SOA-C02 Networking and Content Delivery Practice Test 8 — 15 Questions

Question 1

A SysOps administrator is designing a VPC with public and private subnets. The private subnets need to access the internet for software updates. Which THREE components are required to achieve this?

Accepted Answer

An Internet Gateway attached to the VPC. To enable private subnets to access the internet for software updates, three components are required: an Internet Gateway attached to the VPC (Option B) to allow traffic to and from the internet; a NAT Gateway in a public subnet (Option C) to translate private IP addresses to a public IP for outbound traffic; and a route table in the private subnet with a default route pointing to the NAT Gateway (Option E) so that traffic from private instances is directed through the NAT Gateway. Option A (VPC Gateway Endpoint) is incorrect because it only provides access to specific AWS services like S3, not general internet access. Option D (Site-to-Site VPN) is incorrect because it is used for connecting on-premises networks, not for internet access.

Answer

A VPC Gateway Endpoint

Answer

A Site-to-Site VPN connection

Question 2

Refer to the exhibit. A company has an S3 bucket policy as shown. The SysOps administrator notices that users from the allowed IP range (192.0.2.0/24) can access objects, but users outside that range are denied. However, a CloudFront distribution with an origin access identity (OAI) is also unable to access the bucket and receives 'Access Denied'. What is the MOST likely cause?

Accepted Answer

The condition aws:SourceIp restricts access based on the requestor's IP, not the CloudFront IP.. The bucket policy uses the 'aws:SourceIp' condition key, which evaluates the IP address of the requester. When requests come via CloudFront, the IP address seen by S3 is the CloudFront edge server IP, not the original client IP. Therefore, even though the CloudFront OAI is used, the request is blocked because the CloudFront IP is not within the allowed range (192.0.2.0/24). To allow CloudFront access while restricting direct access, the policy should use a condition that checks the OAI ARN (e.g., 'aws:SourceArn') rather than the source IP. Option A is incorrect because the OAI is indeed allowed via the principal, but the IP condition overrides it. Option B is incorrect because the policy does allow 's3:GetObject' for the OAI. Option D is incorrect because the OAI is configured in the policy (as the principal), but the IP condition prevents its access.

Answer

The policy does not allow 's3:GetObject' for the CloudFront OAI.

Answer

The CloudFront distribution is not in the allowed IP range.

Answer

The CloudFront OAI is not configured in the bucket policy.

Question 3

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) across three Availability Zones. Each AZ has one public and one private subnet. The EC2 instances are in the private subnets. The ALB is internet-facing. Recently, during a traffic spike, some users experienced intermittent timeouts. The SysOps administrator reviews the ALB access logs and finds that the timeouts correspond to periods when the target group had 'unhealthy' instances. The health check is configured to check a health endpoint on port 80 with a path of '/health'. The SysOps administrator checks the EC2 instances and finds that the health endpoint responds correctly. However, the health checks are failing intermittently. The administrator notices that the security group for the EC2 instances allows inbound traffic from the ALB's security group on port 80. The network ACL for the private subnets allows inbound HTTP and outbound ephemeral ports. What is the MOST likely cause of the health check failures?

Accepted Answer

The network ACL for the private subnets is blocking the return traffic from health checks.. The most likely cause is that the network ACL (NACL) for the private subnets is blocking the return traffic from health checks. NACLs are stateless and must allow both inbound and outbound traffic separately. While the inbound rule allows HTTP (port 80) from the ALB, the outbound rule must allow ephemeral ports (1024-65535) for the return traffic. Without this outbound rule, the health check responses from the EC2 instances are dropped, causing intermittent health check failures. Option A is incorrect because the health endpoint responds correctly as stated. Option B is incorrect because the security group allows traffic from the ALB's security group. Option C is incorrect because cross-zone load balancing does not affect health checks.

Answer

The health check endpoint on the EC2 instances is not responding correctly.

Answer

The security group on the EC2 instances is blocking health check traffic from the ALB.

Answer

The ALB does not have cross-zone load balancing enabled.

