SOA-C02 Networking and Content Delivery Practice Test 4 — 15 Questions

Question 1

An application running on EC2 instances sends large amounts of data to an S3 bucket. The SysOps administrator wants to reduce data transfer costs while ensuring the traffic stays within AWS. What is the most cost-effective solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VPC Endpoint for S3 (Gateway type) and use it from the EC2 instances.. A VPC Endpoint for S3 (Gateway type) allows EC2 instances to access S3 over the AWS private network without traversing the public internet, eliminating data transfer costs for traffic within the same region. Since the traffic stays within AWS, this is the most cost-effective solution as it avoids NAT Gateway, Direct Connect, or S3 Transfer Acceleration charges.

Answer

Set up an AWS Direct Connect connection.

Answer

Use S3 Transfer Acceleration.

Answer

Route traffic through a NAT Gateway in a public subnet.

Question 2

A SysOps administrator is troubleshooting connectivity issues between two VPCs in different AWS Regions. Both VPCs are connected via a VPC Peering connection. The route tables in both VPCs have routes pointing to the peering connection. Security groups allow all traffic. However, an EC2 instance in VPC A cannot ping an EC2 instance in VPC B. What is the most likely cause?

Accepted Answer

The route tables in the subnets where the instances reside do not include a route to the peered VPC's CIDR.. The most likely cause is that the route tables associated with the subnets where the EC2 instances reside do not include a route to the peered VPC's CIDR block. Even if the main VPC route tables have the peering route, each subnet must be explicitly associated with a route table that contains the route to the peered VPC's CIDR; otherwise, traffic from the instance will not be directed to the VPC peering connection.

Answer

The network ACLs in subnets are blocking ICMP traffic.

Answer

VPC Peering is not supported across AWS Regions.

Answer

The security groups do not allow traffic from the peered VPC's security group ID.

Question 3

A company has an application that requires UDP traffic to be distributed across multiple EC2 instances. Which AWS load balancer type should be used?

Accepted Answer

Network Load Balancer. A Network Load Balancer (NLB) operates at Layer 4 and can handle both TCP and UDP traffic, making it the correct choice for distributing UDP traffic across multiple EC2 instances. Unlike other load balancers, NLB preserves the source IP address and can forward UDP packets without inspecting application-layer headers, which is essential for UDP-based applications such as DNS, VoIP, or gaming servers.

Answer

Classic Load Balancer

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 4

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download software patches from the internet. Which component should be used to provide internet access to the instance?

Accepted Answer

NAT Gateway in a public subnet. A NAT Gateway in a public subnet allows EC2 instances in private subnets to initiate outbound traffic to the internet (e.g., to download patches) while preventing unsolicited inbound connections. The NAT Gateway uses an Elastic IP and routes traffic from the private subnet through the internet gateway attached to the VPC, translating the private IP to the public IP of the NAT Gateway.

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway attached to the VPC

Answer

VPC Endpoint for Amazon S3

Question 5

A company has multiple VPCs in the same account that need to communicate with each other. The VPCs are in the same region. Which solution provides the simplest and most scalable connectivity?

Accepted Answer

Create a Transit Gateway and attach all VPCs.. AWS Transit Gateway acts as a central hub that allows you to attach multiple VPCs and manage inter-VPC routing through a single gateway, simplifying connectivity and scaling easily as you add more VPCs. It eliminates the need for complex mesh or star configurations and supports transitive routing, making it the simplest and most scalable solution for multi-VPC communication within the same region.

Answer

Set up AWS Direct Connect and route through a single VPC.

Answer

Use AWS PrivateLink to connect the VPCs.

Answer

Create VPC Peering connections between each pair of VPCs.

Question 6

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a database. Which TWO components are required to allow an EC2 instance in the public subnet to connect to the database?

