SOA-C02 Networking and Content Delivery Practice Test 8 — 15 Questions

Question 1

A company has a VPC with public and private subnets. A NAT Gateway is in the public subnet, and a private EC2 instance needs to download patches from the internet. The instance can reach the internet after a reboot. Which action should the SysOps administrator take to make the internet access persistent?

Accepted Answer

Update the route table of the private subnet to point 0.0.0.0/0 to the NAT Gateway.. Route tables must be manually updated after adding a NAT Gateway. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway.

Answer

Attach an internet gateway to the private subnet.

Answer

Associate an Elastic IP with the NAT Gateway.

Answer

Enable DNS resolution in the VPC.

Question 2

A SysOps administrator needs to allow a Lambda function to access a DynamoDB table in the same AWS account. Which configuration is required?

Accepted Answer

Assign an IAM role to the Lambda function with DynamoDB permissions.. Lambda needs an IAM role with a policy granting DynamoDB actions. The role is assumed by the Lambda service.

Answer

Create a VPC endpoint for DynamoDB and attach it to the Lambda function.

Answer

Configure a network ACL to allow traffic from Lambda to DynamoDB.

Answer

Add the Lambda function as a principal in the DynamoDB table's resource-based policy.

Question 3

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection is redundant with two virtual interfaces (VIFs). Recently, one VIF failed, and the administrator notices that traffic is not automatically failing over. What must be configured to enable automatic failover?

Accepted Answer

Create a VPN connection as a backup and configure route propagation with a lower priority.. AWS Direct Connect does not automatically failover. Using BGP with AS_PATH prepending or using a Direct Connect gateway with multiple VIFs can help, but the simplest approach is to use a VPN as a backup or configure BGP metrics. However, the question implies the need for active/backup. The common solution is to use a VPN connection as a backup and configure route propagation.

Answer

Configure BGP metrics to prefer the primary VIF.

Answer

Place both VIFs in the same VLAN.

Answer

Enable equal-cost multi-path (ECMP) routing.

Question 4

A web application on EC2 instances behind an ALB experiences increased latency during peak hours. The SysOps administrator notices that the ALB's RequestCount per target is high. What design change should improve performance?

Accepted Answer

Add more EC2 instances to the target group.. Increasing the number of targets (EC2 instances) spreads the load and reduces latency.

Answer

Switch to a Network Load Balancer.

Answer

Enable sticky sessions on the ALB.

Answer

Reduce the idle timeout on the ALB.

Question 5

An organization wants to block traffic from specific IP addresses at the edge of the AWS network before it reaches the application. Which service should be used?

Accepted Answer

AWS WAF. AWS WAF integrates with CloudFront and ALB to filter traffic based on IP addresses. For edge blocking, CloudFront with WAF is the best choice.

Answer

Security groups

Answer

AWS Shield Advanced

Answer

Network ACLs

Question 6

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. They need to add an IPv6 CIDR block to the VPC and ensure that EC2 instances can communicate over IPv6. Which step is necessary?

Accepted Answer

Associate an Amazon-provided IPv6 CIDR block with the VPC.. To use IPv6, the VPC must be associated with an Amazon-provided IPv6 CIDR block, and subnets must have IPv6 CIDR blocks assigned. Instances must be launched with IPv6 addresses.

Answer

Attach an internet gateway that supports IPv6.

Answer

Create a new VPC with an IPv6 CIDR block and migrate resources.

Answer

Enable DNS64 in the VPC.

Question 7

A SysOps administrator receives an alert that a VPN connection between a VPC and an on-premises network is down. The VPN uses static routing. After verifying the on-premises side is functioning, what should the administrator check in AWS?

Accepted Answer

Verify that the customer gateway device is configured with the correct IP address.. For static VPNs, the tunnel status and BGP (if dynamic) are irrelevant. The VPN connection's tunnel details and route propagation need to be checked. The most common issue is that the tunnel is down due to misconfiguration or network issues.

Answer

Check the BGP session status.

Answer

Reboot the virtual private gateway.

Answer

Ensure the route table has a route to the virtual private gateway.

Question 8

Which TWO actions can reduce data transfer costs for content delivered to users globally? (Choose two.)

Accepted Answer

Deploy multiple Application Load Balancers in different regions.. CloudFront caches content at edge locations to reduce origin data transfer. S3 Transfer Acceleration speeds up uploads but not downloads. VPC endpoints reduce data transfer costs for intra-region traffic, but for global content, CloudFront and using an origin in the same region as the users (e.g., via multiple origins) can help. However, the best two are CloudFront and using multiple origins in different regions.

Answer

Use AWS Direct Connect for all traffic.

Answer

Use a single S3 bucket in one region with cross-region replication.

Answer

Enable S3 Transfer Acceleration.

Question 9

Which THREE components are required to set up a site-to-site VPN connection between an on-premises network and an AWS VPC? (Choose three.)

