SOA-C02 Networking and Content Delivery Practice Test 4 — 15 Questions

Question 1

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The SysOps administrator receives reports that some users are experiencing intermittent HTTP 503 errors. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The health checks are failing for the target group, causing the ALB to stop sending traffic to all instances.. HTTP 503 errors from an Application Load Balancer typically indicate that the target group has no healthy registered targets. When health checks fail for all instances in the target group, the ALB cannot route traffic to any backend, resulting in a 503 response. This is the most common cause of intermittent 503 errors in ALB architectures.

Answer

The security group attached to the ALB does not allow inbound traffic on port 443.

Answer

The EC2 instances do not have the correct IAM role to register with the ALB.

Answer

The ALB idle timeout is set too low.

Question 2

A SysOps administrator is configuring a VPC with a public subnet and a private subnet. The private subnet needs to access the internet to download patches. The administrator creates a NAT Gateway in the public subnet and updates the private subnet route table. However, instances in the private subnet cannot reach the internet. What is the most likely cause?

Accepted Answer

The route table for the public subnet does not have a route to an Internet Gateway.. For a NAT Gateway in a public subnet to provide internet access to private-subnet instances, the public subnet's route table must have a route to an Internet Gateway (0.0.0.0/0 → igw-xxxx). The NAT Gateway itself needs that IGW path to reach the internet on behalf of the private instances. If the public subnet route table lacks the IGW route, the NAT Gateway cannot forward traffic, and private instances time out even though their own route table correctly points to the NAT Gateway.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address attached.

Answer

The security group associated with the NAT Gateway blocks outbound traffic.

Question 3

Refer to the exhibit. A VPC peering connection exists between VPC A (CIDR 10.0.0.0/16) and VPC B (CIDR 192.168.0.0/16). The command output shows the route table for VPC A (rtb-11111111) and VPC B (rtb-33333333). An instance in VPC A (private IP 10.0.1.5) cannot ping an instance in VPC B (private IP 192.168.1.10). What is the most likely reason?

Accepted Answer

The route table for VPC A is missing a route to 192.168.0.0/16 via the peering connection.. For VPC peering to work, both VPC route tables must have explicit routes pointing to the peering connection for the peer's CIDR block. If VPC A's route table lacks a route to 192.168.0.0/16 via the peering connection, traffic from 10.0.1.5 cannot be routed to VPC B, causing the ping to fail. The exhibit shows the route table for VPC A, and the missing route is the most likely cause.

Answer

The security group for the instance in VPC B blocks ICMP traffic.

Answer

The VPC peering connection status is not active.

Answer

The network ACL for the subnet in VPC A blocks outbound ICMP.

Question 4

Refer to the exhibit. A SysOps administrator has attached the bucket policy shown to an S3 bucket. Users from the IP range 192.0.2.0/24 report that they can access objects, but users from other IP ranges also report they can access objects. What is the most likely reason?

Accepted Answer

The bucket ACL allows public read access, overriding the bucket policy Deny.. S3 bucket policies and bucket ACLs are evaluated together, and an explicit Allow in either can grant access unless an explicit Deny in the bucket policy overrides it. If the ACL grants public read (e.g., AllUsers READ), users outside 192.0.2.0/24 can still access objects even though the bucket policy appears to restrict them. The most likely cause is therefore that the ACL is granting broader access than the policy intends.

Answer

The bucket is not configured to use the bucket policy.

Answer

The bucket policy is malformed and is not being applied.

Answer

The Condition element in the Allow statement is incorrectly formatted.

Question 5

A company has a VPC with public and private subnets. The public subnet has a NAT Gateway. The private subnet has an EC2 instance that needs to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instance cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT Gateway is deployed in a private subnet.. A NAT Gateway must be deployed in a public subnet with a route to an Internet Gateway. If the NAT Gateway is in a private subnet, it cannot access the internet, and thus the instances in the private subnet cannot reach the internet via it. Option A is incorrect because network ACLs by default allow all outbound traffic; even if they block HTTP, the instance might still reach other services, but the core issue is the NAT Gateway placement. Option B is incorrect because security groups by default allow all outbound traffic; unless explicitly modified, outbound is not blocked. Option D is incorrect because while a NAT Gateway does require an Elastic IP to communicate with the internet, the more fundamental and likely cause is that the NAT Gateway is in a private subnet, which renders it non-functional regardless of Elastic IP.

Answer

The network ACL for the private subnet blocks outbound HTTP traffic.

Answer

The security group of the EC2 instance blocks outbound traffic.

Answer

The NAT Gateway does not have an Elastic IP address.

Question 6

A SysOps Administrator is configuring a VPC with a public subnet and a private subnet. The public subnet has an Internet Gateway. An EC2 instance in the private subnet needs to access an S3 bucket. What is the MOST secure way to provide this access?

