SOA-C02 Networking and Content Delivery Practice Test 3 — 15 Questions

Question 1

A company has two VPCs in the same AWS account and Region: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The SysOps administrator needs to establish connectivity between these VPCs so that resources in VPC-A can reach resources in VPC-B using private IP addresses. The solution must be highly available and not involve a third-party appliance. Which solution should the administrator implement?

Accepted Answer

Create a VPC Peering connection between VPC-A and VPC-B. Update the route tables in each VPC to add routes to the other VPC's CIDR.. Option B is correct because VPC Peering provides direct, private IP connectivity between two VPCs using the AWS global network, with no bandwidth bottleneck or single point of failure. By creating a peering connection and adding routes to the other VPC's CIDR in each VPC's route table, resources can communicate privately and the solution is highly available as the peering connection itself is redundant within AWS's infrastructure. No third-party appliance is required, and the setup is fully managed by AWS.

Answer

Create an AWS Transit Gateway and attach both VPCs to it. Configure route tables to allow communication.

Answer

Attach an internet gateway to each VPC and use Amazon Route 53 to resolve private DNS names over the internet.

Answer

Set up a site-to-site VPN connection between the two VPCs using AWS Virtual Private Gateway.

Question 2

A company runs a web application on Amazon EC2 instances in private subnets across multiple Availability Zones. The instances need to download software patches from the internet. The SysOps administrator requires a highly available, fully managed solution for outbound internet connectivity. Which solution should be implemented?

Accepted Answer

Deploy a NAT gateway in each Availability Zone and update the route tables for each private subnet to point to the NAT gateway in the same Availability Zone.. A NAT gateway in each Availability Zone provides highly available outbound internet connectivity for instances in private subnets. By placing a NAT gateway in each AZ and routing private subnet traffic to the NAT gateway in the same AZ, you eliminate a single point of failure and ensure that internet-bound traffic remains within the same AZ for low latency and fault tolerance. This is a fully managed AWS service that handles scaling and failover automatically.

Answer

Attach an Internet Gateway to the VPC and add a default route (0.0.0.0/0) to the Internet Gateway in the private subnet route tables.

Answer

Create a VPC endpoint for Amazon S3 and route traffic through it.

Answer

Set up an AWS Direct Connect connection and route all internet-bound traffic through it.

Question 3

A company has a VPC with public and private subnets. An Application Load Balancer (ALB) is in the public subnets, and Amazon EC2 instances are in the private subnets. The SysOps administrator needs to allow the EC2 instances to access an Amazon S3 bucket in the same AWS Region without traversing the internet. Which solution should the administrator implement?

Accepted Answer

A VPC Gateway Endpoint for S3. A VPC Gateway Endpoint for S3 allows EC2 instances in private subnets to access S3 buckets privately using AWS's internal network, without traversing the internet. This endpoint uses prefix lists and route table entries to direct S3 traffic through the AWS backbone, ensuring low latency and no data transfer costs.

Answer

A NAT Gateway

Answer

An Internet Gateway

Answer

VPC Peering

Question 4

A company has a VPC with public and private subnets. An Amazon EC2 instance in a private subnet needs to access an Amazon S3 bucket in the same AWS Region. The SysOps administrator wants to ensure the traffic does not traverse the internet. Which solution should be implemented?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 without traversing the internet. It uses AWS's internal network, routing traffic through a prefix list in the route table, ensuring data stays within the AWS backbone. This meets the requirement of no internet traversal while providing secure, low-latency access to S3.

Answer

Deploy a NAT Gateway in the public subnet and add a route to the private subnet's route table.

Answer

Attach an Internet Gateway to the VPC and add a default route in the private subnet's route table.

Answer

Set up an AWS Direct Connect connection to the S3 bucket.

Question 5

A company has multiple VPCs in the same AWS account and Region, each with overlapping CIDR blocks (10.0.0.0/16). The SysOps administrator needs to establish connectivity between all VPCs and the on-premises network via AWS Transit Gateway. Additionally, certain VPCs must be isolated from each other while still reaching on-premises. How should the administrator configure the Transit Gateway to meet these requirements?

