SOA-C02 Networking and Content Delivery Practice Test 5 — 15 Questions

Question 1

A SysOps administrator is configuring Amazon CloudFront to serve content from an Amazon S3 bucket. The content is sensitive and should be encrypted at rest. Which option ensures that content is encrypted at rest in S3?

Accepted Answer

Enable server-side encryption (SSE-S3) on the S3 bucket. Option D is correct because enabling SSE-S3 on the S3 bucket encrypts objects at rest. CloudFront does not handle encryption at rest. Option A is wrong because CloudFront does not provide encryption at rest; it encrypts data in transit. Option B is wrong because field-level encryption is for encrypting specific fields at the edge. Option C is wrong because signed URLs control access, not encryption at rest.

Answer

Enable CloudFront HTTPS-only access to the S3 bucket

Answer

Configure signed URLs for the distribution

Answer

Use CloudFront field-level encryption

Question 2

Which TWO actions can a SysOps administrator take to improve the availability of a web application using an Application Load Balancer (ALB) and EC2 instances? (Choose two.)

Accepted Answer

Configure health checks on the target group. Options B and C are correct: Deploying EC2 instances in multiple Availability Zones provides high availability, and configuring health checks allows the ALB to route traffic only to healthy instances. Option A is wrong because using a larger instance type improves performance, not availability. Option D is wrong because a single subnet is a single point of failure. Option E is wrong because increasing the deregistration delay does not improve availability; it only affects connection draining.

Answer

Place all instances in a single subnet to reduce latency

Answer

Use larger instance types to handle more traffic

Answer

Increase the deregistration delay (connection draining) timeout

Question 3

Which THREE components are required to establish a site-to-site VPN connection between an AWS VPC and an on-premises network? (Choose three.)

Accepted Answer

Customer gateway (CGW). Options A, C, and D are correct. A virtual private gateway is the VPN concentrator on the AWS side. A customer gateway represents the on-premises VPN device. A VPN connection ties them together with IPsec tunnels. Option B is wrong because a transit gateway is not required; it is used for complex network topologies. Option E is wrong because Direct Connect is a dedicated physical connection, not part of a VPN.

Answer

Transit gateway

Answer

AWS Direct Connect

Question 4

Which TWO features are provided by Amazon CloudFront to secure content delivery? (Choose two.)

Accepted Answer

AWS WAF integration to filter requests based on rules. Options A and C are correct: AWS WAF integration with CloudFront allows you to filter malicious requests, and signed URLs/cookies provide access control to content. Option B is wrong because CloudFront supports custom SSL certificates via SNI or dedicated IP, not by default. Option D is wrong because CloudFront uses the AWS global network, not a VPN. Option E is wrong because CloudFront does not provide DDoS protection by default; AWS Shield is the DDoS protection service.

Answer

Default support for custom SSL certificates without additional configuration

Answer

AWS Shield Advanced for DDoS protection

Answer

VPN connection between CloudFront and the origin

Question 5

Refer to the exhibit. A SysOps administrator created this S3 bucket policy to allow CloudFront to access objects in the bucket using an origin access identity (OAI). However, users are still receiving 403 Access Denied errors when accessing the CloudFront distribution. What is the most likely cause?

Accepted Answer

The S3 bucket has Block Public Access settings enabled that deny all access. Option B is correct because the bucket policy only grants read access to the OAI, but if the bucket itself has Block Public Access settings enabled, it can override the policy and deny access. Option A is wrong because the OAI ARN is correctly formatted. Option C is wrong because CloudFront can use the OAI with S3 regardless of region. Option D is wrong because the distribution domain name does not affect the OAI access.

Answer

The CloudFront distribution uses the S3 bucket's regional domain name instead of the distribution domain name

Answer

The CloudFront distribution is in a different region than the S3 bucket

Answer

The OAI ARN in the policy is incorrect

Question 6

Refer to the exhibit. A SysOps administrator is troubleshooting internet connectivity for an EC2 instance in subnet subnet-0a1b2c3d4e5f6g7h8. The instance can reach other instances in the VPC but cannot access the internet. Based on the route table output, what is the most likely cause?

