SOA-C02 Networking and Content Delivery Practice Test 2 — 15 Questions

Question 1

A company uses Amazon CloudFront to distribute content to users worldwide. The origin is an Application Load Balancer (ALB) that routes to EC2 instances. The SysOps administrator notices that some users are receiving cached responses even though the content has been updated on the origin. The administrator needs to ensure that users always receive the latest version of the content. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CloudFront cache invalidation to remove the old objects after updating the origin.. CloudFront cache invalidation removes objects from edge caches before their TTL expires, ensuring users receive the latest content from the origin. After updating the origin, the administrator should create an invalidation for the affected paths (e.g., /*) to force CloudFront to fetch fresh content.

Answer

Configure the ALB to send a Cache-Control: no-cache header.

Answer

Set up a Lambda@Edge function to change the origin request path.

Answer

Reduce the CloudFront TTL to 0 seconds.

Question 2

A company has an internal Application Load Balancer (ALB) in a VPC. The ALB is used by an on-premises application via AWS Direct Connect. The on-premises application needs to resolve the ALB's DNS name. The VPC has Route 53 private hosted zone associated with the VPC. The on-premises DNS servers are configured to forward queries for the company's domain to the VPC's Route 53 inbound resolver endpoints. However, the on-premises application cannot resolve the ALB's DNS name. What is the likely cause?

Accepted Answer

The ALB's DNS name is not in the Route 53 private hosted zone.. The ALB's DNS name is not automatically added to the Route 53 private hosted zone. For on-premises applications to resolve the ALB's DNS name, a record must be created in the private hosted zone that maps the ALB's DNS name to its IP addresses. Without this record, the on-premises DNS servers, which forward queries to the Route 53 inbound resolver, will not find the ALB's DNS name.

Answer

The ALB's security group blocks inbound traffic from the on-premises CIDR.

Answer

The ALB is internal and does not have a public DNS name.

Answer

The Route 53 inbound resolver is not configured to forward queries to the public internet.

Question 3

A company has a VPC with public and private subnets. A NAT Gateway is in the public subnet, and a private EC2 instance needs to download patches from the internet. The instance can reach the internet after a reboot. Which action should the SysOps administrator take to make the internet access persistent?

Accepted Answer

Update the route table of the private subnet to point 0.0.0.0/0 to the NAT Gateway.. Route tables must be manually updated after adding a NAT Gateway. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway.

Answer

Attach an internet gateway to the private subnet.

Answer

Associate an Elastic IP with the NAT Gateway.

Answer

Enable DNS resolution in the VPC.

Question 4

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection is redundant with two virtual interfaces (VIFs). Recently, one VIF failed, and the administrator notices that traffic is not automatically failing over. What must be configured to enable automatic failover?

Accepted Answer

Create a VPN connection as a backup and configure route propagation with a lower priority.. Direct Connect VIFs do not automatically fail over to each other by default; a common resilient design is to pair Direct Connect with a Site-to-Site VPN backup and use BGP to prefer the Direct Connect path, with the VPN taking over when the DX VIF fails. Configuring route propagation with a lower priority (higher AS path or local preference) enables automatic failover.

Answer

Configure BGP metrics to prefer the primary VIF.

Answer

Place both VIFs in the same VLAN.

Answer

Enable equal-cost multi-path (ECMP) routing.

Question 5

An organization wants to block traffic from specific IP addresses at the edge of the AWS network before it reaches the application. Which service should be used?

Accepted Answer

AWS WAF. AWS WAF integrates with CloudFront and ALB to filter traffic based on IP addresses. For edge blocking, CloudFront with WAF is the best choice.

Answer

Security groups

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 6

Which TWO actions can reduce data transfer costs for content delivered to users globally? (Choose two.)

Accepted Answer

Deploy multiple Application Load Balancers in different regions.. Option A is correct because deploying Application Load Balancers in multiple regions lets you serve users from the region closest to them, so requests and responses travel shorter distances over the AWS network and avoid expensive inter-region or internet egress from a single distant region. Option B is correct because Amazon CloudFront caches content at edge locations worldwide, so repeated requests are served from the nearest edge instead of originating from the origin region, reducing origin egress and data transfer charges. Option C is not correct because AWS Direct Connect is a dedicated private network connection for hybrid connectivity, not a mechanism for reducing global content delivery transfer costs, and it can itself be costly. Option D is not correct because cross-region replication copies data between regions and actually incurs additional inter-region data transfer charges rather than reducing them. Option E is not correct because S3 Transfer Acceleration speeds up uploads to S3 using edge locations but does not reduce data transfer costs for globally delivered content, and it carries its own premium pricing.

Answer

Use AWS Direct Connect for all traffic.

Answer

Use a single S3 bucket in one region with cross-region replication.

Answer

Enable S3 Transfer Acceleration.