Accepted Answer

Create multiple Transit Gateway route tables: one for each group of VPCs that need to communicate, and associate each VPC attachment with the appropriate route table. Add static routes to the on-premises network in each route table.. Option B is correct because AWS Transit Gateway supports multiple route tables, allowing you to isolate VPC attachments from each other while still providing a common route to the on-premises network. By creating separate route tables for each group of VPCs that need to communicate, and associating the appropriate VPC attachments with those tables, you can enforce isolation between groups. Adding static routes to the on-premises network in each route table ensures all VPCs can reach on-premises, even when they cannot communicate with each other.

Answer

Create a single Transit Gateway route table and add routes for all VPCs and the on-premises network.

Answer

Use VPC peering instead of Transit Gateway to connect VPCs, and use Direct Connect Gateway for on-premises connectivity.

Answer

Configure VPN connections between each VPC and the on-premises network, bypassing Transit Gateway.

Question 6

A company wants to host a static website using Amazon S3. The website files are stored in an S3 bucket. The SysOps administrator needs to make the website accessible via HTTP. Which action must be performed on the S3 bucket?

Accepted Answer

Enable static website hosting. To host a static website on Amazon S3, you must enable the 'Static website hosting' property on the bucket. This configures the bucket to serve HTTP responses for index and error documents, and provides a regional website endpoint (e.g., http://bucket-name.s3-website-region.amazonaws.com). Without this setting, the bucket only supports REST API access (via the S3 API endpoint), not standard HTTP browser requests.

Answer

Enable versioning

Answer

Configure a bucket policy to allow public read access

Answer

Attach a CloudFront distribution

Question 7

A company has an Application Load Balancer (ALB) that routes traffic to targets in private subnets. The SysOps administrator needs to log detailed information about HTTP requests, including client IP, request path, and response time. Which ALB feature should be enabled?

Accepted Answer

Access logs. Access logs capture detailed information about each HTTP request processed by the ALB, including client IP, request path, response time, and many other fields. This feature stores the logs in an S3 bucket, providing a persistent, queryable record of all requests. CloudWatch metrics aggregate data but do not provide per-request details, making access logs the correct choice for the required granularity.

Answer

CloudWatch metrics

Answer

Connection logs

Answer

Request tracing

Question 8

A company runs an application on Amazon EC2 instances behind an Application Load Balancer (ALB). The ALB terminates SSL/TLS and forwards traffic to the instances over HTTP. The SysOps administrator needs to capture the original client IP address in the instance logs. How should the administrator configure this?

Accepted Answer

Enable the X-Forwarded-For header on the ALB.. When an Application Load Balancer terminates SSL/TLS and forwards traffic to EC2 instances over HTTP, the original client IP address is preserved by the ALB in the X-Forwarded-For header. By enabling this header on the ALB, the SysOps administrator ensures that the web server or application can log the true client IP, which is essential for analytics, security, and troubleshooting.

Answer

Enable stickiness on the ALB target group.

Answer

Configure the ALB to use Proxy Protocol v2.

Answer

Enable access logs on the ALB and store them in Amazon S3.

Question 9

A company uses Amazon CloudFront to deliver content from an Application Load Balancer (ALB) origin. The SysOps administrator needs to restrict access to the content so that only users from a specific geographic location can view it. Which CloudFront feature should be used?

Accepted Answer

Geographic restrictions (geo-blocking) in CloudFront. CloudFront's geographic restrictions (geo-blocking) feature allows you to restrict access to content based on the geographic location of the viewer's IP address. This is the simplest and most direct method to ensure only users from a specific country or region can access the content delivered through CloudFront, without requiring any changes to the origin or additional authentication mechanisms.

Answer

Origin Access Identity (OAI)

Answer

Signed URLs

Answer

AWS WAF web ACL associated with the CloudFront distribution

Question 10

A SysOps administrator is troubleshooting connectivity issues between Amazon EC2 instances in two different VPCs that are connected via a VPC peering connection. The instances can successfully send ICMP (ping) traffic, but TCP connections on port 443 (HTTPS) fail. The security groups of both instances allow all inbound and outbound traffic. What is the most likely cause of the issue?

Accepted Answer

The Network ACL associated with the subnets is blocking the return traffic for TCP connections on ephemeral ports. The correct answer is A because the Network ACL (NACL) is stateless, meaning it must explicitly allow both inbound and outbound traffic. While ICMP (ping) works because it doesn't rely on ephemeral ports for return traffic, TCP connections on port 443 require the return traffic to come from the target instance on a high ephemeral port (typically 1024-65535). If the NACL's outbound rules block these ephemeral ports, the TCP handshake fails, even though the security groups allow all traffic.

