SOA-C02 Networking and Content Delivery Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are benefits of using Amazon CloudFront in front of an Application Load Balancer? (Select TWO.)

Accepted Answer

Protect the application against DDoS attacks. Amazon CloudFront provides AWS Shield Standard automatically, which mitigates common Layer 3/4 DDoS attacks at the edge before traffic reaches the ALB. By absorbing volumetric attacks at CloudFront's globally distributed edge locations, the ALB is shielded from malicious traffic, ensuring application availability. This is a key benefit because ALBs alone do not have built-in DDoS protection beyond basic security group rules.

Answer

Simplify VPC endpoint configuration

Answer

Offload SSL/TLS termination from the ALB

Answer

Provide a static IP address for the application

Question 2

Which THREE of the following are valid options for connecting a VPC to an on-premises network? (Select THREE.)

Accepted Answer

Transit gateway with VPN attachment. A Transit Gateway with a VPN attachment allows you to connect your VPC to an on-premises network by acting as a central hub that interconnects VPCs and on-premises networks via IPsec VPN tunnels. This is a valid option because the Transit Gateway can terminate multiple VPN connections, enabling hybrid connectivity with centralized routing and scalability.

Answer

VPC peering

Answer

VPC endpoint

Question 3

Which TWO of the following are features of Amazon Route 53? (Select TWO.)

Accepted Answer

Health checking of resources. Amazon Route 53 is a DNS web service that provides domain name resolution, domain registration, and health checking of resources. Health checking monitors the availability and performance of endpoints (e.g., web servers) via HTTP/HTTPS/TCP requests, and can automatically failover DNS responses to healthy resources, ensuring high availability.

Answer

SSL/TLS termination

Answer

SSL certificate management

Answer

Content caching at edge locations

Question 4

A company has an Application Load Balancer (ALB) that routes traffic to an Auto Scaling group of EC2 instances. The security group for the ALB allows inbound HTTP traffic from 0.0.0.0/0. The EC2 instances have a security group that allows inbound traffic from the ALB's security group. Users report intermittent 503 errors. What is the most likely cause?

Accepted Answer

The EC2 instances are not passing the ALB health checks.. The 503 Service Unavailable error from an Application Load Balancer typically indicates that the target instances are not healthy and are not passing the configured health checks. When the ALB's health checks fail, it stops routing traffic to those instances, resulting in 503 errors for users. Since the security group configurations appear correct (ALB allows inbound HTTP from 0.0.0.0/0 and EC2 allows traffic from the ALB's security group), the most likely cause is that the EC2 instances are failing health checks due to application-level issues, such as the web server not responding on the health check path or port.

Answer

The ALB is deployed in a private subnet without a NAT gateway.

Answer

The target group is configured with an incorrect protocol or port.

Answer

The security group on the ALB does not allow inbound traffic from the internet.

Question 5

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered together. The VPCs are in the same AWS region. An EC2 instance in VPC A (10.0.1.0/24) cannot ping an EC2 instance in VPC B (10.0.2.0/24). Both VPCs have route tables that include the CIDR of the other VPC with the peering connection as the target. The security groups and network ACLs allow all inbound and outbound traffic. What is the most likely issue?

Accepted Answer

The VPC peering connection is not enabled for DNS resolution.. Although the route tables and security groups/NACLs appear correctly configured, the scenario likely involves pinging by private DNS hostname rather than by IP address. For VPC peering, DNS resolution must be explicitly enabled on the peering connection to allow instances in one VPC to resolve the private DNS hostnames of instances in the peered VPC. Without this setting, a ping by hostname will fail even if ICMP traffic is allowed. The answer assumes the administrator is using private DNS hostnames for the ping.

Answer

The route tables do not have a route to the other VPC's CIDR.

Answer

There is a third VPC C that is peered with both VPC A and VPC B, and VPC A is trying to reach VPC B through VPC C.

Answer

The VPCs are in different AWS regions.

Question 6

A company uses AWS Direct Connect to connect its on-premises data center to AWS. The data center has multiple VLANs that need to connect to separate VPCs in AWS. The company wants to maintain isolation between the VPCs while maximizing bandwidth utilization. Which solution should the SysOps administrator recommend?

Accepted Answer

Configure a single Direct Connect connection with multiple private virtual interfaces, each tagged with a different VLAN ID and associated with a different VPC.. A single Direct Connect connection can support multiple private virtual interfaces (VIFs), each tagged with a unique 802.1Q VLAN ID. This allows the on-premises data center to connect to separate VPCs while maintaining traffic isolation via VLAN tagging, and it maximizes bandwidth utilization by sharing the single connection's capacity across all VIFs.

Answer

Use AWS Transit Gateway to connect all VPCs and the Direct Connect gateway, then configure route tables to isolate traffic.

Answer

Provision multiple Direct Connect connections, one for each VPC, and use a different VLAN on each connection.

