SOA-C02 Networking and Content Delivery Practice Test 6 — 15 Questions

Question 1

A company has multiple VPCs in the same account that need to communicate with each other. The VPCs are in the same region. Which solution provides the simplest and most scalable connectivity?

Accepted Answer

Create a Transit Gateway and attach all VPCs.. Option A is correct because a Transit Gateway allows you to connect multiple VPCs and on-premises networks through a central hub, simplifying management. Option B is incorrect because VPC Peering is a one-to-one connection and becomes complex with many VPCs. Option C is incorrect because Direct Connect is for on-premises connectivity, not VPC-to-VPC. Option D is incorrect because PrivateLink is for exposing services, not general VPC connectivity.

Answer

Set up AWS Direct Connect and route through a single VPC.

Answer

Use AWS PrivateLink to connect the VPCs.

Answer

Create VPC Peering connections between each pair of VPCs.

Question 2

A SysOps administrator needs to ensure high availability for a web application running on EC2 instances across multiple Availability Zones. Which TWO actions should the administrator take?

Accepted Answer

Launch EC2 instances in at least two different Availability Zones.. Options A and C are correct. Distributing instances across multiple AZs and registering them with a load balancer that routes to healthy instances ensures high availability. Option B is incorrect because a single instance in one AZ is a single point of failure. Option D is incorrect because EBS volumes are tied to a single AZ. Option E is incorrect because CloudFront does not replace a load balancer for high availability.

Answer

Place a CloudFront distribution in front of the instances.

Answer

Launch all EC2 instances in a single Availability Zone for consistency.

Answer

Attach an EBS volume to each instance and replicate data in real-time.

Question 3

A company has a VPC with a public subnet and a private subnet. The private subnet hosts a database. Which TWO components are required to allow an EC2 instance in the public subnet to connect to the database?

Accepted Answer

A network ACL rule on the private subnet allowing inbound traffic from the public subnet CIDR.. Options A and D are correct. The security group of the database must allow inbound traffic from the EC2 instance's security group or IP, and the network ACL of the private subnet must allow inbound traffic from the public subnet. Option B is incorrect because a NAT Gateway is for outbound internet, not inbound. Option C is incorrect because an Internet Gateway is for internet traffic, not VPC internal traffic. Option E is incorrect because a VPC Endpoint is for accessing AWS services, not EC2-to-RDS.

Answer

A NAT Gateway in the public subnet.

Answer

An Internet Gateway attached to the VPC.

Answer

A VPC Endpoint for the database service.

Question 4

A company is using Amazon CloudFront to deliver content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which TWO steps should be taken?

Accepted Answer

Configure the S3 bucket policy to grant the OAI s3:GetObject permission.. Options A and C are correct. Creating an Origin Access Identity (OAI) and granting it read access to the S3 bucket, then configuring the bucket policy to deny all other principals, ensures only CloudFront can access the content. Option B is incorrect because presigned URLs are for individual user access, not for CloudFront origin access. Option D is incorrect because CloudFront signed URLs restrict viewer access, not origin access. Option E is incorrect because bucket policies use OAI, not CloudFront distribution IDs.

Answer

Generate presigned URLs for all objects in the S3 bucket.

Answer

Configure CloudFront signed URLs to limit viewer access.

Answer

Set the S3 bucket policy to allow access only from the CloudFront distribution ID.

Question 5

A company is using Amazon Route 53 as its DNS service. The company has a web application running on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The company wants to ensure that if the ALB fails, traffic is automatically redirected to a static error page hosted on an Amazon S3 bucket. Which Route 53 routing policy should be used to achieve this?

Accepted Answer

Failover routing policy. Option B is correct because a failover routing policy allows you to configure active-passive failover with primary and secondary records. Option A is wrong because weighted routing distributes traffic based on weights. Option C is wrong because latency routing routes to the region with the lowest latency. Option D is wrong because geolocation routing routes based on the user's geographic location.

Answer

Geolocation routing policy

Answer

Latency routing policy

Answer

Weighted routing policy

Question 6

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The company has a NAT gateway in the public subnet. Which of the following route table configurations is required for the private subnet to enable internet access through the NAT gateway?

Accepted Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the private subnet route table. Option C is correct because the private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT gateway. Option A is wrong because a route to the internet gateway would bypass the NAT gateway. Option B is wrong because the NAT gateway is in the public subnet. Option D is wrong because the private subnet does not need a direct route to the internet gateway.

Answer

Add a route to 0.0.0.0/0 pointing to the internet gateway in the private subnet route table

Answer

Add a route to 0.0.0.0/0 pointing to the NAT gateway in the public subnet route table

Answer

Add a route to the NAT gateway's private IP in the private subnet route table

Question 7

A company is using Amazon CloudFront to distribute content globally. The company wants to restrict access to content so that only users from specific countries can access it. Which CloudFront feature should be used?

Accepted Answer

Geo restriction. Option A is correct because CloudFront geo restriction allows you to whitelist or blacklist countries. Option B is wrong because signed URLs provide access per request. Option C is wrong because origin access identity restricts access to the origin, not users. Option D is wrong because WAF can be used for more granular access control but geo restriction is the native feature for country-based blocking.

Answer

AWS WAF

Answer

Signed URLs

Answer

Origin Access Identity (OAI)

Question 8

A company is running a critical application on EC2 instances in a VPC. The instances are in an Auto Scaling group across multiple Availability Zones. The application needs to maintain a fixed, private IP address for each instance. Which approach should be used to ensure each instance receives a consistent private IP address?

