SOA-C02 Networking and Content Delivery Practice Test 6 — 15 Questions

Question 1

A company hosts a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. Which step should the SysOps administrator take to troubleshoot the issue?

Accepted Answer

Verify the target group health check settings.. Intermittent 503 errors from an Application Load Balancer typically indicate that the target instances are failing health checks or are unable to handle the request load. Verifying the target group health check settings (e.g., path, interval, threshold, and protocol) is the first troubleshooting step because if the health checks are misconfigured or the targets are unhealthy, the ALB will stop routing traffic to them, resulting in 503 responses.

Answer

Enable cross-zone load balancing.

Answer

Increase the idle timeout on the load balancer.

Answer

Add more subnets to the load balancer.

Question 2

An organization uses Amazon CloudFront to serve static content from an S3 bucket. The content is updated frequently, but users are seeing stale files. What is the most efficient way to invalidate the cache for updated objects?

Accepted Answer

Create a CloudFront invalidation for the updated files.. CloudFront supports file invalidation to remove objects from edge caches. Using the console or API to create an invalidation for the specific paths is the direct method.

Answer

Use the S3 console to set a new cache-control header.

Answer

Change the origin path in the CloudFront distribution.

Answer

Delete and recreate the CloudFront distribution.

Question 3

A company has a VPC with public and private subnets. A NAT Gateway is in the public subnet, and a private EC2 instance needs to download patches from the internet. The instance can reach the internet after a reboot. Which action should the SysOps administrator take to make the internet access persistent?

Accepted Answer

Update the route table of the private subnet to point 0.0.0.0/0 to the NAT Gateway.. Route tables must be manually updated after adding a NAT Gateway. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway.

Answer

Attach an internet gateway to the private subnet.

Answer

Associate an Elastic IP with the NAT Gateway.

Answer

Enable DNS resolution in the VPC.

Question 4

A SysOps administrator needs to allow a Lambda function to access a DynamoDB table in the same AWS account. Which configuration is required?

Accepted Answer

Assign an IAM role to the Lambda function with DynamoDB permissions.. Lambda needs an IAM role with a policy granting DynamoDB actions. The role is assumed by the Lambda service.

Answer

Create a VPC endpoint for DynamoDB and attach it to the Lambda function.

Answer

Configure a network ACL to allow traffic from Lambda to DynamoDB.

Answer

Add the Lambda function as a principal in the DynamoDB table's resource-based policy.

Question 5

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection is redundant with two virtual interfaces (VIFs). Recently, one VIF failed, and the administrator notices that traffic is not automatically failing over. What must be configured to enable automatic failover?

Accepted Answer

Create a VPN connection as a backup and configure route propagation with a lower priority.. AWS Direct Connect does not automatically failover. Using BGP with AS_PATH prepending or using a Direct Connect gateway with multiple VIFs can help, but the simplest approach is to use a VPN as a backup or configure BGP metrics. However, the question implies the need for active/backup. The common solution is to use a VPN connection as a backup and configure route propagation.

Answer

Configure BGP metrics to prefer the primary VIF.

Answer

Place both VIFs in the same VLAN.

Answer

Enable equal-cost multi-path (ECMP) routing.

Question 6

A web application on EC2 instances behind an ALB experiences increased latency during peak hours. The SysOps administrator notices that the ALB's RequestCount per target is high. What design change should improve performance?

Accepted Answer

Add more EC2 instances to the target group.. Increasing the number of targets (EC2 instances) spreads the load and reduces latency.

Answer

Switch to a Network Load Balancer.

Answer

Enable sticky sessions on the ALB.

Answer

Reduce the idle timeout on the ALB.

Question 7

An organization wants to block traffic from specific IP addresses at the edge of the AWS network before it reaches the application. Which service should be used?

Accepted Answer

AWS WAF. AWS WAF integrates with CloudFront and ALB to filter traffic based on IP addresses. For edge blocking, CloudFront with WAF is the best choice.

Answer

Security groups

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 8

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which step is necessary?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. To enable IPv6 communication in an existing VPC, you must first associate an Amazon-provided IPv6 CIDR block with the VPC. This is a prerequisite for configuring subnets, route tables, and internet gateways to support IPv6 traffic. Without an IPv6 CIDR block assigned to the VPC, no EC2 instance can obtain an IPv6 address or route IPv6 traffic.

Answer

Attach an internet gateway that supports IPv6.

Answer

Create a new VPC with an IPv6 CIDR block and migrate resources.

Answer

Enable DNS64 in the VPC.

Question 9

A SysOps administrator receives an alert that a VPN connection between a VPC and an on-premises network is down. The VPN uses static routing. After verifying the on-premises side is functioning, what should the administrator check in AWS?

Accepted Answer

Verify that the customer gateway device is configured with the correct IP address.. Since the VPN uses static routing, BGP is not in use, so checking BGP session status (Option A) is irrelevant. Rebooting the virtual private gateway (Option B) is a disruptive action that should not be a first step without identifying the root cause. Ensuring the route table has a route to the virtual private gateway (Option C) is important for traffic flow but does not address the VPN tunnel being down. The correct first step is to verify that the customer gateway device is configured with the correct IP address (Option D), because a mismatch in the public IP address of the on-premises VPN endpoint will prevent the IPsec tunnel from establishing, even if the on-premises side is functioning internally.

