SOA-C02 Networking and Content Delivery Practice Test 18 — 15 Questions

Question 1

A company uses Amazon CloudFront to distribute content globally. They need to restrict access to premium content to only authenticated users. Which THREE methods can be used to achieve this?

Accepted Answer

Lambda@Edge to validate JWT tokens. Lambda@Edge (C) is correct because it runs custom Node.js/Python code at CloudFront edge locations, allowing the function to inspect incoming requests and validate JWT tokens (e.g., checking signature, issuer, and expiry) before serving premium content. CloudFront signed cookies (D) are correct because they grant access to multiple restricted files (such as an entire premium video library or HLS segments) using a single Set-Cookie header with a signed policy, ideal when you don't want to change URLs per object. CloudFront signed URLs (E) are correct because they provide time-limited, cryptographically signed access to individual objects, commonly used for one-off downloads or streaming a single premium file. AWS WAF IP set rules (A) only filter by source IP address and do not authenticate users, so they cannot verify identity. AWS Shield Advanced (B) is a DDoS protection service and provides no user authentication or content access control.

Answer

AWS WAF IP set rules to allow only known IPs

Answer

AWS Shield Advanced to protect against DDoS

Question 2

A company has a VPC with public and private subnets across two Availability Zones. An application running on EC2 instances in the private subnets needs to access the internet for updates. Which configuration should be used to provide internet access while minimizing administrative overhead?

Accepted Answer

Deploy a NAT Gateway in a public subnet and update private route tables to point to it.. A NAT Gateway, deployed in a public subnet with an Elastic IP, allows instances in private subnets to initiate outbound traffic to the internet (e.g., for updates) while preventing inbound traffic from the internet. This is a fully managed AWS service, so it requires no patching or scaling management, minimizing administrative overhead. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway's network interface.

Answer

Assign public IP addresses to the private instances and update route tables accordingly.

Answer

Set up AWS Direct Connect to an internet gateway.

Answer

Launch a NAT instance in the private subnet and configure routing.

Question 3

A company wants to host a static website on AWS with high availability and low latency for global users. Which service should be used to serve the static content?

Accepted Answer

Amazon S3 bucket configured for static website hosting, with Amazon CloudFront.. Amazon S3 static website hosting serves the HTML/CSS/JS objects directly from the bucket, and fronting it with Amazon CloudFront caches content at global edge locations, delivering low latency and high availability. This combination is the canonical AWS pattern for globally distributed static sites because it removes server management and scales automatically.

Answer

AWS Lambda with API Gateway.

Answer

Amazon Route 53 with a simple routing policy.

Answer

EC2 instances behind an Application Load Balancer.

Question 4

A SysOps administrator notices that traffic from an Application Load Balancer to targets is failing intermittently. The targets are EC2 instances in an Auto Scaling group. The health check settings on the target group are: ping path '/health', healthy threshold 2, unhealthy threshold 2, timeout 5 seconds, interval 30 seconds. Which change would most likely improve the stability of the health checks?

Accepted Answer

Increase the unhealthy threshold to 5.. Increasing the unhealthy threshold reduces flapping; currently 2 consecutive failures mark an instance unhealthy, which may be too sensitive. Option A is wrong because a longer interval would delay detection. Option B is wrong because a shorter timeout may cause false positives. Option C is wrong because decreasing healthy threshold increases sensitivity.

Answer

Increase the interval to 60 seconds.

Answer

Decrease the healthy threshold to 1.

Answer

Decrease the timeout to 2 seconds.

Question 5

A company wants to use Amazon CloudFront to serve content from an Application Load Balancer (ALB) that is internet-facing. Which type of origin should be configured in CloudFront?

Accepted Answer

Custom origin (HTTP/HTTPS) pointing to the ALB DNS name.. CloudFront requires a custom origin (HTTP/HTTPS) when the origin is an Application Load Balancer (ALB) because ALBs are not S3 buckets and do not support S3 origin configurations. The custom origin type allows CloudFront to forward requests to the ALB's public DNS name, which resolves to the ALB's IP addresses, enabling proper load balancing and content delivery.

Answer

S3 origin with the ALB's DNS name as the bucket name.

