SOA-C02 Networking and Content Delivery Practice Test 6 — 15 Questions

Question 1

A company has a web application that uses Amazon CloudFront and an Application Load Balancer as origin. The application requires HTTPS between CloudFront and the ALB. The ALB uses a certificate from AWS Certificate Manager (ACM) for the custom domain. The administrator notices that CloudFront returns HTTP 502 errors occasionally. The ALB target group shows healthy instances. What is the most likely cause of the 502 errors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SSL/TLS certificate on the ALB does not match the origin domain name configured in CloudFront. CloudFront validates the origin's TLS certificate against the origin domain name configured in the distribution. If the ALB's ACM certificate does not cover that domain (e.g., CloudFront is configured with the ALB's DNS name but the cert is for the custom domain), the TLS handshake fails and CloudFront returns HTTP 502. This is the classic cause when targets are healthy and the ALB is otherwise functional.

Answer

The ALB is not configured to support HTTPS

Answer

The CloudFront origin response timeout is set too low

Answer

The ALB security group denies traffic from CloudFront IP addresses

Question 2

A company has a multi-tier application with a web tier, application tier, and database tier. All tiers are in the same VPC. The web tier is in public subnets, application tier in private subnets, and database tier in private subnets. The security groups are configured as follows: Web SG allows HTTP/HTTPS from 0.0.0.0/0; App SG allows HTTP from Web SG; DB SG allows MySQL from App SG. The application tier instances cannot connect to the database tier. What is the most likely cause?

Accepted Answer

The network ACLs on the database subnets are blocking inbound MySQL traffic. The application instances cannot connect to the database tier despite the security group rules being correctly configured (DB SG allows MySQL from App SG). Since security groups are stateful and allow return traffic automatically, the issue must be with the network ACLs (NACLs) on the database subnets, which are stateless and require explicit inbound and outbound rules. By default, custom NACLs deny all traffic, so unless they allow MySQL (port 3306) inbound and ephemeral ports outbound, the connection is blocked. Option A is incorrect because overlapping CIDRs are not mentioned and routing within the same VPC is unaffected. Option B is incorrect because route tables in private subnets automatically include a local route to other subnets in the VPC. Option D is incorrect because security groups are stateful and allow return traffic for established connections.

Answer

The VPC CIDR blocks overlap and cause routing issues

Answer

The route tables in the private subnets do not have a route to the database subnets

Answer

The security group for the database tier does not allow return traffic from the application tier

Question 3

A company has a VPC with a CIDR block of 10.0.0.0/16. The company needs to connect this VPC to an on-premises network that uses the CIDR block 10.0.0.0/8. The company wants to use AWS Site-to-Site VPN for the connection. A SysOps administrator must ensure that traffic from the VPC to the on-premises network is routed correctly without affecting other VPCs in the AWS account. Which solution should the administrator implement?

Accepted Answer

Create a Site-to-Site VPN connection, and use a transit gateway with a route table that has a static route for 10.0.0.0/8 pointing to the VPN attachment, and associate only the required VPC attachment with that route table.. The overlapping CIDR blocks require a solution that isolates routing. A transit gateway with separate route tables allows you to control which VPC attachments can route to the VPN. By associating only the specific VPC with a route table that has a static route for 10.0.0.0/8 pointing to the VPN attachment, traffic is correctly routed without impacting other VPCs. This approach avoids modifying the VPC's local routes and provides the necessary isolation.

Answer

Create a Site-to-Site VPN connection, enable route propagation on the VPC route tables, and add a static route for 10.0.0.0/8 pointing to the virtual private gateway.

Answer

Create a Site-to-Site VPN connection, and add a route for 10.0.0.0/8 to the VPC route tables pointing to the virtual private gateway, and also add a route for 10.0.0.0/8 to the on-premises router pointing to the VPN tunnel.

Answer

Create a Site-to-Site VPN connection, and configure the on-premises customer gateway to use a different CIDR block that does not overlap with the VPC CIDR.

Question 4

A company uses Amazon Route 53 to manage DNS for its public domain. The company has a web application running on an Application Load Balancer (ALB) in the us-east-1 Region. The company wants to implement a disaster recovery strategy that automatically routes traffic to a static maintenance page hosted on Amazon S3 if the ALB becomes unhealthy. The maintenance page must be served with low latency to users worldwide. Which two actions should a SysOps administrator take to meet these requirements? (Choose two.)

Accepted Answer

Create an Amazon CloudFront distribution with the S3 bucket as the origin, and configure the S3 bucket for static website hosting.. To automatically route traffic to a maintenance page when the ALB is unhealthy, use a Route 53 failover routing policy with a health check on the ALB. The primary record points to the ALB, and the secondary record points to a CloudFront distribution that serves the maintenance page from an S3 bucket. CloudFront provides low-latency global delivery. This combination ensures automatic failover and fast content delivery.