Answer

Establish a single Direct Connect connection and use IPsec VPN tunnels over it to connect to each VPC.

Question 7

A company hosts a static website on Amazon S3 with public read access enabled. The website is accessed via a custom domain name that uses Amazon Route 53. The domain name points to the S3 bucket's website endpoint. Users report that they can access the website using the S3 bucket URL but not the custom domain name. What is the most likely cause?

Accepted Answer

The Route 53 alias record points to the S3 bucket's regional endpoint instead of the website endpoint.. The most likely cause is that the Route 53 alias record points to the S3 bucket's regional endpoint (e.g., s3.us-east-1.amazonaws.com) instead of the website endpoint (e.g., bucket-name.s3-website-us-east-1.amazonaws.com). To serve a static website, an S3 bucket must be configured for static website hosting, and the alias record must point to the S3 website endpoint. The regional endpoint is used for direct API access, not for website hosting. Option A is incorrect because public read access is enabled, so the bucket policy allows access. Option B is incorrect because the issue is DNS resolution, not HTTPS; S3 website endpoints support HTTP. Option D is incorrect because DNS propagation delays are unlikely to cause complete failure to resolve; the alias record type is the issue.

Answer

The S3 bucket policy does not allow public access.

Answer

The website does not support HTTPS and the browser blocks it.

Answer

The DNS TTL is too long and the changes have not propagated.

Question 8

A company deploys a web application on EC2 instances behind an Application Load Balancer. The SysOps administrator needs to allow inbound traffic only from the ALB to the EC2 instances. Currently, the EC2 security group allows inbound HTTP from 0.0.0.0/0. Which security group configuration should the administrator apply?

Accepted Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's security group.. The best practice is to reference the ALB's security group ID in the EC2 security group's inbound rule, allowing traffic from that security group. Option A is incorrect because 0.0.0.0/0 allows all traffic, defeating the purpose. Option C is incorrect because the ALB's private IPs can change. Option D is incorrect because the ALB's public IPs are not fixed and should not be used.

Answer

Keep the existing rule that allows inbound HTTP from 0.0.0.0/0, but add a network ACL to block traffic from the internet.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's private IP addresses.

Answer

Modify the EC2 security group to allow inbound HTTP from the ALB's public IP addresses.

Question 9

A company uses Amazon CloudFront to distribute content to users worldwide. The origin is an Application Load Balancer (ALB) that routes to EC2 instances. The SysOps administrator notices that some users are receiving cached responses even though the content has been updated on the origin. The administrator needs to ensure that users always receive the latest version of the content. What should the administrator do?

Accepted Answer

Use CloudFront cache invalidation to remove the old objects after updating the origin.. To ensure users always receive the latest content after updating the origin, the most effective method in CloudFront is to create a cache invalidation request to remove the old cached objects. The other options are not appropriate: Option A (sending Cache-Control: no-cache from the ALB) would require CloudFront to always revalidate with the origin, which increases load and latency, and does not affect existing cached objects. Option B (using Lambda@Edge to change the origin request path) could be used for versioned URLs, but simply changing the path does not invalidate existing cache. Option D (reducing TTL to 0 seconds) would cause all requests to go to the origin, defeating the purpose of CloudFront and increasing origin load, and still does not clear existing cached objects.

Answer

Configure the ALB to send a Cache-Control: no-cache header.

Answer

Set up a Lambda@Edge function to change the origin request path.

Answer

Reduce the CloudFront TTL to 0 seconds.

Question 10

A SysOps administrator needs to create a VPC with both public and private subnets. The public subnet will host a NAT gateway and a bastion host. The private subnet will host application servers that need outbound internet access for updates. Which routing configuration should the administrator implement?

Accepted Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> NAT Gateway.. The correct configuration is: Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> NAT Gateway. The public subnet needs direct internet access for the NAT gateway and bastion host, so it routes to the Internet Gateway (IGW). The private subnet needs outbound internet access for updates but should not be directly reachable from the internet, so it routes to the NAT Gateway, which resides in the public subnet and translates private IPs to the public IP of the NAT gateway. Option A is incorrect because the private subnet should route directly to the NAT gateway, not via the IGW. Option B is incorrect because it gives private instances direct internet access, bypassing the NAT gateway and exposing them. Option C is incorrect because it sends public subnet traffic to the NAT gateway, but the NAT gateway itself requires internet access through the IGW; the public subnet should route to the IGW directly.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway via the NAT Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> Internet Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

Answer

Public subnet route table: 0.0.0.0/0 -> NAT Gateway; Private subnet route table: 0.0.0.0/0 -> Internet Gateway.

Question 11

A company has an internal Application Load Balancer (ALB) in a VPC. The ALB is used by an on-premises application via AWS Direct Connect. The on-premises application needs to resolve the ALB's DNS name. The VPC has Route 53 private hosted zone associated with the VPC. The on-premises DNS servers are configured to forward queries for the company's domain to the VPC's Route 53 inbound resolver endpoints. However, the on-premises application cannot resolve the ALB's DNS name. What is the likely cause?