Answer

Custom origin with Origin Access Identity (OAI) to restrict access.

Answer

Custom origin pointing to the ALB's private IP address.

Question 6

A company has a web application behind an Application Load Balancer (ALB) with sticky sessions enabled. The ALB's target group contains EC2 instances in an Auto Scaling group. After a deployment, users report that they are being logged out frequently. What is the most likely cause?

Accepted Answer

The ALB's stickiness cookie is not configured or is being overwritten.. Sticky sessions (session affinity) rely on a cookie generated by the ALB (AWSALB) to route subsequent requests from a user to the same target. If the cookie is not configured or is overwritten (e.g., by the application after deployment), the ALB treats each request as new and may route to different instances, causing the user to be logged out. Option A is incorrect because deregistration delay controls how long the ALB waits before deregistering an instance, which does not affect existing sessions unless instances are being removed. Option C is incorrect because while frequent health checks may cause instances to be marked unhealthy, this would result in connection errors or routing to other instances, but it does not explain logouts due to sticky session loss. Option D is incorrect because cross-zone load balancing distributes traffic across zones but does not affect session stickiness.

Answer

The deregistration delay is set too low.

Answer

Health checks are too frequent and marking instances unhealthy.

Answer

Cross-zone load balancing is disabled.

Question 7

Which AWS service can be used to create a private, dedicated connection between an on-premises data center and AWS?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. It offers more consistent network performance, lower latency, and reduced bandwidth costs compared to internet-based connections. This makes it the correct choice for a private, dedicated connection.

Answer

AWS Site-to-Site VPN

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 8

A company is using Amazon CloudFront to distribute content globally. They want to restrict access to their content so that only users from specific countries can access it. Which TWO actions can be taken to achieve this?

Accepted Answer

Configure CloudFront geo restriction (whitelist or blacklist) at the distribution level.. CloudFront geo restriction allows you to whitelist or blacklist countries at the distribution level, directly controlling access based on the geographic location of the viewer's IP address. This is a native CloudFront feature that does not require additional services, making it a straightforward solution for country-based access control.

Answer

Configure an S3 bucket policy with a condition for aws:SourceIp.

Answer

Use IAM policies to restrict access based on the user's location.

Answer

Set up an Application Load Balancer rule to deny traffic from certain IP ranges.

Question 9

A company is designing a multi-tier application in a VPC. The web tier must be in public subnets and the application tier in private subnets. The application tier needs to receive traffic only from the web tier. Which TWO configurations are required?

Accepted Answer

Configure the security group for the application tier to allow inbound traffic from the web tier's security group.. Security groups support stateful, rule-based traffic control using logical references to other security groups. By specifying the web tier's security group as the source in the application tier's inbound rule, traffic is allowed only from instances associated with that web tier security group, regardless of IP address changes. This provides a more secure and manageable configuration than using CIDR blocks, as it automatically adapts to scaling or instance replacements.

Answer

Use a network ACL on the private subnet to deny all inbound traffic except from the public subnet CIDR.

Answer

Add a route to the Internet Gateway in the private subnet's route table.

Answer

Assign public IP addresses to the application tier instances for outbound access.

Question 10

A company has an application running on EC2 instances behind an Application Load Balancer. Users report intermittent timeout errors. The ALB target group shows healthy instances, and CloudWatch metrics show no spikes in CPU or memory. Which configuration is most likely causing the timeouts?

Accepted Answer

The ALB idle timeout is set too low. The ALB idle timeout is the period the load balancer waits for data on an idle connection before closing it. If it is set lower than the application's processing time (e.g., a long-running request), the ALB closes the connection and the client sees a timeout, even though targets are healthy and CPU/memory are normal. This matches the symptom of intermittent timeouts with no resource spikes.

Answer

Connection draining is set too low

Answer

The target group health check interval is too long

Answer

Cross-zone load balancing is disabled

Question 11

A SysOps administrator needs to route traffic to multiple AWS regions for disaster recovery using Amazon Route 53. The primary region should receive all traffic unless it becomes unhealthy. Which routing policy should be used?