Accepted Answer

A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR.. A security group rule on the database allowing inbound traffic from the EC2 instance's security group (Option E) is required because security groups act as a virtual firewall at the instance level, and by default they deny all inbound traffic. A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR (Option B) is also required because network ACLs are stateless and control traffic at the subnet boundary; without an inbound allow rule, traffic from the public subnet would be dropped by the private subnet's ACL.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Endpoint for the database service.

Question 7

A company is using Amazon CloudFront to deliver content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which TWO steps should be taken?

Accepted Answer

Configure the S3 bucket policy to grant the OAI s3:GetObject permission.. To restrict access so that only CloudFront can access the S3 bucket, the correct steps are to create an Origin Access Identity (OAI) for the CloudFront distribution (option D) and then configure the S3 bucket policy to grant the OAI s3:GetObject permission (option B). This ensures that only the CloudFront distribution with that OAI can read objects from the bucket, while all other principals are denied access. Option A is incorrect because presigned URLs grant temporary access to individual users, not to CloudFront. Option C is incorrect because signed URLs control viewer access, not origin access. Option E is incorrect because bucket policies reference the OAI, not the distribution ID.

Answer

Generate presigned URLs for all objects in the S3 bucket.

Answer

Configure CloudFront signed URLs to limit viewer access.

Answer

Set the S3 bucket policy to allow access only from the CloudFront distribution ID.

Question 8

A company is using Amazon Route 53 as its DNS service. The company has a web application running on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that if the ALB fails, traffic is automatically redirected to a static error page hosted on an Amazon S3 bucket. Which Route 53 routing policy should be used to achieve this?

Accepted Answer

Failover routing policy. The Failover routing policy in Amazon Route 53 is designed to route traffic to a primary resource (the ALB) and automatically redirect to a secondary resource (the S3 bucket static error page) when the primary health check fails. This ensures high availability by failing over to the static error page if the ALB becomes unhealthy, meeting the requirement precisely.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 9

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. Which of the following route table configurations is required for the private subnet to enable internet access through the NAT gateway?

Accepted Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the private subnet route table. A private subnet route table must have a default route (0.0.0.0/0) pointing to the NAT gateway's elastic network interface (ENI) to forward outbound internet traffic from private instances through the NAT gateway. The NAT gateway, residing in the public subnet, then uses its own route table with a route to the internet gateway (IGW) to reach the internet. Without this route, traffic from the private subnet would have no path to the internet.

Answer

Add a route to 0.0.0.0/0 pointing to the internet gateway in the private subnet route table

Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the public subnet route table

Answer

Add a route to the NAT gateway's private IP in the private subnet route table

Question 10

A company is running a critical application on EC2 instances in a VPC. The instances are in an Auto Scaling group across multiple Availability Zones. The application needs to maintain a fixed, private IP address for each instance. Which approach should be used to ensure each instance receives a consistent private IP address?

Accepted Answer

Use an Elastic Network Interface (ENI) with a predefined private IP and attach it to the instance. An Elastic Network Interface (ENI) can be created with a specific private IP address and attached to an instance. Upon instance termination, the ENI can be detached and reattached to a new instance, preserving the private IP. Option B is incorrect because DHCP option sets configure domain name servers and domain names, not assign IP addresses. Option C is incorrect because Elastic IPs are public IP addresses, not private. Option D is incorrect because user data scripts run at boot but cannot guarantee a static IP if the instance is replaced; the new instance would get a different IP from the VPC's DHCP range unless an ENI is used.

Answer

Configure the DHCP option set to assign a static IP

Answer

Assign an Elastic IP to each instance and use that as the private IP

Answer

Use a custom AMI that configures a static private IP address via user data

Question 11

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. The company wants to connect two subnets: one in the VPC (10.0.1.0/24) and one in an on-premises network (192.168.1.0/24) via a Site-to-Site VPN. The VPN connection is established. However, instances in the VPC subnet cannot ping the on-premises server at 192.168.1.10. What is a possible cause?