Question 7

A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances. Users report intermittent 503 errors. Which of the following is the MOST likely cause?

Accepted Answer

The target instances are not healthy or are overloaded.. An ALB returns HTTP 503 when it has no healthy targets available in a target group to route the request to. This happens when targets fail their configured health checks (e.g., /health returns non-200, TCP connection refused, or timeout) or when instances are so overloaded they cannot respond within the health check timeout. Since the errors are intermittent, some instances are likely passing checks while others are failing or saturated, causing the ALB to drop requests when it routes to unhealthy targets.

Answer

The health check interval is set too low, causing the ALB to mark instances as unhealthy prematurely.

Answer

The SSL certificate on the ALB has expired.

Answer

The security group for the ALB is blocking incoming traffic.

Question 8

A company has a VPN connection between its on-premises network and AWS VPC. The VPN tunnel shows status as UP, but traffic is not flowing from on-premises to the VPC. Which configuration should be checked?

Accepted Answer

The route tables in the VPC have routes pointing to the virtual private gateway for the on-premises CIDR.. Even if the VPN tunnel is UP, traffic from on-premises to the VPC requires a route in the VPC route tables that points the on-premises CIDR block to the virtual private gateway (VGW). Without this route, the VPC has no path to forward return traffic or accept inbound traffic, causing a black hole. The tunnel status only indicates the IPsec/IKE negotiation succeeded, not that routing is properly configured.

Answer

The IKE versions on the customer gateway and virtual private gateway match.

Answer

The customer gateway device is configured to forward traffic to the VPC.

Answer

The security groups allow inbound traffic from the on-premises network.

Question 9

A company has a VPC with a public subnet and a private subnet. An Amazon RDS for MySQL database is deployed in the private subnet. Which TWO steps are required to allow an EC2 instance in the public subnet to connect to the database? (Choose two.)

Accepted Answer

Update the security group for the RDS instance to allow inbound traffic on port 3306 from the EC2 instance's security group.. Option A is correct because an RDS security group must explicitly permit inbound MySQL traffic on TCP port 3306, and referencing the EC2 instance's security group as the source is the recommended way to authorize that instance. Option D is correct because security groups are stateful but still require an outbound rule allowing the EC2 instance to initiate traffic to the RDS security group on port 3306 (the default all-traffic egress rule satisfies this, but the rule must exist). Option B is incorrect because a NAT Gateway only provides outbound internet access for private subnets and is not needed for intra-VPC communication between subnets. Option C is incorrect because RDS instances in a VPC are reached via their private DNS endpoint and should never be assigned public IP addresses. Option E is incorrect because subnets within the same VPC are already reachable via the VPC's local route, so no additional route table entry for the RDS subnet CIDR is required.

Answer

Deploy a NAT Gateway in the public subnet to allow the EC2 instance to communicate with the RDS instance.

Answer

Assign a public IP address to the RDS instance.

Answer

Add a route to the public subnet's route table for the RDS subnet CIDR.

Question 10

A company's web application is hosted on EC2 instances behind a Network Load Balancer (NLB) with a static IP address. The application receives a sudden spike in traffic, and some clients report connection timeouts. Which NLB feature should the SysOps administrator configure to handle the increased load?

Accepted Answer

Enable cross-zone load balancing.. Cross-zone load balancing on an NLB distributes traffic across targets in all enabled Availability Zones, not just the AZ of the load balancer node that received the request. When traffic spikes, enabling cross-zone load balancing allows the NLB to use healthy targets in other AZs, preventing overload and connection timeouts on a single AZ's targets.

Answer

Enable sticky sessions.

Answer

Enable deletion protection.

Answer

Enable health checks to mark unhealthy instances.

Question 11

A company uses a Network Load Balancer (NLB) with a static IP address. The SysOps administrator needs to enable client IP preservation for the NLB so that backend instances see the original client IP. Which TWO conditions are required for client IP preservation to work?

Accepted Answer

The target group must be of type 'instance'.. Only option A is correct because client IP preservation for a Network Load Balancer (NLB) requires the target group to be of type 'instance'. When the target group is instance-based, the NLB can forward packets with the original source IP address intact, allowing backend instances to see the client's IP directly. Option D is not required; client IP preservation does work when the NLB is integrated with AWS Global Accelerator, so this condition is not necessary. The other options are not required for client IP preservation.

Answer

The NLB must have TLS listeners.

Answer

Proxy protocol must be enabled on the target group.

Answer

The NLB must not be integrated with AWS Global Accelerator.

Answer

Cross-zone load balancing must be enabled.

Question 12

Refer to the exhibit. A company has an S3 bucket policy as shown. The SysOps administrator notices that users from the allowed IP range (192.0.2.0/24) can access objects, but users outside that range are denied. However, a CloudFront distribution with an origin access identity (OAI) is also unable to access the bucket and receives 'Access Denied'. What is the MOST likely cause?

