SOA-C02 Networking and Content Delivery Practice Test 7 — 15 Questions

Question 1

A company wants to provide low-latency access to a web application for users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. Which AWS service should be used to route users to the nearest region?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Route 53 with latency-based routing. Amazon Route 53 with latency-based routing directs user traffic to the AWS region that provides the lowest latency for the end user. By configuring latency records for the EC2 instances in us-east-1 and eu-west-1, Route 53 responds to DNS queries with the IP address of the region that offers the best network performance, effectively routing users to the nearest region.

Answer

Application Load Balancer with cross-region load balancing

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 2

A company has a VPC with a public subnet and a private subnet. An Amazon RDS for MySQL database is deployed in the private subnet. Which TWO steps are required to allow an EC2 instance in the public subnet to connect to the database? (Choose two.)

Accepted Answer

Update the security group for the RDS instance to allow inbound traffic on port 3306 from the EC2 instance's security group.. The correct answers are A and D. To allow an EC2 instance in a public subnet to connect to an RDS for MySQL database in a private subnet, two steps are needed: (A) Update the security group for the RDS instance to allow inbound traffic on port 3306 from the EC2 instance's security group. This permits the database to receive connections from the EC2 instance. (D) Ensure that the EC2 instance's security group allows outbound traffic to the RDS instance's security group on port 3306. This permits the EC2 instance to initiate the connection. Option B is incorrect because a NAT Gateway is for providing internet access to instances in private subnets, not for communication within the same VPC. Option C is incorrect because the RDS instance does not need a public IP; it communicates with the EC2 instance using private IPs within the VPC. Option E is incorrect because the route between subnets in the same VPC is automatically handled by the VPC's local route; no additional route is needed.

Answer

Deploy a NAT Gateway in the public subnet to allow the EC2 instance to communicate with the RDS instance.

Answer

Assign a public IP address to the RDS instance.

Answer

Add a route to the public subnet's route table for the RDS subnet CIDR.

Question 3

A company is using Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is configured with HTTPS listeners. Users report that some requests are failing with a 502 error. Which THREE steps should the SysOps administrator take to troubleshoot the issue? (Choose three.)

Accepted Answer

Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.. The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.

Answer

Configure the CloudFront distribution to use a custom error response for 502 errors.

Answer

Verify that the ALB is configured to use the X-Forwarded-For header to route requests.

Question 4

A company is using Amazon Route 53 with a private hosted zone for internal DNS resolution within a VPC. The VPC is connected to an on-premises network via a VPN. On-premises resources cannot resolve DNS names in the private hosted zone. Which TWO actions should be taken to resolve this issue? (Choose two.)

Accepted Answer

Enable DNS resolution and DNS hostnames for the VPC.. To allow on-premises resources to resolve DNS names in a private hosted zone, you need to create a Route 53 inbound resolver endpoint in the VPC (option E). This endpoint allows DNS queries from on-premises to be forwarded to Route 53. Additionally, you must enable DNS resolution and DNS hostnames for the VPC (option C) to ensure that the VPC's DNS settings support internal resolution. Option A is incorrect because route propagation affects network routing, not DNS resolution. Option B is incorrect because private hosted zones cannot be associated with on-premises networks directly. Option D is incorrect because a public hosted zone is used for public DNS and does not resolve private DNS queries.

Answer

Configure route propagation from the VPN to the VPC's route table.

Answer

Associate the private hosted zone with the on-premises network.

Answer

Create a public hosted zone with the same name and associate it with the VPC.

Question 5

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to send traffic to an EC2 instance in subnet-B. Both instances are in the same VPC and have appropriate security group rules. However, traffic is not reaching the destination. What is the MOST likely cause?

Accepted Answer

The network ACL associated with subnet-B is denying inbound traffic from subnet-A.. Network ACLs are stateless and must allow both inbound and outbound traffic for the communication to succeed. If the NACL associated with subnet-B does not allow inbound traffic from subnet-A (10.0.1.0/24), then traffic from the EC2 instance in subnet-A to the instance in subnet-B will be denied. Option A is incorrect because VPC route tables automatically include a local route for the VPC CIDR (10.0.0.0/16), so no specific route for subnet-B's CIDR is needed. Option C is incorrect because security groups are stateful; if the source instance's security group allows outbound traffic, the return traffic is automatically allowed, and the question states that security group rules are appropriate. Option D is incorrect because VPC peering is not required for communication within the same VPC; both subnets are in the same VPC, so local routing applies.