Accepted Answer

Failover routing policy. Failover routing policy is correct because it allows you to configure an active-passive setup where all traffic is directed to a primary resource (e.g., an Elastic Load Balancer in the primary region) unless Route 53 health checks determine that the primary is unhealthy. When the primary fails, Route 53 automatically routes traffic to the secondary (disaster recovery) resource in another region. This directly meets the requirement of sending all traffic to the primary region unless it becomes unhealthy.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 12

A company has an Amazon CloudFront distribution with an S3 bucket as origin. The bucket contains sensitive data. Which configuration ensures that users access the content only through CloudFront and not directly via the S3 URL?

Accepted Answer

Configure an Origin Access Identity (OAI) in CloudFront and update the bucket policy. An Origin Access Identity (OAI) is a special CloudFront user that the distribution uses to fetch objects from the S3 bucket. By updating the bucket policy to grant read access only to that OAI and removing public access, direct requests to the S3 URL are denied while CloudFront can still serve the content. This is the standard AWS pattern for locking an S3 origin behind CloudFront.

Answer

Enable S3 server-side encryption

Answer

Use CloudFront signed URLs or signed cookies

Answer

Enable S3 Block Public Access on the bucket

Question 13

A company is designing a VPC with public and private subnets. The private subnets need internet access for patching, but must not be directly reachable from the internet. Which TWO components should be used together?

Accepted Answer

Private subnet route table with a route to the NAT Gateway. Option E is correct because a NAT Gateway must be deployed in a public subnet (with an Elastic IP) so it can route traffic out through the Internet Gateway on behalf of private instances. Option D is correct because the private subnet's route table must have a route (typically 0.0.0.0/0) pointing to that NAT Gateway, which allows instances in the private subnet to initiate outbound traffic for patching while remaining unreachable from the internet. Together, the NAT Gateway in the public subnet and the private route table entry provide one-way outbound internet access. Option A is incorrect because VPC Peering connects two VPCs and does not provide internet access. Option B is incorrect because routing a private subnet directly to an Internet Gateway would make it a public subnet and expose it to inbound internet traffic. Option C is incorrect because an Internet Gateway alone, attached to the VPC, does not give private subnets outbound access without a NAT device and the corresponding route.

Answer

VPC Peering connection

Answer

Private subnet route table with a route to the Internet Gateway

Answer

Internet Gateway attached to the VPC

Question 14

A company has an Application Load Balancer (ALB) that distributes traffic to EC2 instances. The company wants to enable path-based routing to send requests to different target groups. Which TWO resources must be created to achieve this?

Accepted Answer

Target group for each backend service. (Target group for each backend service) and Option D (Listener rule with a path pattern condition) are correct. Path-based routing requires creating target groups for each backend service and a listener rule with a path pattern condition to direct requests to the appropriate target group. Option A is incorrect because subnets are needed for the ALB, but they are not specifically required for path-based routing. Option C is incorrect because a Network Load Balancer is not used; the ALB itself handles path-based routing. Option E is incorrect because a security group controls traffic but does not enable path-based routing.

Answer

Subnet for the ALB

Answer

Network Load Balancer (NLB)

Answer

Security group for the ALB

Question 15

A SysOps administrator manages a web application hosted on EC2 instances behind an Application Load Balancer. The application uses sticky sessions (session affinity) based on cookies. Recently, the development team deployed a new version that increases the load time for certain pages. Users report that they are randomly seeing other users' data. The administrator suspects that the sticky session configuration is not working correctly. The ALB target group is configured with stickiness enabled using the AWSALB cookie. What should the administrator do to verify that sticky sessions are being honored?

Accepted Answer

Use a browser's developer tools to inspect the cookies on the client side and verify the AWSALB cookie is being set and includes the correct target group identifier. To verify sticky sessions, inspect browser developer tools to confirm the AWSALB cookie is set and remains unchanged across requests. The cookie value is opaque and cannot be decoded to reveal the target group identifier. ALB access logs can also be used to correlate the cookie with the target IP, and the presence of the cookie in access logs does prove the client sent it.

Answer

Increase the stickiness duration to 7 days and test again

Answer

Check the ALB access logs for the presence of the stickiness cookie

Answer

Check the target group health check settings to ensure all instances are healthy