SOA-C02 Networking and Content Delivery Practice Test 4 — 15 Questions

Question 1

A company hosts a static website on Amazon EC2 instances behind an Application Load Balancer. They want to improve latency for users around the world by caching content at edge locations. Which AWS service should they use?

Accepted Answer

Amazon CloudFront. Amazon CloudFront is a content delivery network (CDN) that caches static content (e.g., HTML, CSS, images) at edge locations worldwide, reducing latency for global users by serving cached responses from the nearest edge rather than the origin EC2 instances behind the Application Load Balancer. It integrates directly with ALB as a custom origin, offloading traffic and improving response times for repeated requests.

Answer

AWS Global Accelerator

Answer

AWS Direct Connect

Answer

Amazon Route 53

Question 2

EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?

Accepted Answer

Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway. Option A is correct because an S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.

Answer

Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately

Answer

Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway

Answer

Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT

Question 3

A web application is deployed in us-east-1 (primary) and eu-west-1 (standby). Under normal conditions, all traffic should go to us-east-1. If the us-east-1 health check fails, traffic must automatically redirect to eu-west-1 within 30 to 60 seconds. What Route 53 configuration implements this?

Accepted Answer

Create failover routing records for the domain: a Primary record pointing to us-east-1 with a Route 53 health check, and a Secondary record pointing to eu-west-1 with no health check. Option A is correct because Route 53 failover routing records, combined with a health check on the primary record, automatically redirect traffic to the secondary (standby) record when the primary health check fails. The health check interval and failure threshold can be configured to detect failure within 30–60 seconds, meeting the requirement without manual intervention.

Answer

Use weighted routing with 100 weight for us-east-1 and 0 weight for eu-west-1; update the weights via Lambda when a CloudWatch alarm fires

Answer

Enable Route 53 latency routing with records for both regions; Route 53 will automatically switch to eu-west-1 when us-east-1 becomes unavailable

Answer

Configure Route 53 geolocation routing to send all US traffic to us-east-1 and all European traffic to eu-west-1

Question 4

Users are intermittently reporting 502 Bad Gateway errors when accessing the application through an Application Load Balancer. The team needs to identify which target IPs are associated with the failures and the request processing time for those requests. Application logs on instances do not capture failures before the ALB connection. What should be enabled?

Accepted Answer

Enable ALB access logs, specify an S3 bucket destination, and query the logs to filter on elb_status_code=502. ALB access logs capture detailed information about each request, including the target IP address, request processing time, and the HTTP status code returned by the ALB. By enabling these logs and querying for `elb_status_code=502`, you can identify which target IPs were associated with the failures and the `request_processing_time` for those requests. This directly addresses the need to correlate failures with specific targets and timing, without relying on application instance logs that miss pre-connection failures.

Answer

Enable AWS X-Ray on the ALB to trace each request end-to-end from client to target

Answer

Configure a VPC Flow Log on the subnets containing the ALB to capture all network traffic

Answer

Install an agent on the application instances that logs all incoming connection attempts from the ALB

Question 5

A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?

Accepted Answer

Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports. Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.

Answer

Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console

Answer

Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic

Answer

Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule

Question 6

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Question 7

Match each AWS database service to its type.

Question 8

A company uses Amazon CloudFront to deliver its static website hosted on Amazon S3. The security team notices that users are able to access the S3 bucket directly via the S3 endpoint, bypassing CloudFront. What should be done to ensure that content is only accessible through CloudFront?

Accepted Answer

Create an origin access identity (OAI) and update the S3 bucket policy to grant access only to the OAI. Option C is correct because configuring an origin access identity (OAI) and updating the S3 bucket policy to allow access only to the OAI prevents direct S3 access. Option A is wrong because disabling public access on the S3 bucket using S3 Block Public Access would also block legitimate CloudFront requests if not combined with OAI. Option B is wrong because Lambda@Edge can modify requests/responses but does not enforce access control at the bucket level. Option D is wrong because AWS WAF can filter requests but does not prevent direct S3 access.

Answer

Use AWS WAF to block requests that do not include the CloudFront distribution's domain name

Answer

Create an AWS Lambda@Edge function to validate headers

Answer

Use S3 Block Public Access to prevent all public access

Question 9

A SysOps administrator is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises data center connected via AWS Direct Connect. The EC2 instance can reach other instances in the same VPC but cannot reach the on-premises network. The virtual private gateway (VGW) is attached to the VPC and the Direct Connect virtual interface is up. Which configuration step should the administrator verify first?

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway. Option D is correct because for Direct Connect to work, the on-premises CIDR must be added to the VPC route table pointing to the virtual private gateway. Without this route, traffic from the VPC to on-premises is dropped. Option A is wrong because the security group controls inbound/outbound traffic but does not affect routing. Option B is wrong because network ACLs are stateless and would need to allow both inbound and outbound; but the primary issue is routing. Option C is wrong because the VGW is already attached and the virtual interface is up, indicating the physical connection is fine.