Question 4

A company has a VPC with a CIDR block of 10.0.0.0/16. The VPC has two public subnets (10.0.1.0/24 and 10.0.2.0/24) and two private subnets (10.0.3.0/24 and 10.0.4.0/24). The VPC has an Internet Gateway (IGW) attached. The public subnets have a route to the IGW, and the private subnets have a route to a NAT Gateway in the public subnet 10.0.1.0/24. The SysOps administrator deploys a new EC2 instance in the private subnet 10.0.4.0/24. The instance needs to download software from the internet, but the download fails. The administrator can successfully ping the NAT Gateway from the instance. What is the MOST likely cause of the failure?

Accepted Answer

The route table for the private subnet does not have a default route to the NAT Gateway.. The most likely cause is that the route table for the private subnet 10.0.4.0/24 does not have a default route (0.0.0.0/0) pointing to the NAT Gateway. Without this route, internet-bound traffic from the EC2 instance is not forwarded to the NAT Gateway, causing the download to fail. The ping to the NAT Gateway works because it's within the VPC and does not require the default route. Option A is incorrect because security groups by default allow all outbound traffic, so they would not block the download. Option C is incorrect because network ACLs are stateless and by default allow outbound traffic; the issue is routing, not ACL rules. Option D is incorrect because the NAT Gateway must have an Elastic IP to function, and if it didn't, the ping would also fail; the problem is routing, not the Elastic IP association.

Answer

The security group for the EC2 instance blocks outbound internet traffic.

Answer

The network ACL for the private subnet blocks outbound traffic.

Answer

The NAT Gateway is not associated with an Elastic IP address.

Question 5

A company uses Amazon CloudFront to deliver video content to users worldwide. The content is stored in an S3 bucket. The SysOps administrator notices that users in some geographic regions experience high latency when loading the video. The administrator wants to improve the performance for these users without changing the existing infrastructure. The CloudFront distribution is configured with the default cache behavior. What is the MOST cost-effective solution to reduce latency for users in those regions?

Accepted Answer

Change the CloudFront distribution's price class to include all edge locations.. CloudFront's Price Class All includes all edge locations worldwide, reducing latency for users in all regions without changing the existing infrastructure. Option A is wrong because increasing cache TTL does not reduce latency for initial requests; it only increases the time content stays cached. Option C is wrong because adding more S3 buckets in different regions and configuring multiple origins increases complexity and cost, and is not the most cost-effective solution. Option D is wrong because using multiple CloudFront distributions increases cost and management overhead, and is not necessary when a single distribution with Price Class All can cover all regions.

Answer

Increase the cache TTL for the content.

Answer

Add additional S3 buckets in different regions and configure multiple origins.

Answer

Use multiple CloudFront distributions for different geographic regions.

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB) in a VPC. Users report slow load times. The SysOps team notices that all traffic goes to a single availability zone. Which action should be taken to improve performance and reliability?

Accepted Answer

Configure the ALB to use subnets in at least two Availability Zones. The correct action is to configure the ALB to use subnets in at least two Availability Zones. An ALB is a regional service that requires subnets in multiple AZs to distribute incoming traffic across healthy targets in those zones. When all traffic goes to a single AZ, it indicates the ALB is only attached to one subnet, creating a single point of failure and limiting the pool of EC2 instances that can serve traffic, which directly causes slow load times and reduced reliability.

Answer

Add more EC2 instances in the same Availability Zone

Answer

Replace the ALB with a Network Load Balancer (NLB)

Answer

Enable cross-zone load balancing on the ALB

Question 7

A SysOps administrator needs to allow an EC2 instance in a private subnet to download patches from the internet. Which AWS service should be used to achieve this securely?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in private subnets to initiate outbound traffic to the internet, while preventing inbound traffic from the internet. Option A is wrong because an Internet Gateway is for public subnets. Option C is wrong because a VPC Peering connection connects VPCs, not to the internet. Option D is wrong because a VPN connection connects to on-premises networks, not the internet.

Answer

Internet Gateway (IGW)

Answer

AWS VPN

Answer

VPC Peering

Question 8

An application hosted on EC2 instances behind an ALB is experiencing intermittent connectivity errors. The ALB target group is configured with health checks on port 80. The SysOps team notices that the EC2 instances pass health checks but clients still receive 503 errors. What is the most likely cause?