Accepted Answer

The NAT gateway does not have a route to an internet gateway. Option C is correct because the route table has a default route to a NAT gateway, but the exhibit does not show that the NAT gateway is in a public subnet with an internet gateway route. If the NAT gateway lacks internet access, private instances cannot reach the internet. Option A is wrong because the route table is associated with the subnet. Option B is wrong because the route exists. Option D is wrong because the VPC CIDR is local, which is fine.

Answer

The default route (0.0.0.0/0) is missing

Answer

The route table is not associated with the subnet

Answer

The VPC CIDR route is misconfigured

Question 7

Refer to the exhibit. A SysOps administrator runs the describe-target-health command and sees that an EC2 instance in the target group is unhealthy with a timeout error. What is the most likely cause?

Accepted Answer

The instance's security group does not allow traffic from the ALB on the health check port. Option B is correct because the health check is timing out, which indicates that the instance is not responding to health check requests on port 80. The security group must allow inbound traffic from the ALB on the health check port. Option A is wrong because the target group is configured with port 80, which matches. Option C is wrong because the route table is less likely to cause a timeout; it would cause unreachability. Option D is wrong because the instance is in a public subnet? Not necessarily; but the health check timeout is most often a security group issue.

Answer

The target group is configured with an incorrect port

Answer

The instance is in a private subnet without a NAT gateway

Answer

The instance does not have a route to the internet

Question 8

A company is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to maintain user session state. Which configuration ensures session stickiness with minimal performance impact?

Accepted Answer

Enable sticky sessions on the Application Load Balancer using a load balancer-generated cookie.. Option B is correct because ALB sticky sessions use a cookie to bind a user's session to a specific target, which is the simplest and most efficient method. Option A is incorrect because an NLB does not natively support sticky sessions with cookies. Option C is incorrect because DynamoDB would add latency and complexity. Option D is incorrect because CloudFront is for content delivery, not session stickiness.

Answer

Use Amazon CloudFront with origin stickiness enabled.

Answer

Use a Network Load Balancer (NLB) with target group stickiness.

Answer

Store session state in Amazon DynamoDB and have each instance read from DynamoDB.

Question 9

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

Accepted Answer

The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.. Option C is correct because ALB health checks originate from the ALB's private IP addresses within the VPC, not from the internet or the ALB's public IP. If the subnet's network ACL does not allow inbound traffic from the ALB's subnet CIDR, health checks will fail. Option A is incorrect because security groups are stateful; return traffic is allowed automatically. Option B is incorrect because the ALB can communicate within the VPC without an internet gateway. Option D is incorrect because the ALB uses its own security group, not the instance's.

Answer

The instance security group does not allow outbound traffic to the ALB.

Answer

The ALB security group does not allow outbound traffic to the instances.

Answer

The ALB is in a public subnet without an internet gateway.

Question 10

A company wants to provide low-latency access to static content (images, CSS) for global users. The content is stored in an S3 bucket. Which service should be used to cache content at edge locations?

Accepted Answer

Amazon CloudFront. Option A is correct because Amazon CloudFront is a CDN that caches content at edge locations for low-latency delivery. Option B is incorrect because S3 Transfer Acceleration speeds up uploads, not downloads. Option C is incorrect because Global Accelerator improves TCP/UDP performance but does not cache content. Option D is incorrect because ElastiCache is a caching layer for databases, not for static content delivery.

Answer

Amazon ElastiCache

Answer

S3 Transfer Acceleration

Answer

AWS Global Accelerator

Question 11

An application running on EC2 instances sends large amounts of data to an S3 bucket. The SysOps administrator wants to reduce data transfer costs while ensuring the traffic stays within AWS. What is the most cost-effective solution?