Answer

The VPC peering connection is not properly configured for TCP traffic

Answer

The route tables in the VPCs do not contain a route for the other VPC's CIDR

Answer

The security group on the EC2 instance is blocking inbound TCP traffic on port 443

Question 11

A SysOps administrator has deployed an Application Load Balancer (ALB) that distributes traffic to a fleet of Amazon EC2 instances. The administrator notices that the ALB is sending all traffic to instances in a single Availability Zone (AZ), ignoring instances in other AZs. The ALB was created with default settings. Which action should the administrator take to ensure traffic is distributed evenly across all AZs?

Accepted Answer

Enable cross-zone load balancing on the ALB.. By default, an Application Load Balancer distributes traffic evenly across the registered targets in each enabled Availability Zone, but it does not distribute traffic evenly across zones. This means if one AZ has more healthy targets than another, traffic is still split 50/50 between AZs, not across all instances equally. Enabling cross-zone load balancing on the ALB ensures that traffic is distributed evenly across all healthy targets in all enabled AZs, regardless of the number of instances in each zone.

Answer

Enable connection draining on the target group.

Answer

Enable sticky sessions (session stickiness) on the target group.

Answer

Configure health checks on the target group to ensure unhealthy instances are not used.

Question 12

A company needs a dedicated private network connection from its on-premises data center to AWS that provides consistent network performance and high bandwidth. The connection must bypass the public internet. Which AWS service should the SysOps administrator use?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct choice because it provides a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet entirely. This ensures consistent network performance, low latency, and high bandwidth, which are critical for workloads requiring predictable throughput and a private link.

Answer

AWS Site-to-Site VPN

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Question 13

A company has multiple VPCs in the same AWS Region that need to communicate with each other. The SysOps administrator wants to avoid the complexity of a full mesh of VPC peering connections. Which AWS service should the administrator use to connect all VPCs with a central hub?

Accepted Answer

AWS Transit Gateway. AWS Transit Gateway acts as a central hub that allows you to connect multiple VPCs and on-premises networks through a single gateway, eliminating the need for a full mesh of VPC peering connections. It uses a star topology where each VPC attaches to the Transit Gateway, and routing is managed via route tables, simplifying network management and scaling.

Answer

AWS Direct Connect

Answer

VPC peering

Answer

AWS PrivateLink

Question 14

A company has a VPC with a public subnet and a private subnet. An Amazon EC2 instance in the private subnet needs to download security patches from the internet, but the instance must not be directly accessible from the internet. The SysOps administrator configured a NAT gateway in the public subnet and added a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT gateway. The instance's security group allows all outbound traffic. However, the instance still cannot reach the internet. What is the most likely missing configuration?

Accepted Answer

Add a route in the public subnet's route table that directs 0.0.0.0/0 traffic to an internet gateway. The NAT gateway is in the public subnet, but for it to route traffic to the internet, the public subnet must have a route table entry that directs 0.0.0.0/0 traffic to an internet gateway (IGW). Without this route, the NAT gateway cannot forward outbound traffic to the IGW, so the private instance's traffic is dropped. Option C correctly identifies this missing route.

Answer

Attach an Elastic IP to the NAT gateway

Answer

Enable DNS resolution in the VPC

Answer

Modify the network ACL of the private subnet to allow inbound ephemeral ports from the NAT gateway's private IP

Question 15

Instances in a private subnet need outbound internet access for software updates. The route table sends 0.0.0.0/0 to a NAT gateway, but updates fail. Which condition should you check first?

Accepted Answer

Confirm the NAT gateway is in a public subnet whose route table has 0.0.0.0/0 to an internet gateway.. A NAT gateway must reside in a public subnet with a route table entry directing 0.0.0.0/0 to an internet gateway (IGW). Without this, the NAT gateway cannot translate private IPs to the IGW's public IP, so outbound traffic from private instances fails. This is the most common root cause for failed internet access through a NAT gateway.

Answer

Attach an internet gateway directly to the private subnet instances.

Answer

Replace all security groups with network ACLs.

Answer

Enable VPC peering to another account.