Accepted Answer

The ALB's DNS name is not in the Route 53 private hosted zone.. The ALB is internal, meaning it does not have a public IP address but it still has a public DNS name (e.g., internal-alb-123456789.elb.amazonaws.com) that resolves to its private IP addresses within the VPC. The Route 53 private hosted zone is associated with the VPC and contains DNS records only for the company's custom domain (e.g., example.com). The on-premises DNS servers forward queries for the company's domain to the Route 53 inbound resolver, but the ALB's DNS name is not within that domain, so the resolver cannot resolve it. Therefore, the on-premises application cannot resolve the ALB's DNS name because it is not listed in the private hosted zone. Options A, B, and D are incorrect: A involves security groups which affect traffic, not DNS; B incorrectly claims internal ALBs don't have a DNS name; D is irrelevant because the inbound resolver is specifically for the private hosted zone domain, not for public DNS resolution.

Answer

The ALB's security group blocks inbound traffic from the on-premises CIDR.

Answer

The ALB is internal and does not have a public DNS name.

Answer

The Route 53 inbound resolver is not configured to forward queries to the public internet.

Question 12

A company is using Amazon CloudFront with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible via CloudFront. The SysOps administrator has configured an Origin Access Identity (OAI) and updated the bucket policy to allow access only to the OAI. However, users are still able to access the S3 bucket directly via the S3 URL. What is the most likely reason?

Accepted Answer

The bucket policy allows public read access in addition to the OAI access.. The most likely reason users can still access the S3 bucket directly is that the bucket policy allows public read access in addition to the Origin Access Identity (OAI) access. Even though the OAI restricts CloudFront access, if the bucket policy also grants public read access, users can bypass CloudFront and access the bucket directly via its S3 URL. For the OAI to effectively prevent direct access, the bucket policy must deny all principals except the OAI. Option A is incorrect because requiring the OAI via a condition is not the issue; the policy must explicitly deny other access. Option C is incorrect because if the OAI were not properly associated, CloudFront would fail to access the bucket, but the problem is that users can still access the bucket directly. Option D is incorrect because configuring the bucket as a static website does not inherently allow direct access; the bucket policy still governs access.

Answer

The bucket policy does not include a condition to require the OAI.

Answer

The OAI is not properly associated with the CloudFront distribution.

Answer

The S3 bucket is configured as a static website.

Question 13

Which TWO actions should a SysOps administrator take to improve the availability and reduce latency for a web application hosted on EC2 instances behind an Application Load Balancer?

Accepted Answer

Implement Auto Scaling to add instances based on CPU utilization.. Auto Scaling based on CPU utilization dynamically adjusts the number of EC2 instances to match demand, improving availability by ensuring sufficient capacity during traffic spikes and reducing latency by distributing load across more instances. Option E is correct because deploying EC2 instances in multiple Availability Zones (AZs) provides fault tolerance: if one AZ fails, the ALB continues routing traffic to healthy instances in other AZs, which also reduces latency by serving users from the closest AZ.

Answer

Use larger EC2 instance types to handle more traffic.

Answer

Configure the ALB health check to have a shorter interval.

Answer

Use an Amazon CloudFront distribution in front of the ALB to cache content at edge locations.

Question 14

Which THREE configurations are required to enable an EC2 instance in a private subnet to access the internet for software updates while preventing inbound internet traffic?

Accepted Answer

Attach an Internet Gateway to the VPC.. An Internet Gateway (IGW) is required for any VPC to enable internet connectivity. Without an IGW, traffic cannot leave or enter the VPC from the internet. For a private subnet EC2 instance to reach the internet for software updates, the VPC must have an IGW attached, and the NAT Gateway (placed in a public subnet) uses the IGW to forward outbound traffic while blocking inbound connections.

Answer

Assign an Elastic IP address to the EC2 instance.

Answer

Deploy a bastion host in the private subnet.

Question 15

Which TWO are valid methods to secure traffic between a client and an Application Load Balancer?

Accepted Answer

Configure a listener on port 443 with an SSL certificate from AWS Certificate Manager.. Configuring a listener on port 443 with an SSL certificate from ACM enables TLS encryption between the client and the ALB. Option B is also correct: using a security group that only allows HTTPS traffic enforces that all traffic must be encrypted, securing the communication by blocking unencrypted HTTP traffic. Options C, D, and E are incorrect: IPsec VPN is not terminated on an ALB (C), network ACLs do not provide encryption (D), and SSL/TLS encryption requires a valid certificate (E).

Answer

Set up an IPsec VPN connection between the client and the ALB.

Answer

Configure a network ACL to allow only port 443.

Answer

Enable the ALB's built-in SSL/TLS encryption without a certificate.