Accepted Answer

Create a VPC Gateway Endpoint for S3 in the private subnet's route table.. A VPC Gateway Endpoint for S3 allows instances in a private subnet to access S3 privately without traversing the internet, using AWS's internal network. This is the most secure method as it avoids exposing the private subnet to the public internet or requiring a NAT Gateway, and it leverages AWS PrivateLink for direct, low-latency connectivity.

Answer

Attach an Internet Gateway to the private subnet.

Answer

Use a VPC peering connection to an S3 bucket.

Answer

Create a NAT Gateway in the public subnet and route traffic through it.

Question 7

A SysOps Administrator needs to monitor network traffic in a VPC. Which AWS service provides packet-level information about IP traffic?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture metadata about IP traffic flowing through network interfaces in a VPC, including source/destination IP addresses, ports, protocols, and packet-level details such as packet counts and byte counts. This provides the packet-level information needed for network traffic analysis, unlike higher-level logging services.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 8

A SysOps Administrator is troubleshooting an issue where an Application Load Balancer (ALB) returns 502 Bad Gateway errors. Which THREE are possible causes? (Choose THREE.)

Accepted Answer

The ALB is configured with a different HTTP method than the target expects.. Option C is correct because a 502 Bad Gateway occurs when the ALB successfully connects to the target but the target returns a response the ALB cannot process, such as an HTTP method mismatch (e.g., ALB sends GET while the application only accepts POST), causing the target to reset or return an invalid response. Option D is correct because if the target instance's security group does not permit inbound traffic from the ALB's security group or subnet CIDR on the target port, the ALB's connection attempt is blocked, resulting in a 502 error. Option E is also correct (and is one of the three expected answers) because when a target group has no healthy instances, the ALB has no backend to forward requests to, producing 502 Bad Gateway responses. Option A is incorrect because a target response exceeding the idle timeout typically causes a 504 Gateway Timeout, not a 502. Option B is incorrect because a URL path mismatch would result in a 404 Not Found from the application, not a 502.

Answer

The target instance is taking too long to respond (e.g., more than the idle timeout).

Answer

The target instance is configured to respond to a different URL path.

Answer

The target group has no healthy instances.

Question 9

Refer to the exhibit. An EC2 instance is registered with an ALB target group. The health check returns 502. What is the most likely cause?

Accepted Answer

The web server on the instance is returning an HTTP 502 response.. A 502 Bad Gateway from the ALB indicates that the target responded with an invalid or empty HTTP response, which is usually caused by the web server on the instance returning an HTTP 502 error. Option A is wrong because a network ACL blocking traffic would result in a connection timeout (504) or unreachable error, not a 502. Option B is wrong: if the instance were not registered, the ALB would not perform health checks on it; the fact that a health check is failing shows the instance is registered. Option D is wrong: a mismatch between HealthCheck protocol (HTTPS) and instance support (HTTP) would cause the ALB to fail to establish a TLS connection, resulting in a 504 Gateway Timeout or a connection error, not a 502.

Answer

The instance is not reachable from the ALB due to a network ACL.

Answer

The instance is not registered with the target group.

Answer

The health check path is configured for HTTPS but the instance only supports HTTP.

Question 10

A company's web application uses an Application Load Balancer (ALB) in front of multiple EC2 instances in an Auto Scaling group. Users report intermittent 503 errors. The ALB health checks are configured to check the /health endpoint every 30 seconds with a threshold of 2 successful checks to mark healthy. The Auto Scaling group’s health check grace period is set to 60 seconds. What is the most likely cause of the 503 errors?

Accepted Answer

The health check endpoint is returning a 500 status code intermittently.. 503 errors from an ALB occur when all healthy targets are unavailable. If the /health check endpoint intermittently returns a 500 status code, the ALB considers those instances unhealthy and stops routing traffic to them, resulting in 503 errors. Option A is incorrect because the ALB idle timeout affects idle connections, not health check failures. Option B is incorrect because the health check grace period is only relevant during instance launch; it does not affect ongoing health checks. Option C is incorrect while overloaded instances can cause performance degradation, the specific intermittent 503 errors point to health check failures rather than resource exhaustion.

Answer

The ALB’s idle timeout is set too low.

Answer

The Auto Scaling group health check grace period is too short.

Answer

The EC2 instances are of a small instance type and are overloaded.

Question 11

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet. Private EC2 instances need to download patches from the internet. The route table for the private subnet has a default route (0.0.0.0/0) pointing to the NAT Gateway. However, the instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The NAT Gateway is not placed in a public subnet with a route to an internet gateway.. A NAT Gateway must be deployed in a public subnet that has a route to an internet gateway. Although the private subnet's route table points to the NAT Gateway for default traffic, if the NAT Gateway's subnet lacks a route to an internet gateway, the NAT Gateway cannot forward traffic to the internet. Option A is incorrect because network ACLs could block traffic, but the stated issue—instances cannot reach the internet via a properly configured route—points to the NAT Gateway's subnet configuration as the most likely cause. Option C is incorrect because even if the private instances' security group allows outbound HTTPS, the NAT Gateway still needs internet connectivity. Option D is incorrect because while a NAT Gateway requires an Elastic IP address, the scenario assumes the NAT Gateway is deployed; typically, an Elastic IP is assigned during creation, so the missing route to the internet gateway is the more probable cause.