Accepted Answer

Security groups or network ACLs are blocking traffic from the ALB to the instances. If security groups or network ACLs block traffic from the ALB to the instances, the ALB may still mark them as healthy if the health check is coming from a different source IP, but actual client traffic is blocked. Option A is wrong because a high deregistration delay would cause instances to remain in service during shutdown, but it does not cause 503 errors when instances are healthy. Option B is wrong because having the ALB in only one AZ could cause issues if that AZ fails, but it would not typically cause 503 errors for all clients; rather, it would affect availability. Option C is wrong because if the target group were empty, health checks would fail and instances would not be healthy, but the question states instances pass health checks.

Answer

The deregistration delay is too high

Answer

The ALB is only configured in one Availability Zone

Answer

The target group is empty

Question 9

A SysOps administrator is troubleshooting DNS resolution issues for a custom domain used by an Application Load Balancer. Which TWO steps should the administrator take to diagnose the issue? (Choose two.)

Accepted Answer

Verify that the Route 53 alias record points to the ALB's DNS name. A Route 53 alias record must point to the ALB's DNS name (e.g., my-alb-1234567890.us-east-1.elb.amazonaws.com) to properly route traffic to the load balancer. If the alias record is misconfigured or points to an incorrect resource, DNS resolution will fail or resolve to an unintended IP, causing the custom domain not to work.

Answer

Ensure the VPC's CIDR block does not overlap with the ALB's IP range

Answer

Verify that the ALB's security group allows inbound traffic on port 443

Answer

Check the health status of the ALB's target group

Question 10

A company has a VPC with public and private subnets in two Availability Zones. The private subnets need outbound internet access for EC2 instances to download updates. Which THREE components are required to achieve this? (Choose three.)

Accepted Answer

Route table in the private subnets with a default route pointing to the NAT Gateway. A route table associated with private subnets must have a default route (0.0.0.0/0) pointing to a NAT Gateway to direct outbound internet traffic from EC2 instances through the NAT device. This allows instances in private subnets to initiate outbound connections to the internet (e.g., for software updates) while preventing unsolicited inbound connections from the internet.

Answer

Egress-only Internet Gateway

Answer

AWS Site-to-Site VPN connection

Question 11

A SysOps administrator needs to troubleshoot connectivity between two EC2 instances in the same VPC but different subnets. The instances cannot communicate. Which THREE checks should the administrator perform? (Choose three.)

Accepted Answer

Verify that the network ACLs for both subnets allow the required traffic. Correct answers: A, C, and E. Option A is correct because network ACLs (NACLs) at the subnet level can block traffic between subnets, so verifying both subnet NACLs is necessary. Option C is correct because security groups (SGs) at the instance level control inbound/outbound traffic; if SGs don't allow the required ports, instances cannot communicate. Option E is correct because route tables in each subnet must have routes to the other subnet's CIDR for traffic to be forwarded. Option B (flow logs) is a monitoring tool, not a cause. Option D (NAT Gateway) is used for outbound internet access, not internal VPC communication.

Answer

Enable VPC Flow Logs to analyze traffic

Answer

Verify that the NAT Gateway is configured correctly

Question 12

A SysOps administrator notices that an EC2 instance is not receiving traffic from an Application Load Balancer (ALB). The ALB is healthy and the target group shows the instance as healthy. The exhibit shows the network interface attached to the instance. What is the likely cause of the issue?

Accepted Answer

The instance's security group does not allow inbound traffic from the ALB. The instance's security group must allow inbound traffic from the ALB. The exhibit shows the network interface attached to the instance, and the security group (sg-12345678) is likely the default security group, which typically does not allow HTTP/HTTPS traffic. Option C is correct because the security group acts as a virtual firewall for the instance. Options A, B, and D are incorrect: A) source/destination check is irrelevant for ALB traffic destined to the instance; B) the subnet type does not directly prevent ALB traffic as long as routing is correct; D) network ACLs are stateless and if inbound traffic is denied, outbound return traffic would also be affected, but the instance is not receiving traffic at all, indicating a security group issue.