Answer

Create a Route 53 health check for the ALB, and configure a weighted routing policy with the ALB and the S3 bucket website endpoint as targets.

Answer

Create an Amazon CloudFront distribution with the ALB as the origin, and configure a custom error page in CloudFront to serve the maintenance page from S3 when the ALB returns a 5xx error.

Answer

Create a Route 53 health check for the ALB, and configure a latency routing policy with the ALB and the CloudFront distribution as targets.

Question 5

A company wants to establish a dedicated, low-latency, private connection between its on-premises data center and an AWS VPC. The company does not want to use the public internet. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS Direct Connect. AWS Direct Connect is the correct service because it provides a dedicated, private, low-latency network connection from an on-premises data center to AWS, bypassing the public internet entirely. It uses industry-standard 802.1Q VLANs to create a private virtual interface (VIF) that connects directly to a VPC, ensuring consistent network performance and reduced latency.

Answer

AWS Virtual Private Gateway

Answer

AWS Transit Gateway

Answer

VPC Peering

Question 6

A company has two VPCs in different AWS regions (us-east-1 and eu-west-1) that are peered. Applications in both VPCs need to communicate using private IP addresses. The ping tests are successful, but the latency is significantly higher than expected. Which change is most likely to improve the latency between the VPCs?

Accepted Answer

Enable DNS resolution for the VPC peering connection.. Enabling DNS resolution for the VPC peering connection allows instances to resolve public DNS hostnames to the private IP addresses of the peered VPC. Without this, DNS queries may return public IP addresses, forcing traffic to traverse the internet or NAT gateways, which adds significant latency. By resolving to private IPs, traffic stays within the AWS backbone, reducing latency.

Answer

Use a Transit Gateway instead of VPC Peering for cross-region connectivity.

Answer

Increase the MTU on the instances' network interfaces to 9001.

Answer

Configure ECMP (Equal-Cost Multi-Path) routing on the VPC peering connection.

Question 7

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. The company's SysOps administrator wants to ensure that traffic from the VPC destined for the on-premises network uses the Direct Connect connection instead of the internet. Which configuration should be used?

Accepted Answer

Add a route in the VPC route table pointing to the on-premises network via a virtual private gateway (VGW). A virtual private gateway (VGW) is the AWS-side endpoint for an AWS Direct Connect connection when using a private virtual interface. By adding a route in the VPC route table that points the on-premises network CIDR to the VGW, all traffic destined for the on-premises network is forced over the Direct Connect link, bypassing the internet. This ensures private, low-latency, and consistent connectivity as required.

Answer

Add a route in the VPC route table pointing to the on-premises network via a NAT gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via an internet gateway

Answer

Add a route in the VPC route table pointing to the on-premises network via a VPC peering connection

Question 8

A company has two VPCs in the same AWS region. VPC A hosts a web application, and VPC B hosts a database. The SysOps administrator needs to enable private IP communication between the two VPCs without using the public internet. The administrator wants a simple, low-cost solution that uses the AWS network backbone. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering allows direct, private IP connectivity between two VPCs using the AWS network backbone without traversing the public internet. It is the simplest and most cost-effective solution for connecting exactly two VPCs in the same region, as there are no additional hourly charges beyond data transfer costs, and no intermediate devices or bandwidth limitations are introduced.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 9

A company hosts a web application behind an Application Load Balancer (ALB) in us-east-1. Users in Europe report high latency. The SysOps administrator decides to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. However, the application logs require the original client IP addresses of users. The ALB currently provides the client IP via the X-Forwarded-For header, but the development team warns that Global Accelerator may change the source IP. Which configuration should the administrator choose to meet both performance and logging requirements?

Accepted Answer

Place a Network Load Balancer (NLB) in front of the ALB, and configure Global Accelerator to point to the NLB. The NLB preserves the client IP, and the ALB can still see it in the X-Forwarded-For header.. Placing a Network Load Balancer (NLB) in front of the ALB allows Global Accelerator to terminate the TCP connection at the edge, then forward traffic to the NLB. The NLB preserves the original client IP address by default (since it operates at Layer 4 and does not terminate the connection), and the ALB can still read the client IP from the X-Forwarded-For header. This setup meets both the performance requirement (via Global Accelerator's edge routing) and the logging requirement (preserving the original client IP).

Answer

Configure Global Accelerator with an endpoint group that points directly to the ALB. The ALB will continue to receive the original client IP in the X-Forwarded-For header.

Answer

Enable Proxy Protocol v2 on the ALB to ensure client IP addresses are preserved through Global Accelerator.

Answer

Use Amazon CloudFront instead of Global Accelerator and configure it to forward the client IP in a custom header.

