checks are configured ensures Route 53 can automatically fail over if the region becomes unhealthy again, providing both immediate mitigation and ongoing resilience.

Answer

Update the alias record to point to a different load balancer.

Answer

Change the routing policy from weighted to latency-based.

Answer

Restart the EC2 instances in the affected region.

Question 12

A company wants to allow its employees to access internal applications using a custom domain name (app.example.com) that resolves to an internal ALB. Which AWS service should be used?

Accepted Answer

Amazon Route 53. Amazon Route 53 is the correct choice because it is a DNS service that can resolve a custom domain name (app.example.com) to an internal Application Load Balancer's DNS name. By creating a private hosted zone associated with the company's VPC, Route 53 can provide internal DNS resolution without exposing the ALB to the internet, which meets the requirement for internal application access.

Answer

AWS Global Accelerator

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 13

A SysOps administrator notices that traffic to an Amazon EC2 instance is being blocked even though the security group allows all inbound traffic. The subnet's network ACL allows all inbound and outbound traffic. What could be the issue?

Accepted Answer

The instance's operating system firewall is blocking the traffic.. The security group and network ACL both allow all traffic, so the issue must be at the instance level. The operating system's built-in firewall (e.g., iptables for Linux, Windows Firewall for Windows) can block inbound traffic independently of AWS networking constructs. Since the OS firewall is not managed by AWS, it can override security group rules, causing traffic to be dropped even when AWS-side configurations are permissive.

Answer

The network ACL is not associated with the subnet correctly.

Answer

VPC Flow Logs are misconfigured.

Answer

The route table does not have a default route to an internet gateway.

Question 14

A company is using Amazon CloudFront to serve static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. How should this be configured?

Accepted Answer

Configure Origin Access Control (OAC) with the S3 bucket policy.. Origin Access Control (OAC) is the recommended method to restrict access to an S3 bucket so that only CloudFront can retrieve objects. When OAC is enabled, CloudFront signs requests to S3 using a specific principal, and the S3 bucket policy is configured to allow access only to that principal. This prevents direct access to the bucket via S3 URLs or other AWS services, ensuring that content is served exclusively through CloudFront.

Answer

Use CloudFront signed URLs or cookies.

Answer

Attach an IAM role to CloudFront that grants S3 read access.

Answer

Create a bucket policy that allows access only from the CloudFront distribution's IP addresses.

Question 15

A SysOps administrator needs to design a VPC with public and private subnets for a web application. Which TWO components are required to allow instances in the private subnet to access the internet?

Accepted Answer

NAT gateway in a public subnet. A NAT gateway in a public subnet is required because it allows instances in a private subnet to initiate outbound traffic to the internet (e.g., for software updates) while preventing unsolicited inbound connections. The NAT gateway must be placed in a public subnet with an Internet Gateway (IGW) route to translate private IPs to the gateway's Elastic IP. Without the NAT gateway, private instances have no path to the internet.

Answer

VPC endpoint for S3

Answer

Internet gateway attached to the VPC

Answer

Virtual private gateway