SOA-C02 Networking and Content Delivery Practice Test 3 — 15 Questions

Question 1

A SysOps administrator is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises data center connected via AWS Direct Connect. The EC2 instance can reach other instances in the same VPC but cannot reach the on-premises network. The virtual private gateway (VGW) is attached to the VPC and the Direct Connect virtual interface is up. Which configuration step should the administrator verify first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway. For traffic from a VPC to an on-premises network over Direct Connect, the VPC route table must have a route for the on-premises CIDR block pointing to the virtual private gateway (VGW). Without this route, traffic destined for on-premises is dropped. Option A is incorrect because security group rules control traffic at the instance level but do not affect routing; if the security group allowed outgoing traffic, it wouldn't cause a routing issue. Option B is incorrect because network ACLs are stateless and could block traffic if misconfigured, but the primary issue here is the missing route; the VPC route table is the first thing to verify. Option D is incorrect because the Direct Connect virtual interface being up indicates the physical and logical connection is established; the issue is at the VPC routing layer.

Answer

Check the security group rules for the EC2 instance

Answer

Confirm that the Direct Connect virtual interface is associated with the correct VLAN

Answer

Verify the network ACL inbound and outbound rules for the VPC subnet

Question 2

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which configuration ensures that traffic is distributed evenly across all healthy targets?

Accepted Answer

Enable cross-zone load balancing on the ALB. Cross-zone load balancing enables the ALB to distribute incoming traffic evenly across all healthy targets in all enabled Availability Zones, rather than sending traffic only to targets within the same zone as the requesting client. By default, ALBs distribute traffic equally across zones first, then round-robin within each zone, which can lead to uneven load if target counts differ per zone. Enabling cross-zone load balancing overrides this behavior, ensuring each healthy target receives an equal share of requests regardless of its zone.

Answer

Configure sticky sessions (session affinity) on the target group

Answer

Use a Network Load Balancer with path-based routing

Answer

Enable connection draining on the target group

Question 3

A SysOps administrator is setting up Amazon Route 53 for a domain that will be used for a web application. The application requires failover to a backup data center in another region if the primary becomes unhealthy. The administrator creates a failover routing policy with two records (primary and secondary) associated with health checks. After testing, the failover does not occur when the primary endpoint fails. What is the most likely cause?

Accepted Answer

The health check is configured to monitor the secondary endpoint instead of the primary. Failover routing relies on health checks to determine the health of the primary endpoint. If the health check is mistakenly configured to monitor the secondary endpoint, it will not assess the primary's health. Consequently, Route 53 will not trigger a failover to the secondary when the primary fails. Option A is incorrect because alias records are not required for failover; they are only needed for AWS resources. Option B is incorrect because the registrar's nameservers do not affect Route 53's failover logic once the domain is delegated. Option D is incorrect because while a high TTL can delay propagation, it does not prevent failover from occurring; failover depends on health check status, not TTL.

Answer

The primary record is not an alias record

Answer

The domain registrar's nameservers are not pointing to Route 53

Answer

The TTL on the primary record is set too high

Question 4

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The SysOps administrator needs to restrict access to the ALB so that it only accepts requests from CloudFront. Which solution should the administrator implement?

Accepted Answer

Configure CloudFront to add a custom HTTP header to requests, and configure the ALB to only forward requests that contain that header. It uses a shared secret mechanism: CloudFront is configured to add a custom HTTP header (e.g., X-Origin-Verify) to all requests, and the ALB's listener rule is configured to only forward requests that contain that specific header value. This ensures that only requests originating from your CloudFront distribution reach the ALB, as the header is not present in direct client requests. This approach is recommended by AWS for restricting ALB access to CloudFront when the origin is an ALB, because CloudFront does not support Origin Access Identity (OAI) with ALB origins.