Question 10

A company hosts a web application on Amazon EC2 instances in two AWS regions: us-east-1 and eu-west-1. The application is behind an Application Load Balancer (ALB) in each region. The SysOps administrator wants to direct users to the region that provides the lowest latency, automatically routing traffic away from a region if it becomes unhealthy. Which Amazon Route 53 routing policy should be used?

Accepted Answer

Latency routing. Latency routing (B) is correct because it directs users to the region with the lowest network latency based on real-time measurements between the user and the AWS endpoints. When a region becomes unhealthy, Route 53 automatically stops routing traffic to that region's ALB, ensuring failover to the next lowest-latency healthy region. This meets the requirement of both low-latency and automatic health-based rerouting.

Answer

Geolocation routing

Answer

Weighted routing

Answer

Failover routing

Question 11

A company runs a gaming application that uses Amazon EC2 instances to handle real-time multiplayer sessions. The application requires low-latency communication with users around the world. The SysOps administrator needs to accelerate content delivery for non-cacheable, dynamic content (such as real-time game state updates) and also provide static asset delivery. The solution must support both TCP and UDP traffic. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network and Anycast IPs to route TCP and UDP traffic to the optimal endpoint, providing low-latency performance for non-cacheable dynamic content like real-time game state updates. It also supports static asset delivery by directing traffic to origins such as Application Load Balancers or EC2 instances, and it handles both TCP and UDP protocols natively, which is essential for real-time multiplayer gaming.

Answer

Amazon CloudFront with origins configured for both dynamic and static content

Answer

AWS Shield Advanced

Answer

AWS App Mesh

Question 12

A company has two VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The VPCs are in the same AWS region. The SysOps administrator needs to enable private IP connectivity between the two VPCs so that an EC2 instance in VPC-A can communicate with an EC2 instance in VPC-B using their private IP addresses. The administrator wants a simple, low-cost solution with high throughput. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it enables direct, private IP connectivity between two VPCs in the same AWS region using the existing AWS network infrastructure, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer. It meets the requirements for simplicity, low cost, and high throughput, as traffic stays within the AWS backbone and does not require a separate transit hub or VPN.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 13

A company has an Application Load Balancer (ALB) in the us-east-1 region. Users in Asia report high latency. The SysOps administrator wants to use AWS Global Accelerator to improve performance by directing traffic to the closest edge location. Which step is required to integrate Global Accelerator with the ALB?

Accepted Answer

Configure the ALB as an endpoint group in a Global Accelerator accelerator.. AWS Global Accelerator uses the AWS global network to route traffic to the closest edge location, then forwards it over the AWS backbone to the ALB endpoint. To integrate, you must configure the ALB as an endpoint in an endpoint group within the accelerator, which allows Global Accelerator to direct traffic to the ALB based on proximity and health. This reduces latency for users in Asia by minimizing internet hops.

Answer

Create a CloudFront distribution and point it to the ALB as an origin.

Answer

Set up a Route 53 geoproximity routing policy for the ALB.

Answer

Use AWS WAF to allow traffic from Global Accelerator edge locations.

Question 14

A company has an on-premises data center connected to AWS via an AWS Direct Connect connection. The SysOps administrator needs to ensure high availability for the connectivity. Which configuration provides the highest availability for the Direct Connect connection?

Accepted Answer

Establish two Direct Connect connections to different AWS Direct Connect locations.. Establishing two Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one AWS Direct Connect location experiences an outage, the other connection remains operational, ensuring high availability. This configuration eliminates single points of failure at the facility level, which is the most resilient design for hybrid connectivity.

Answer

Establish a single Direct Connect connection with a VPN backup.

Answer

Establish two Direct Connect connections to the same AWS Direct Connect location.

Answer

Use multiple virtual interfaces on a single Direct Connect connection.

Question 15

A company has a VPC with public and private subnets. An Application Load Balancer (ALB) is deployed in the public subnets, and an Auto Scaling group of web servers is deployed in the private subnets. The web servers need to frequently make HTTPS requests to an external API. The API provider requires that all requests originate from a consistent set of static IP addresses for whitelisting. The SysOps administrator must ensure that outbound traffic from the web servers has static source IP addresses. Which solution should be implemented?

Accepted Answer

Deploy a NAT gateway in a public subnet with an Elastic IP and route outbound traffic from the private subnets through the NAT gateway.. A NAT gateway placed in a public subnet with an Elastic IP provides a consistent, static source IP for all outbound traffic from instances in private subnets. The web servers route their outbound HTTPS requests through the NAT gateway, which performs source NAT (SNAT) using the Elastic IP, satisfying the API provider's whitelisting requirement. This design keeps the web servers in private subnets for security while ensuring a fixed public IP for outbound traffic.

Answer

Place the web servers in public subnets and assign each instance an Elastic IP address.

Answer

Create a VPC endpoint for the external API service.

Answer

Use AWS Global Accelerator to provide static IP addresses for outbound traffic.