Accepted Answer

The route table for the VPC subnet does not have a route to the on-premises network via the VPN gateway. The VPC subnet's route table must have a route for the on-premises CIDR pointing to the VPN gateway. Without that route, traffic to the on-premises network is not forwarded to the VPN gateway. Option A is incorrect because the question states the VPN connection is established, implying the tunnel is up. If the tunnel were not UP, it would prevent ping, but the scenario indicates the connection is established. Option C is incorrect because security groups control traffic to/from instances, but the route is missing; even if ICMP is allowed, traffic won't reach the on-premises server without a proper route. Option D is incorrect because there is no VPC endpoint for the VPN service; VPN connections use the internet gateway or virtual private gateway, not a VPC endpoint.

Answer

The VPN tunnel is not in the UP state

Answer

The security group for the VPC instances does not allow ICMP traffic

Answer

The VPC does not have a VPC endpoint for the VPN service

Question 12

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The company needs to ensure that the ALB sends requests to instances that are healthy and can serve traffic. Which feature should be used to monitor the health of the instances?

Accepted Answer

Health checks. Health checks allow the ALB to monitor the health of EC2 instances by sending periodic requests to a specified endpoint (e.g., /health). If an instance fails consecutive health checks, the ALB stops sending traffic to it. Option B is incorrect because sticky sessions (session affinity) ensure a client's requests are sent to the same instance, not health monitoring. Option C is incorrect because cross-zone load balancing distributes traffic across instances in multiple Availability Zones. Option D is incorrect because connection draining (deregistration delay) allows in-flight requests to complete before an instance is removed from the target group.

Answer

Sticky sessions

Answer

Cross-zone load balancing

Answer

Connection draining

Question 13

A company has a CloudFront distribution with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible through CloudFront. Which configuration is required to ensure that direct access to the S3 bucket is blocked?

Accepted Answer

Create an Origin Access Identity (OAI) and add a bucket policy that grants access only to the OAI. Origin Access Identity (OAI) prevents direct S3 access by allowing only CloudFront to access the bucket. Option A is wrong because IAM roles are not used for origin access in CloudFront. Option B is wrong because CloudFront IP ranges change and are not a reliable method. Option D is wrong because signed URLs control viewer access, not origin access.

Answer

Attach an IAM role to CloudFront that allows S3 access

Answer

Set the S3 bucket policy to deny all access except from CloudFront's IP ranges

Answer

Use signed URLs for all requests

Question 14

A company has a VPC with multiple subnets across two Availability Zones. The company wants to set up a Network Load Balancer (NLB) to handle TCP traffic to a fleet of EC2 instances. The instances are in private subnets. Which configuration is necessary to ensure the NLB can route traffic to the instances?

Accepted Answer

Ensure the NLB is deployed in subnets that can route to the target subnets. A Network Load Balancer must be deployed in subnets that can route to the target subnets. Since the instances are in private subnets, the NLB's subnets must have route table entries (e.g., VPC peering or transit gateway) that allow communication with the target subnets. Option B is incorrect because NLB does not use security groups; it relies on network ACLs. Option C is incorrect because NAT gateways are for outbound internet traffic, not for NLB-to-instance traffic. Option D is incorrect because an internet gateway is not required for NLB traffic within the VPC.

Answer

Assign security groups to the NLB to allow inbound traffic

Answer

Configure a NAT gateway in each Availability Zone for the NLB to access the instances

Answer

Attach an internet gateway to the VPC and add a route to the NLB subnets

Question 15

A company has an EC2 instance that needs to have a static public IP address that does not change even if the instance is stopped and started. Which AWS resource should be attached to the instance?

Accepted Answer

An Elastic IP address. An Elastic IP address is a static public IP that can be associated with an EC2 instance and remains with the account until explicitly released, even if the instance is stopped and started. Option B is incorrect because automatically assigned public IP addresses change when the instance is stopped and started. Option C is incorrect because a secondary private IP address is not public and cannot be used for internet-facing traffic without a NAT device. Option D is incorrect because a static private IP address is not public and cannot provide direct internet access.

Answer

An automatically assigned public IP address

Answer

A secondary private IP address

Answer

A static private IP address