Answer

Replace the ALB with a Network Load Balancer and use a VPC endpoint

Answer

Create an origin access identity (OAI) and attach it to the CloudFront distribution

Answer

Add a security group rule to the ALB that allows traffic only from the CloudFront IP ranges

Question 5

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance cannot connect to the internet. The instance is in a public subnet with a route table that has a route to an internet gateway (IGW). The instance has a public IP assigned. What should the administrator check next?

Accepted Answer

Check the security group rules to ensure outbound traffic is allowed. The instance has a public IP and is in a public subnet with a route to an IGW, so network-level routing and addressing are already configured. The most common remaining cause for no internet connectivity is that the security group's outbound rules are blocking traffic. Security groups are stateful, so even if inbound rules allow return traffic, outbound rules must explicitly permit the instance to initiate connections to the internet (e.g., outbound HTTPS on port 443 or all traffic).

Answer

Verify the network ACL associated with the subnet allows inbound traffic from the internet

Answer

Confirm that the route table has a route to the IGW for 0.0.0.0/0

Answer

Ensure the instance has a public IP address

Question 6

A company has deployed a web application across multiple AWS regions and wants to use Amazon Route 53 to direct users to the region with the lowest latency. Which routing policy should the SysOps administrator use?

Accepted Answer

Latency routing policy. Latency routing policy is correct because it directs user traffic to the AWS region that provides the lowest network latency for the end user. Route 53 measures latency between the user's DNS resolver and each region's edge location, then responds with the IP of the region that has the lowest latency. This is ideal for multi-region deployments where the goal is to minimize response time.

Answer

Geolocation routing policy

Answer

Geoproximity routing policy

Answer

Weighted routing policy

Question 7

A SysOps administrator is configuring Amazon CloudFront to serve content from an Amazon S3 bucket. The content is sensitive and should be encrypted at rest. Which option ensures that content is encrypted at rest in S3?

Accepted Answer

Enable server-side encryption (SSE-S3) on the S3 bucket. Enabling server-side encryption (SSE-S3) on the S3 bucket ensures that objects are encrypted at rest using AES-256 encryption managed by Amazon S3. This directly addresses the requirement for content to be encrypted while stored in S3, independent of how CloudFront accesses the bucket.

Answer

Enable CloudFront HTTPS-only access to the S3 bucket

Answer

Configure signed URLs for the distribution

Answer

Use CloudFront field-level encryption

Question 8

Which TWO actions can a SysOps administrator take to improve the availability of a web application using an Application Load Balancer (ALB) and EC2 instances? (Choose two.)

Accepted Answer

Configure health checks on the target group. Health checks allow the ALB to automatically detect unhealthy EC2 instances and stop routing traffic to them, which prevents failed requests from reaching users. By configuring health checks on the target group, the ALB can mark instances as unhealthy based on criteria like HTTP response codes or timeout thresholds, and then route traffic only to healthy instances. This directly improves availability by ensuring that requests are not sent to failed or degraded instances.

Answer

Place all instances in a single subnet to reduce latency

Answer

Use larger instance types to handle more traffic

Answer

Increase the deregistration delay (connection draining) timeout

Question 9

Which THREE components are required to establish a site-to-site VPN connection between an AWS VPC and an on-premises network? (Choose three.)

Accepted Answer

Customer gateway (CGW). A customer gateway (CGW) is required because it represents the on-premises side of the site-to-site VPN connection. It provides the public IP address and BGP ASN (if dynamic routing is used) of the on-premises VPN device, allowing AWS to establish IPsec tunnels with the correct endpoint.

Answer

Transit gateway

Answer

AWS Direct Connect

Question 10

Which TWO features are provided by Amazon CloudFront to secure content delivery? (Choose two.)

Accepted Answer

AWS WAF integration to filter requests based on rules. AWS WAF can be associated with a CloudFront distribution to filter incoming HTTP(S) requests based on rules such as IP addresses, HTTP headers, URI strings, or SQL injection patterns. This allows you to block malicious traffic at the edge before it reaches your origin, providing a layer of security for content delivery.