Accepted Answer

The condition aws:SourceIp restricts access based on the requestor's IP, not the CloudFront IP.. The bucket policy uses the 'aws:SourceIp' condition key, which evaluates the IP address of the requester. When requests come via CloudFront, the IP address seen by S3 is the CloudFront edge server IP, not the original client IP. Therefore, even though the CloudFront OAI is used, the request is blocked because the CloudFront IP is not within the allowed range (192.0.2.0/24). To allow CloudFront access while restricting direct access, the policy should use a condition that checks the OAI ARN (e.g., 'aws:SourceArn') rather than the source IP. Option A is incorrect because the OAI is indeed allowed via the principal, but the IP condition overrides it. Option B is incorrect because the policy does allow 's3:GetObject' for the OAI. Option D is incorrect because the OAI is configured in the policy (as the principal), but the IP condition prevents its access.

Answer

The policy does not allow 's3:GetObject' for the CloudFront OAI.

Answer

The CloudFront distribution is not in the allowed IP range.

Answer

The CloudFront OAI is not configured in the bucket policy.

Question 13

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) across three Availability Zones. Each AZ has one public and one private subnet. The EC2 instances are in the private subnets. The ALB is internet-facing. Recently, during a traffic spike, some users experienced intermittent timeouts. The SysOps administrator reviews the ALB access logs and finds that the timeouts correspond to periods when the target group had 'unhealthy' instances. The health check is configured to check a health endpoint on port 80 with a path of '/health'. The SysOps administrator checks the EC2 instances and finds that the health endpoint responds correctly. However, the health checks are failing intermittently. The administrator notices that the security group for the EC2 instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound HTTP and outbound ephemeral ports. What is the MOST likely cause of the health check failures?

Accepted Answer

The network ACL for the private subnets is blocking the return traffic from health checks.. The most likely cause is that the network ACL (NACL) for the private subnets is blocking the return traffic from health checks. NACLs are stateless and must allow both inbound and outbound traffic separately. While the inbound rule allows HTTP (port 80) from the ALB, the outbound rule must allow ephemeral ports (1024-65535) for the return traffic. Without this outbound rule, the health check responses from the EC2 instances are dropped, causing intermittent health check failures. Option A is incorrect because the health endpoint responds correctly as stated. Option B is incorrect because the security group allows traffic from the ALB's security group. Option C is incorrect because cross-zone load balancing does not affect health checks.

Answer

The health check endpoint on the EC2 instances is not responding correctly.

Answer

The security group on the EC2 instances is blocking health check traffic from the ALB.

Answer

The ALB does not have cross-zone load balancing enabled.

Question 14

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The VPC has an Internet Gateway (IGW) attached. The public subnets have a route to the IGW, and the private subnets have a route to a NAT Gateway in the public subnet 10.0.1.0/24. The SysOps administrator deploys a new EC2 instance in the private subnet 10.0.4.0/24. The instance needs to download software from the internet, but the download fails. The administrator can successfully ping the NAT Gateway from the instance. What is the MOST likely cause of the failure?

Accepted Answer

The route table for the private subnet does not have a default route to the NAT Gateway.. The most likely cause is that the route table for the private subnet 10.0.4.0/24 does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, internet-bound traffic from the EC2 instance is not forwarded to the NAT Gateway, causing the download to fail. The ping to the NAT Gateway works because it's within the VPC and does not require the default route. Option A is incorrect because security groups by default allow all outbound traffic, so they would not block the download. Option C is incorrect because network ACLs are stateless and by default allow outbound traffic; the issue is routing, not ACL rules. Option D is incorrect because the NAT Gateway must have an Elastic IP to function, and if it didn't, the ping would also fail; the problem is routing, not the Elastic IP association.

Answer

The security group for the EC2 instance blocks outbound internet traffic.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The NAT Gateway is not associated with an Elastic IP address.

Question 15

A company uses Amazon CloudFront to deliver video content to users worldwide. The content is stored in an S3 bucket. The SysOps administrator notices that users in some geographic regions experience high latency when loading the video. The administrator wants to improve the performance for these users without changing the existing infrastructure. The CloudFront distribution is configured with the default cache behavior. What is the MOST cost-effective solution to reduce latency for users in those regions?

Accepted Answer

Change the CloudFront distribution's price class to include all edge locations.. CloudFront price classes determine which edge locations serve the distribution. The default price class (PriceClass_All or the default depending on configuration) may exclude some regions; changing the price class to include all edge locations ensures users in the affected geographic regions are served from a nearby PoP, reducing latency. This requires no infrastructure changes and is the most cost-effective option because it only changes which existing edge locations are used.

Answer

Increase the cache TTL for the content.

Answer

Add additional S3 buckets in different regions and configure multiple origins.

Answer

Use multiple CloudFront distributions for different geographic regions.