Answer

The private subnet’s network ACL is blocking outbound traffic.

Answer

The security group for the private instances does not allow outbound HTTPS.

Answer

The NAT Gateway does not have an Elastic IP address assigned.

Question 12

A SysOps administrator needs to monitor the amount of data transferred through a VPC’s internet gateway. Which Amazon CloudWatch metric should be used?

Accepted Answer

NetworkIn (AWS/EC2 namespace). The correct metric is NetworkIn under the AWS/EC2 namespace, which measures the number of bytes received by an EC2 instance from the network, including traffic from the internet gateway. BytesOutToSource is not a valid CloudWatch metric for internet gateways; the only available metrics in the AWS/VPC namespace are for NAT gateways, not internet gateways. Options A and D are invalid. Option B measures packets, not bytes, and is less appropriate for monitoring data transfer volume.

Answer

InternetGatewayBytes (AWS/VPC namespace)

Answer

NetworkPackets (AWS/EC2 namespace)

Answer

BytesOutToSource (AWS/VPC namespace)

Question 13

A SysOps administrator is troubleshooting an issue where an EC2 instance in a private subnet cannot connect to the internet. The instance has a security group allowing outbound HTTPS traffic. The subnet’s route table has a default route (0.0.0.0/0) to a NAT Gateway. The NAT Gateway is in a public subnet with an Elastic IP and a route to an internet gateway. What is a likely cause of the issue?

Accepted Answer

The subnet’s network ACL is blocking outbound ephemeral ports.. The most likely cause is that the subnet's network ACL is blocking outbound traffic on ephemeral ports. When an instance initiates a connection to the internet via a NAT Gateway, the return traffic comes back on ephemeral ports (1024-65535). Network ACLs are stateless, so they must explicitly allow outbound and inbound traffic on these ports. If the NACL does not allow outbound ephemeral ports, the instance cannot establish connections.

Answer

The NAT Gateway does not have an Elastic IP.

Answer

The private subnet has a route to an internet gateway.

Answer

The security group is blocking inbound traffic from the NAT Gateway.

Question 14

Which TWO methods can be used to secure an S3 bucket that is used as an origin for Amazon CloudFront? (Select two.)

Accepted Answer

Write a bucket policy that allows only the CloudFront distribution’s OAI.. Option A is correct because a bucket policy can explicitly allow s3:GetObject only to the CloudFront origin access identity (OAI) principal, effectively blocking direct public access while permitting CloudFront to fetch objects. Option D is correct because configuring an OAI and then restricting bucket access (via the bucket policy or ACLs) is the standard mechanism that ties the S3 origin to the specific CloudFront distribution, preventing users from bypassing CloudFront. Option B is incorrect because granting public read access via bucket ACLs exposes the bucket directly and defeats the purpose of securing the origin. Option C is incorrect because server-side encryption protects data at rest but does not restrict who can retrieve objects from the bucket. Option E is incorrect because pre-signed URLs are for granting time-limited access to individual objects, not for securing a CloudFront origin, and they would not integrate with CloudFront's OAI model.

Answer

Use bucket ACLs to grant public read access.

Answer

Enable S3 server-side encryption.

Answer

Generate pre-signed URLs for all objects.

Question 15

Refer to the exhibit. A SysOps administrator is troubleshooting connectivity issues for a web application that uses an ALB. The ALB sends health check requests to targets on port 443. The network ACL shown is associated with the target subnet. Based on the exhibit, what is causing the health checks to fail?

Accepted Answer

The network ACL allows inbound HTTPS (443) from 0.0.0.0/0, which includes the ALB, so this should work. The issue is likely elsewhere.. The network ACL has an inbound rule (Rule 120) that denies all traffic (protocol -1) after allowing specific ports. However, health checks originate from the ALB's private IP addresses, which are not 0.0.0.0/0? Actually, the ALB's health check traffic comes from the ALB's subnet IPs, which might be in the same VPC or different? The NACL rule 100 allows TCP 443 from 0.0.0.0/0, which should include the ALB's IPs. But the deny rule 120 will block traffic not matching the allow rules. However, health check traffic on port 443 should be allowed by rule 100. The issue might be that the NACL is stateless, and the ephemeral ports for response are not allowed. But the question is about health checks failing. Option B is wrong because the ALB does not send health checks on port 80 unless configured. Option C is wrong because health checks originate from ALB, not internet. Option D is wrong because the NACL allows inbound 443 from 0.0.0.0/0.

Answer

The network ACL does not allow inbound traffic from the ALB on ephemeral ports.

Answer

The network ACL is blocking inbound traffic from the internet, but health checks come from the ALB.

Answer

The network ACL does not allow inbound HTTP (port 80) from the ALB.