Answer

Default support for custom SSL certificates without additional configuration

Answer

AWS Shield Advanced for DDoS protection

Answer

VPN connection between CloudFront and the origin

Question 11

Refer to the exhibit. A SysOps administrator created this S3 bucket policy to allow CloudFront to access objects in the bucket using an origin access identity (OAI). However, users are still receiving 403 Access Denied errors when accessing the CloudFront distribution. What is the most likely cause?

Accepted Answer

The OAI ARN in the policy is incorrect. The most likely cause is that the OAI ARN in the bucket policy is incorrect (option D). The OAI ARN must exactly match the CloudFront origin access identity used by the distribution. If it is wrong, CloudFront cannot access the S3 objects and returns 403. S3 Block Public Access settings only apply to anonymous public access and do not affect grants to specific principals like an OAI.

Answer

The CloudFront distribution uses the S3 bucket's regional domain name instead of the distribution domain name

Answer

The CloudFront distribution is in a different region than the S3 bucket

Answer

The S3 bucket has Block Public Access settings enabled that deny all access

Question 12

Refer to the exhibit. A SysOps administrator is troubleshooting internet connectivity for an EC2 instance in subnet subnet-0a1b2c3d4e5f6g7h8. The instance can reach other instances in the VPC but cannot access the internet. Based on the route table output, what is the most likely cause?

Accepted Answer

The NAT gateway does not have a route to an internet gateway. The route table has a default route to a NAT gateway, but the exhibit does not show that the NAT gateway is in a public subnet with an internet gateway route. If the NAT gateway lacks internet access, private instances cannot reach the internet. Option A is wrong because the default route (0.0.0.0/0) exists and points to the NAT gateway. Option B is wrong because the route table is associated with the subnet (the exhibit shows the route table for that subnet). Option D is wrong because the VPC CIDR route is local, which is fine.

Answer

The default route (0.0.0.0/0) is missing

Answer

The route table is not associated with the subnet

Answer

The VPC CIDR route is misconfigured

Question 13

Refer to the exhibit. A SysOps administrator runs the describe-target-health command and sees that an EC2 instance in the target group is unhealthy with a timeout error. What is the most likely cause?

Accepted Answer

The instance's security group does not allow traffic from the ALB on the health check port. The health check is timing out, which indicates that the instance is not responding to health check requests on port 80. The security group must allow inbound traffic from the ALB on the health check port. Option A is wrong because the target group is configured with port 80, which matches. Option C is wrong because the route table is less likely to cause a timeout; it would cause unreachability. Option D is wrong because the instance is in a public subnet? Not necessarily; but the health check timeout is most often a security group issue.

Answer

The target group is configured with an incorrect port

Answer

The instance is in a private subnet without a NAT gateway

Answer

The instance does not have a route to the internet

Question 14

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to maintain user session state. Which configuration ensures session stickiness with minimal performance impact?

Accepted Answer

Enable sticky sessions on the Application Load Balancer using a load balancer-generated cookie.. Enabling sticky sessions on an Application Load Balancer (ALB) using a load balancer-generated cookie (AWSALB) binds a user's session to a specific target instance with minimal overhead. The ALB inserts the cookie in the response, and subsequent requests from the same client are routed to the same instance without requiring application-level session replication or external storage, thus preserving performance.

Answer

Use Amazon CloudFront with origin stickiness enabled.

Answer

Use a Network Load Balancer (NLB) with target group stickiness.

Answer

Store session state in Amazon DynamoDB and have each instance read from DynamoDB.

Question 15

A company wants to provide low-latency access to static content (images, CSS) for global users. The content is stored in an S3 bucket. Which service should be used to cache content at edge locations?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., images, CSS) at edge locations worldwide, providing low-latency access to global users. It integrates directly with S3 as an origin, allowing you to serve content from edge caches while reducing load on the S3 bucket. This makes CloudFront the correct choice for caching static content at edge locations.

Answer

Amazon ElastiCache

Answer

S3 Transfer Acceleration

Answer

AWS Global Accelerator