Accepted Answer

Use an Elastic Network Interface (ENI) with a predefined private IP and attach it to the instance. Option D is correct because an Elastic Network Interface (ENI) can be created with a specific private IP and attached to an instance; upon instance termination, the ENI can be reattached to a new instance. Option A is wrong because private IP addresses are assigned at launch and released upon termination. Option B is wrong because Elastic IPs are public IPs. Option C is wrong because DHCP option sets do not assign IP addresses.

Answer

Configure the DHCP option set to assign a static IP

Answer

Assign an Elastic IP to each instance and use that as the private IP

Answer

Use a custom AMI that configures a static private IP address via user data

Question 9

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. The company wants to connect two subnets: one in the VPC (10.0.1.0/24) and one in an on-premises network (192.168.1.0/24) via a Site-to-Site VPN. The VPN connection is established. However, instances in the VPC subnet cannot ping the on-premises server at 192.168.1.10. What is a possible cause?

Accepted Answer

The route table for the VPC subnet does not have a route to the on-premises network via the VPN gateway. Option B is correct because the VPC subnet's route table must have a route for the on-premises CIDR pointing to the VPN gateway. Option A is wrong because the VPN connection uses the internet, not a VPC endpoint. Option C is wrong because security groups control traffic to/from instances, but the route is missing. Option D is wrong because the VPN is established, so tunnel is up.

Answer

The VPN tunnel is not in the UP state

Answer

The security group for the VPC instances does not allow ICMP traffic

Answer

The VPC does not have a VPC endpoint for the VPN service

Question 10

A company is using an Application Load Balancer (ALB) to distribute traffic to a fleet of EC2 instances. The company needs to ensure that the ALB sends requests to instances that are healthy and can serve traffic. Which feature should be used to monitor the health of the instances?

Accepted Answer

Health checks. Option B is correct because health checks are used by the ALB to determine if an instance is healthy. Option A is wrong because stickiness is about session persistence. Option C is wrong because cross-zone load balancing distributes traffic across zones. Option D is wrong because connection draining ensures in-flight requests complete before instance deregistration.

Answer

Sticky sessions

Answer

Cross-zone load balancing

Answer

Connection draining

Question 11

A company has a CloudFront distribution with an S3 bucket as the origin. The S3 bucket contains sensitive data that should only be accessible through CloudFront. Which configuration is required to ensure that direct access to the S3 bucket is blocked?

Accepted Answer

Create an Origin Access Identity (OAI) and add a bucket policy that grants access only to the OAI. Option A is correct because Origin Access Identity (OAI) prevents direct S3 access by allowing only CloudFront to access the bucket. Option B is wrong because signed URLs control viewer access, not origin access. Option C is wrong because bucket policies alone can restrict access, but OAI is the standard way. Option D is wrong because CloudFront does not use IAM roles for origin access.

Answer

Attach an IAM role to CloudFront that allows S3 access

Answer

Set the S3 bucket policy to deny all access except from CloudFront's IP ranges

Answer

Use signed URLs for all requests

Question 12

A company has a VPC with multiple subnets across two Availability Zones. The company wants to set up a Network Load Balancer (NLB) to handle TCP traffic to a fleet of EC2 instances. The instances are in private subnets. Which configuration is necessary to ensure the NLB can route traffic to the instances?

Accepted Answer

Ensure the NLB is deployed in subnets that can route to the target subnets. Option D is correct because NLB targets can be instances in private subnets as long as the NLB has a subnet in each AZ where targets reside. Option A is wrong because NLB does not require an internet gateway. Option B is wrong because security groups are not used for NLB traffic. Option C is wrong because NAT gateway is for outbound traffic.

Answer

Assign security groups to the NLB to allow inbound traffic

Answer

Configure a NAT gateway in each Availability Zone for the NLB to access the instances

Answer

Attach an internet gateway to the VPC and add a route to the NLB subnets

Question 13

A company has an EC2 instance that needs to have a static public IP address that does not change even if the instance is stopped and started. Which AWS resource should be attached to the instance?

Accepted Answer

An Elastic IP address. Option C is correct because an Elastic IP address is a static public IP that can be associated with an instance and remains with the account until released. Option A is wrong because public IPs assigned by AWS change when the instance is stopped. Option B is wrong because private IPs are not public. Option D is wrong because a secondary private IP is not public.

Answer

An automatically assigned public IP address

Answer

A secondary private IP address

Answer

A static private IP address

Question 14

Which TWO of the following are benefits of using Amazon CloudFront in front of an Application Load Balancer? (Select TWO.)

Accepted Answer

Protect the application against DDoS attacks. Amazon CloudFront provides AWS Shield Standard automatically, which mitigates common Layer 3/4 DDoS attacks at the edge before traffic reaches the ALB. By absorbing volumetric attacks at CloudFront's globally distributed edge locations, the ALB is shielded from malicious traffic, ensuring application availability. This is a key benefit because ALBs alone do not have built-in DDoS protection beyond basic security group rules.

Answer

Simplify VPC endpoint configuration

Answer

Offload SSL/TLS termination from the ALB

Answer

Provide a static IP address for the application

Question 15

Which THREE of the following are valid options for connecting a VPC to an on-premises network? (Select THREE.)

Accepted Answer

Transit gateway with VPN attachment. A Transit Gateway with a VPN attachment allows you to connect your VPC to an on-premises network by acting as a central hub that interconnects VPCs and on-premises networks via IPsec VPN tunnels. This is a valid option because the Transit Gateway can terminate multiple VPN connections, enabling hybrid connectivity with centralized routing and scalability.

Answer

VPC peering

Answer

VPC endpoint