Answer

The source/destination check is enabled on the network interface

Answer

The network interface is in a private subnet

Answer

The network ACL of the subnet denies inbound traffic

Question 13

A company runs a multi-tier web application in a VPC with public and private subnets. The web servers (EC2 instances) are in public subnets, and the database servers (RDS MySQL) are in private subnets. The web servers need to connect to the database servers on port 3306. The security group for the RDS instances (sg-db) has an inbound rule allowing TCP port 3306 from the security group of the web servers (sg-web). The web servers can connect to the database, but the connection is intermittent and slow. The SysOps administrator checks the network ACLs and finds that both the public and private subnet network ACLs have default allow all entries. What is the most likely cause of the issue?

Accepted Answer

The network ACL for the private subnet does not have an outbound rule to allow return traffic on ephemeral ports. Network ACLs are stateless, meaning they evaluate inbound and outbound traffic separately. The security group on the RDS instances allows inbound traffic on port 3306 from the web servers' security group, so requests from the web servers reach the database. However, the response traffic from the database back to the web servers uses ephemeral ports. If the private subnet's NACL does not have an outbound rule allowing this return traffic, the responses are dropped, causing intermittent and slow connections. Option A is incorrect because RDS in a private subnet can receive traffic from public subnets if allowed by security groups and NACLs. Option B is incorrect because the security group rule is already configured correctly using security group IDs. Option D is incorrect because NACLs are stateless, not stateful.

Answer

The RDS instances are in a private subnet and cannot receive traffic from public subnets

Answer

The security group for the RDS instances is missing an inbound rule for port 3306 from the web servers' IP range

Answer

The network ACLs are stateful and require an outbound rule for ephemeral ports

Question 14

A company has deployed a global web application using AWS CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is in a single AWS region. Users in different geographic regions report high latency, and some users are unable to access the application. The SysOps administrator verifies that the CloudFront distribution is configured correctly and that the ALB is healthy. The administrator also confirms that the ALB's security group allows traffic from the CloudFront IP ranges. What is the most likely cause of the issue?

Accepted Answer

The ALB is overwhelmed by the number of concurrent connections from CloudFront. The ALB in a single region can become overwhelmed by the high volume of concurrent connections from CloudFront's global edge locations, even though the security group allows traffic from CloudFront IP ranges. This can cause high latency and access failures for users in different regions. Option B is incorrect because CloudFront caching typically reduces the load on the origin by serving cached content at edge locations. Option C is incorrect because CloudFront distributions support HTTP and HTTPS protocols, not TCP/UDP, and the protocol used does not explain the regional latency issue. Option D is incorrect because the SSL/TLS certificate on the ALB must be trusted by CloudFront for HTTPS connections, but this would not cause intermittent access issues across regions if the distribution is configured correctly.

Answer

CloudFront is not caching content, causing all requests to go to the origin

Answer

The CloudFront distribution is using TCP instead of HTTP, causing higher latency

Answer

The SSL/TLS certificate on the ALB is not trusted by CloudFront

Question 15

A company has a VPC with a CIDR block of 10.0.0.0/16. They have two subnets: a public subnet (10.0.1.0/24) and a private subnet (10.0.2.0/24). An EC2 instance in the private subnet needs to access an S3 bucket to store logs. The instance currently has no internet access. The SysOps administrator has created a VPC endpoint for S3 (gateway type) and attached it to the VPC. The instance still cannot reach S3. What additional step is required?

Accepted Answer

Add a route in the private subnet's route table pointing to the S3 endpoint. For a gateway VPC endpoint for S3, you must add a route in the private subnet's route table pointing to the S3 prefix list (the endpoint). This enables traffic from the instance to S3 without going through the internet. Option A is wrong because an internet gateway is not needed; the endpoint provides private connectivity. Option B is wrong because security groups do not apply to traffic destined for S3 via a gateway endpoint; the traffic stays within AWS. Option C is wrong because the endpoint policy already allows all S3 actions by default, so modifying it is unnecessary.

Answer

Attach an Internet Gateway to the VPC and add a route to it

Answer

Add a security group rule to allow outbound HTTPS traffic to S3

Answer

Modify the endpoint policy to allow all S3 actions