Answer

Check the BGP session status.

Answer

Reboot the virtual private gateway.

Answer

Ensure the route table has a route to the virtual private gateway.

Question 10

Which TWO actions can reduce data transfer costs for content delivered to users globally? (Choose two.)

Accepted Answer

Deploy multiple Application Load Balancers in different regions.. Deploying multiple Application Load Balancers (ALBs) in different regions allows traffic to be routed to the nearest regional endpoint, reducing the distance data must travel over the public internet and lowering egress costs. Option B is correct because Amazon CloudFront caches content at edge locations closer to users, minimizing the amount of data transferred from the origin and reducing overall data transfer costs, especially for frequently accessed static content.

Answer

Use AWS Direct Connect for all traffic.

Answer

Use a single S3 bucket in one region with cross-region replication.

Answer

Enable S3 Transfer Acceleration.

Question 11

A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances. Users report intermittent 503 errors. Which of the following is the MOST likely cause?

Accepted Answer

The target instances are not healthy or are overloaded.. 503 errors from an ALB typically indicate that the target instances are not healthy or are overloaded, causing the ALB to return a 503 Service Unavailable response. Option D is correct because unhealthy or overwhelmed targets are the most direct cause. Option A is incorrect because a health check interval set too low might cause premature marking, but the underlying issue is still target health; however, the most common and direct cause is unhealthy targets. Option B is incorrect because SSL certificate expiration causes 502 errors, not 503. Option C is incorrect because security group blocking traffic to the ALB would result in 504 errors, not 503.

Answer

The health check interval is set too low, causing the ALB to mark instances as unhealthy prematurely.

Answer

The SSL certificate on the ALB has expired.

Answer

The security group for the ALB is blocking incoming traffic.

Question 12

A company wants to host a static website on AWS with high availability and low latency for global users. Which combination of services should be used?

Accepted Answer

Amazon S3 and Amazon CloudFront. Amazon S3 and Amazon CloudFront. Amazon S3 can host static websites directly, and Amazon CloudFront is a CDN that caches content at edge locations globally, providing low latency and high availability. Option A (EC2 + ELB) is overkill for static sites and adds management overhead. Option C (Route 53 + S3) provides DNS and storage but no CDN, so global latency would be higher. Option D (ELB + CloudFront) is for dynamic content and not suitable for static site hosting alone.

Answer

Amazon EC2 and Elastic Load Balancing

Answer

Amazon Route 53 and Amazon S3

Answer

Elastic Load Balancing and Amazon CloudFront

Question 13

A company uses Amazon CloudFront to serve content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Users report that they can access the content via CloudFront but also directly via the S3 bucket URL. How can the company restrict direct access to the S3 bucket?

Accepted Answer

Update the S3 bucket policy to deny access to any principal other than the CloudFront service.. While OAC ensures that CloudFront uses a specific identity to access the S3 bucket, it does not automatically block direct access from other users. To restrict direct access, you must explicitly deny access to any principal other than the CloudFront service. This is done by adding a bucket policy that denies s3:GetObject for any principal that is not the CloudFront service principal (or the OAC principal). Option A is incorrect because OAC is the recommended approach over OAI, and switching would not solve the issue without a proper bucket policy. Option B is incorrect because pre-signed URLs provide temporary access for specific users, but do not block direct access from unauthorized users. Option C is incorrect because removing the bucket policy and relying on ACLs could make the bucket public; OAC requires a bucket policy to allow CloudFront access, and ACLs are not sufficient to restrict access to only CloudFront.

Answer

Disable OAC and use Origin Access Identity (OAI) instead.

Answer

Use pre-signed URLs for all S3 requests.

Answer

Remove the bucket policy and rely on ACLs.

Question 14

A company has deployed a web application across multiple Availability Zones using an Application Load Balancer. The application experiences increased latency during peak hours. Which action would be MOST effective in reducing latency?

Accepted Answer

Add more EC2 instances to the target group.. The most effective action to reduce latency during peak hours is to add more EC2 instances to the target group. This increases the application's capacity to handle requests, reducing the load per instance and thus decreasing response times. Adding more instances distributes the incoming traffic across a larger pool of resources, directly addressing the increased demand.

Answer

Update the health check to use a more frequent interval.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay for the target group.

Question 15

A company has a VPN connection between its on-premises network and AWS VPC. The VPN tunnel shows status as UP, but traffic is not flowing from on-premises to the VPC. Which configuration should be checked?

Accepted Answer

The route tables in the VPC have routes pointing to the virtual private gateway for the on-premises CIDR.. Even if the VPN tunnel is UP, traffic from on-premises to the VPC requires a route in the VPC route tables that points the on-premises CIDR block to the virtual private gateway (VGW). Without this route, the VPC has no path to forward return traffic or accept inbound traffic, causing a black hole. The tunnel status only indicates the IPsec/IKE negotiation succeeded, not that routing is properly configured.

Answer

The IKE versions on the customer gateway and virtual private gateway match.

Answer

The customer gateway device is configured to forward traffic to the VPC.

Answer

The security groups allow inbound traffic from the on-premises network.