Accepted Answer

Create a VPC Endpoint for S3 (Gateway type) and use it from the EC2 instances.. Option B is correct because using a VPC Endpoint for S3 allows traffic to stay within the AWS network, avoiding internet data transfer costs. Option A is incorrect because NAT Gateways incur charges for data processing and transfer. Option C is incorrect because S3 Transfer Acceleration is for faster uploads, not cost savings. Option D is incorrect because Direct Connect is a dedicated connection that incurs monthly fees and is overkill for this use case.

Answer

Set up an AWS Direct Connect connection.

Answer

Use S3 Transfer Acceleration.

Answer

Route traffic through a NAT Gateway in a public subnet.

Question 12

A SysOps administrator is troubleshooting connectivity issues between two VPCs in different AWS Regions. Both VPCs are connected via a VPC Peering connection. The route tables in both VPCs have routes pointing to the peering connection. Security groups allow all traffic. However, an EC2 instance in VPC A cannot ping an EC2 instance in VPC B. What is the most likely cause?

Accepted Answer

The route tables in the subnets where the instances reside do not include a route to the peered VPC's CIDR.. Option D is correct because VPC Peering does not support transitive routing; each VPC must have explicit routes to the other VPC's CIDR. If the route tables are correctly configured, the issue is likely that the instances do not have the other VPC's CIDR in their route tables. Option A is incorrect because VPC Peering works across regions. Option B is incorrect because the security groups can reference each other if the peered VPC's CIDR is added, but not by security group ID across regions. Option C is incorrect because NACLs are stateless and need rules for both directions.

Answer

The network ACLs in subnets are blocking ICMP traffic.

Answer

VPC Peering is not supported across AWS Regions.

Answer

The security groups do not allow traffic from the peered VPC's security group ID.

Question 13

A company has an application that requires UDP traffic to be distributed across multiple EC2 instances. Which AWS load balancer type should be used?

Accepted Answer

Network Load Balancer. Option C is correct because Network Load Balancer (NLB) supports UDP traffic. Application Load Balancer (ALB) only supports HTTP/HTTPS. Option A is incorrect because ALB does not support UDP. Option B is incorrect because Classic Load Balancer supports TCP/SSL but not UDP. Option D is incorrect because CloudFront is a CDN, not a load balancer.

Answer

Classic Load Balancer

Answer

Amazon CloudFront

Answer

Application Load Balancer

Question 14

A company has a VPC with public and private subnets. An EC2 instance in a private subnet needs to download software patches from the internet. Which component should be used to provide internet access to the instance?

Accepted Answer

NAT Gateway in a public subnet. Option B is correct because a NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet while preventing inbound traffic. Option A is incorrect because an Internet Gateway is used for public subnets, not private. Option C is incorrect because a VPC Endpoint is for accessing AWS services privately. Option D is incorrect because a VPN connection is for on-premises connectivity, not internet access.

Answer

AWS Site-to-Site VPN

Answer

Internet Gateway attached to the VPC

Answer

VPC Endpoint for Amazon S3

Question 15

A SysOps administrator is configuring an Application Load Balancer to route traffic to multiple target groups based on the URL path. The ALB is not routing traffic correctly. Which listener rule configuration should be used to route requests with path /api/* to target group A and all other requests to target group B?

Accepted Answer

Create a rule with path pattern /api/* and forward to target group A with priority 10, and a default rule with path pattern /* and forward to target group B with priority 20.. Option C is correct because the ALB listener rules are evaluated in order; the first rule with a path pattern /api/* will match, and then a default rule (catch-all) is needed for all other paths. Option A is incorrect because order is not automatically prioritized by pattern. Option B is incorrect because a single rule cannot have two conditions with different paths to different target groups. Option D is incorrect because wildcards are not allowed in condition keys.

Answer

Create a rule with a host header condition matching 'api.example.com' and forward to target group A, and a default rule forward to target group B.

Answer

Create one rule with a condition that matches /api/* and forward to target group A, and another condition in the same rule for /* to forward to target group B.

Answer

Create two rules with path patterns /api/* and /*, and set priority based on the pattern length.