Accepted Answer

Virtual private gateway. A site-to-site VPN requires a virtual private gateway (or transit gateway) attached to the VPC, a customer gateway representing the on-premises device, and a VPN connection that ties them together. The VPN connection includes two tunnels.

Answer

Internet gateway

Answer

Direct Connect virtual interface

Question 10

Which TWO security measures should be implemented to protect a VPC from DDoS attacks? (Choose two.)

Accepted Answer

Use AWS WAF with rate-based rules. AWS Shield Advanced provides DDoS protection. Using a web application firewall (WAF) at the edge helps filter malicious traffic. Security groups and NACLs are not effective against DDoS at scale.

Answer

Apply network ACLs with deny rules

Answer

Use restrictive security groups

Answer

Enable VPC Flow Logs

Question 11

A company is using an Application Load Balancer (ALB) to distribute traffic to a set of EC2 instances. Users report intermittent 503 errors. Which of the following is the MOST likely cause?

Accepted Answer

The target instances are not healthy or are overloaded.. Option C is correct because 503 errors from an ALB typically indicate that the target instances are not healthy or are overwhelmed, causing the ALB to return a 503 Service Unavailable response. Option A is wrong because security group rules blocking traffic would result in 504 errors, not 503. Option B is wrong because incorrect health check configuration can cause targets to be marked unhealthy, but the symptom is still 503; however, the most direct cause is unhealthy targets. Option D is wrong because SSL certificate issues cause 502 errors, not 503.

Answer

The health check interval is set too low, causing the ALB to mark instances as unhealthy prematurely.

Answer

The SSL certificate on the ALB has expired.

Answer

The security group for the ALB is blocking incoming traffic.

Question 12

A company wants to host a static website on AWS with high availability and low latency for global users. Which combination of services should be used?

Accepted Answer

Amazon S3 and Amazon CloudFront. Option A is correct because Amazon S3 can host static websites and Amazon CloudFront provides a CDN with edge locations for low latency and high availability. Option B is wrong because EC2 instances are not ideal for static websites and require more management. Option C is wrong because ELB is for dynamic content and not needed for static sites. Option D is wrong because Route 53 is a DNS service, not for hosting content.

Answer

Amazon EC2 and Elastic Load Balancing

Answer

Amazon Route 53 and Amazon S3

Answer

Elastic Load Balancing and Amazon CloudFront

Question 13

A company has a VPC with public and private subnets. A NAT Gateway is deployed in the public subnet to allow instances in the private subnet to access the internet. However, private instances cannot reach an external service at 203.0.113.50:443. What should be checked first?

Accepted Answer

The route table for the private subnet has a route 0.0.0.0/0 pointing to the NAT Gateway.. Option B is correct because the most common issue is that the route table for the private subnet does not have a default route pointing to the NAT Gateway. Option A is wrong because NACLs and security groups are stateful for NAT Gateway traffic, but the route table is the first thing to verify. Option C is wrong because the NAT Gateway's public IP is not relevant; the issue is routing. Option D is wrong because the internet gateway is needed for the NAT Gateway, but if private instances cannot reach the external service, the routing from the private subnet to the NAT Gateway is the primary suspect.

Answer

The NAT Gateway has an Elastic IP assigned.

Answer

The security group for the NAT Gateway allows inbound traffic from the private subnet.

Answer

The internet gateway is attached to the VPC.

Question 14

A company uses Amazon CloudFront to serve content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Users report that they can access the content via CloudFront but also directly via the S3 bucket URL. How can the company restrict direct access to the S3 bucket?

Accepted Answer

Update the S3 bucket policy to deny access to any principal other than the CloudFront service.. Option A is correct because an S3 bucket policy that denies all access except when the request includes a specific CloudFront header (via OAC) or is from the CloudFront service principal is the standard way to restrict direct access. Option B is wrong because removing the bucket policy would make the bucket public if ACLs allow, but OAC requires a bucket policy to allow CloudFront access. Option C is wrong because using a pre-signed URL is for temporary access, not for blocking direct access. Option D is wrong because OAC already restricts access to CloudFront only; the bucket policy must explicitly deny all other principals.

Answer

Disable OAC and use Origin Access Identity (OAI) instead.

Answer

Use pre-signed URLs for all S3 requests.

Answer

Remove the bucket policy and rely on ACLs.

Question 15

A company has deployed a web application across multiple Availability Zones using an Application Load Balancer. The application experiences increased latency during peak hours. Which action would be MOST effective in reducing latency?

Accepted Answer

Add more EC2 instances to the target group.. Option C is correct because enabling connection idle timeout can help free up resources by closing idle connections, but the most effective for latency is to add more targets. Option A is wrong because enabling cross-zone load balancing is already default and helps distribute traffic evenly. Option B is wrong because increasing the deregistration delay does not reduce latency. Option D is wrong because updating health checks does not directly reduce latency.

Answer

Update the health check to use a more frequent interval.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay for the target group.