Answer

The route table for subnet-A does not have a route for subnet-B's CIDR.

Answer

The security group on the destination instance does not allow inbound traffic from the source instance.

Answer

The VPC peering connection is not established between the two subnets.

Question 6

A company is using Amazon CloudFront to distribute content globally. The origin is an S3 bucket. The SysOps administrator notices that cache hit ratio is low. Which configuration change would MOST improve the cache hit ratio?

Accepted Answer

Set longer Cache-Control max-age headers on the S3 objects.. Setting longer Cache-Control max-age headers on the S3 objects tells CloudFront to cache the objects for a longer period, directly increasing the cache hit ratio. Option A is wrong because using query string parameters without proper configuration can fragment the cache and reduce hit ratio. Option B is wrong because custom error responses for 404 errors do not affect caching of successful responses. Option D is wrong because Origin Shield reduces the load on the origin by aggregating requests but does not directly improve cache hit ratio; it primarily helps with cost and origin offload.

Answer

Use query string parameters to differentiate content.

Answer

Configure custom error responses for 404 errors.

Answer

Enable Origin Shield for the distribution.

Question 7

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 502 errors. The SysOps administrator checks the ALB access logs and sees that the error occurs when the target group has 'unhealthy' targets. What is the MOST likely cause of the 502 errors?

Accepted Answer

The target instances are not passing health checks.. 502 errors from an Application Load Balancer typically occur when the target instances are unhealthy and cannot respond to requests. The ALB attempts to forward requests to targets in the target group, but if the targets fail health checks, the ALB cannot establish a successful connection, resulting in a 502 error. Option A is incorrect because an expired SSL certificate on the ALB would cause 502 errors only if the certificate is used for listener authentication, but common SSL issues lead to 502 or 503 errors; however, the scenario specifically ties 502 errors to unhealthy targets, not certificate problems. Option B is incorrect because insufficient ALB capacity typically results in 503 errors (Service Unavailable), not 502. Option C is incorrect because exceeding the idle timeout results in a 408 Request Timeout error, not a 502.

Answer

The SSL certificate on the ALB is expired.

Answer

The ALB does not have enough capacity to handle the traffic.

Answer

The client request exceeds the idle timeout.

Question 8

A SysOps administrator needs to route traffic for a domain name 'example.com' to an Application Load Balancer. Which AWS service should be used to create the DNS record?

Accepted Answer

Amazon Route 53. Mazon Route 53, which is AWS's DNS service used to create DNS records such as A records and CNAME records to route traffic to an Application Load Balancer. Option A (Amazon EC2) is incorrect because EC2 is a compute service, not a DNS service. Option B (Application Load Balancer) is incorrect because it is the target of the DNS record, not the service to create DNS records. Option D (Amazon CloudFront) is incorrect because CloudFront is a content delivery network (CDN) service, not a DNS service.

Answer

Amazon EC2

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 9

A company has a VPC with public and private subnets across three Availability Zones. The public subnets host NAT Gateways, and the private subnets host EC2 instances that need to access the internet. The SysOps administrator notices that EC2 instances in one private subnet cannot reach the internet, while others can. What is the MOST likely cause?

Accepted Answer

The route table for the private subnet does not have a default route to the NAT Gateway.. The most likely cause is that the route table associated with the private subnet does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, traffic destined for the internet has no path and fails. Option A is incorrect because secondary private IP addresses do not affect internet access. Option B is incorrect because NAT Gateways must be in a public subnet (not private) to have internet access. Option C is incorrect because network ACLs are stateless and would affect all instances equally, not just those in one subnet.

Answer

The EC2 instances have a secondary private IP address that is not registered.

Answer

The NAT Gateway is not in a public subnet.

Answer

The network ACL for the private subnet blocks outbound traffic.

Question 10

A company uses Amazon CloudFront to deliver static content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which solution should be used?