Answer

Check the security group rules for the EC2 instance

Answer

Confirm that the Direct Connect virtual interface is associated with the correct VLAN

Answer

Verify the network ACL inbound and outbound rules for the VPC subnet

Question 10

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which configuration ensures that traffic is distributed evenly across all healthy targets?

Accepted Answer

Enable cross-zone load balancing on the ALB. Cross-zone load balancing enables the ALB to distribute incoming traffic evenly across all healthy targets in all enabled Availability Zones, rather than sending traffic only to targets within the same zone as the requesting client. By default, ALBs distribute traffic equally across zones first, then round-robin within each zone, which can lead to uneven load if target counts differ per zone. Enabling cross-zone load balancing overrides this behavior, ensuring each healthy target receives an equal share of requests regardless of its zone.

Answer

Configure sticky sessions (session affinity) on the target group

Answer

Use a Network Load Balancer with path-based routing

Answer

Enable connection draining on the target group

Question 11

A SysOps administrator is setting up Amazon Route 53 for a domain that will be used for a web application. The application requires failover to a backup data center in another region if the primary becomes unhealthy. The administrator creates a failover routing policy with two records (primary and secondary) associated with health checks. After testing, the failover does not occur when the primary endpoint fails. What is the most likely cause?

Accepted Answer

The health check is configured to monitor the secondary endpoint instead of the primary. Option B is correct because if the health check is set to evaluate the health of the secondary endpoint instead of the primary, Route 53 will not detect the primary failure. Option A is wrong because DNS TTL affects caching but not failover behavior. Option C is wrong because the failover routing policy is independent of the domain registrar's nameservers. Option D is wrong because an alias record is not required for failover with non-AWS endpoints.

Answer

The primary record is not an alias record

Answer

The domain registrar's nameservers are not pointing to Route 53

Answer

The TTL on the primary record is set too high

Question 12

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The SysOps administrator needs to restrict access to the ALB so that it only accepts requests from CloudFront. Which solution should the administrator implement?

Accepted Answer

Configure CloudFront to add a custom HTTP header to requests, and configure the ALB to only forward requests that contain that header. Option D is correct because it uses a shared secret mechanism: CloudFront is configured to add a custom HTTP header (e.g., X-Origin-Verify) to all requests, and the ALB's listener rule is configured to only forward requests that contain that specific header value. This ensures that only requests originating from your CloudFront distribution reach the ALB, as the header is not present in direct client requests. This approach is recommended by AWS for restricting ALB access to CloudFront when the origin is an ALB, because CloudFront does not support Origin Access Identity (OAI) with ALB origins.

Answer

Replace the ALB with a Network Load Balancer and use a VPC endpoint

Answer

Create an origin access identity (OAI) and attach it to the CloudFront distribution

Answer

Add a security group rule to the ALB that allows traffic only from the CloudFront IP ranges

Question 13

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance cannot connect to the internet. The instance is in a public subnet with a route table that has a route to an internet gateway (IGW). The instance has a public IP assigned. What should the administrator check next?

Accepted Answer

Check the security group rules to ensure outbound traffic is allowed. The instance has a public IP and is in a public subnet with a route to an IGW, so network-level routing and addressing are already configured. The most common remaining cause for no internet connectivity is that the security group's outbound rules are blocking traffic. Security groups are stateful, so even if inbound rules allow return traffic, outbound rules must explicitly permit the instance to initiate connections to the internet (e.g., outbound HTTPS on port 443 or all traffic).

Answer

Verify the network ACL associated with the subnet allows inbound traffic from the internet

Answer

Confirm that the route table has a route to the IGW for 0.0.0.0/0

Answer

Ensure the instance has a public IP address

Question 14

A company has deployed a web application across multiple AWS regions and wants to use Amazon Route 53 to direct users to the region with the lowest latency. Which routing policy should the SysOps administrator use?

Accepted Answer

Latency routing policy. Latency routing policy is correct because it directs user traffic to the AWS region that provides the lowest network latency for the end user. Route 53 measures latency between the user's DNS resolver and each region's edge location, then responds with the IP of the region that has the lowest latency. This is ideal for multi-region deployments where the goal is to minimize response time.

Answer

Geolocation routing policy

Answer

Geoproximity routing policy

Answer

Weighted routing policy

Question 15

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

Accepted Answer

The NAT gateway's subnet does not have a route to an internet gateway. Option C is correct because the NAT gateway must be in a public subnet with an internet gateway route; if the route table for the NAT gateway's subnet does not have a default route to the IGW, the NAT gateway cannot reach the internet. Option A is wrong because security groups for the NAT gateway do not affect internet access; NAT gateways are managed services. Option B is wrong because the private instances need a route to the NAT gateway, not a public IP. Option D is wrong because the NAT gateway is in a public subnet, so the private subnet does not need a public IP.

Answer

The private subnet's network ACL blocks outbound HTTPS traffic

Answer

The security group attached to the NAT gateway does not allow outbound traffic

Answer

The private instances do not have a public IP address assigned