Accepted Answer

Configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access.. Origin Access Control (OAC) is the recommended method to restrict S3 bucket access exclusively to CloudFront. OAC uses a CloudFront-owned service principal to sign requests, and the S3 bucket policy must explicitly grant the `s3:GetObject` action to that principal, ensuring no direct S3 access from other sources.

Answer

Use pre-signed URLs for all objects.

Answer

Use an S3 bucket policy that allows access from any AWS service.

Answer

Generate CloudFront key pairs and configure signed URLs.

Question 11

A SysOps administrator needs to monitor network traffic to and from an EC2 instance for troubleshooting. Which AWS feature captures IP traffic information at the VPC level?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, including source/destination IPs, ports, protocols, and packet accept/reject decisions. This feature operates at the VPC level and is specifically designed for network traffic monitoring and troubleshooting, making it the correct choice for capturing IP traffic information to and from an EC2 instance.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 12

A company's web application is hosted on EC2 instances behind a Network Load Balancer (NLB) with a static IP address. The application receives a sudden spike in traffic, and some clients report connection timeouts. Which NLB feature should the SysOps administrator configure to handle the increased load?

Accepted Answer

Enable cross-zone load balancing.. NLB cross-zone load balancing distributes traffic across all registered instances in all Availability Zones, improving capacity to handle increased traffic. Option A is incorrect because sticky sessions (session persistence) do not increase capacity; they only ensure a client's requests go to the same target. Option C is incorrect because deletion protection prevents accidental deletion of the NLB and does not affect traffic handling. Option D is incorrect because health checks help identify unhealthy instances but do not increase capacity.

Answer

Enable sticky sessions.

Answer

Enable deletion protection.

Answer

Enable health checks to mark unhealthy instances.

Question 13

A SysOps administrator needs to ensure that all traffic between an on-premises data center and the AWS VPC is encrypted and goes over the internet. Which AWS service should be used?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises data center and an AWS VPC using IPsec (IKEv1/IKEv2) over the public internet. This meets the requirement for encryption and internet-based connectivity, as the VPN traffic traverses the internet but is secured by IPsec tunnels.

Answer

VPC Peering

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 14

A SysOps administrator is troubleshooting an issue where an EC2 instance cannot be accessed via SSH from the internet. The security group allows inbound SSH (port 22) from 0.0.0.0/0. The network ACL (NACL) for the subnet has an inbound rule allowing SSH from 0.0.0.0/0. What else could be blocking access?

Accepted Answer

The NACL outbound rule is blocking return traffic.. The network ACL (NACL) is stateless, meaning that return traffic must be explicitly allowed by outbound rules. Even though the inbound rule allows SSH from 0.0.0.0/0, if the outbound rule does not allow ephemeral ports for return traffic, SSH connections will fail. Option A is incorrect because the NACL inbound rule does allow SSH. Option B is incorrect because the internet gateway being attached is irrelevant to the NACL issue. Option C is incorrect because the security group correctly allows SSH from 0.0.0.0/0. Therefore, option D is correct: the NACL outbound rule is blocking return traffic.

Answer

The NACL inbound rule is blocking traffic.

Answer

The internet gateway is not attached to the VPC.

Answer

The security group rule is misconfigured.

Question 15

A company uses a Network Load Balancer (NLB) with a static IP address. The SysOps administrator needs to enable client IP preservation for the NLB so that backend instances see the original client IP. Which TWO conditions are required for client IP preservation to work?

Accepted Answer

The target group must be of type 'instance'.. Only option A is correct because client IP preservation for a Network Load Balancer (NLB) requires the target group to be of type 'instance'. When the target group is instance-based, the NLB can forward packets with the original source IP address intact, allowing backend instances to see the client's IP directly. Option D is not required; client IP preservation does work when the NLB is integrated with AWS Global Accelerator, so this condition is not necessary. The other options are not required for client IP preservation.

Answer

The NLB must have TLS listeners.

Answer

Proxy protocol must be enabled on the target group.

Answer

The NLB must not be integrated with AWS Global Accelerator.

Answer

Cross-zone load balancing must be enabled.