SOA-C02 Networking and Content Delivery Practice Test 9 — 15 Questions

Question 1

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The VPC has a private subnet with EC2 instances that need to communicate with on-premises servers. The on-premises network team reports that they can ping the EC2 instances, but the EC2 instances cannot ping the on-premises servers. The SysOps administrator checks the route tables and finds that the VPC has a route to the on-premises CIDR via the virtual private gateway. The security groups allow all ICMP traffic. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The on-premises network does not have a route back to the VPC CIDR through the Direct Connect. If the on-premises servers can ping EC2 instances, traffic from on-premises to VPC is working. However, for EC2 to ping on-premises, the return traffic from on-premises must route back through Direct Connect. If the on-premises network lacks a route back to the VPC CIDR over Direct Connect, the traffic may go through the internet, causing the ping to fail. Option A is incorrect because the security groups are configured to allow all ICMP traffic, so outbound ICMP is not blocked. Option B is incorrect because the default network ACL allows all outbound traffic, and if a custom NACL were blocking outbound, it would need explicit deny rules; typically, this is not the most likely cause. Option D is incorrect because the VPC route table already has a route to the on-premises CIDR via the virtual private gateway, as stated in the scenario.

Answer

The security group on the EC2 instances blocks outbound ICMP

Answer

The network ACL for the private subnet blocks outbound traffic

Answer

The VPC route table does not have a route to the on-premises CIDR via the virtual private gateway

Question 2

A company uses Amazon Route 53 as its DNS service. They have a domain example.com with an alias record pointing to an Application Load Balancer (ALB). Recently, they updated the ALB's DNS name, but the Route 53 record was not updated. Users are still being directed to the old ALB, which has been decommissioned. The SysOps administrator updates the alias record to point to the new ALB DNS name. However, users still experience errors for several hours. What is the most likely reason?

Accepted Answer

The TTL on the DNS record is set too high, causing client-side caching. Alias records in Route 53 are not subject to TTL-based caching for the alias target resolution itself, but the DNS query response from the resolver to the client still includes a TTL value. When the TTL is set too high, clients and intermediate resolvers cache the old DNS response (pointing to the decommissioned ALB) for the duration of that TTL, causing continued errors even after the Route 53 record is updated. The alias record update propagates instantly within Route 53's authoritative infrastructure, but cached records at clients and recursive resolvers must expire before users reach the new ALB.

Answer

Route 53 requires time to propagate changes globally

Answer

The alias record was not saved correctly

Answer

The domain is using DNSSEC, which delays updates

Question 3

A company has a VPC with both IPv4 and IPv6 CIDR blocks. They have a public subnet with an EC2 instance that needs to be accessible over IPv6 from the internet. The instance has an IPv6 address assigned. The SysOps administrator has attached an Internet Gateway (IGW) to the VPC and added a route to the IGW for the public subnet's IPv6 route table. However, the instance is not reachable over IPv6. What is the missing configuration?

Accepted Answer

The security group attached to the instance does not allow inbound IPv6 traffic. The instance is not reachable over IPv6 because the security group attached to the instance does not have an inbound rule allowing IPv6 traffic. By default, security groups block all inbound traffic. Even though the IGW is attached and a route for ::/0 exists, without a security group rule permitting inbound IPv6 traffic (e.g., from ::/0 on the required port), the traffic will be dropped. The other options are incorrect: The instance already has an IPv6 address (A), the route table likely already has a default route to the IGW (B), and an egress-only IGW is for outbound-only traffic, not inbound (C). Therefore, the missing configuration is a security group rule allowing inbound IPv6 traffic.

Answer

The instance does not have a public IPv6 address assigned

Answer

The route table for the subnet does not have a default route (::/0) to the IGW

Answer

An egress-only Internet Gateway is required for IPv6

Question 4

A company has a web application running on EC2 instances behind an Application Load Balancer (ALB). The application uses sticky sessions (session affinity) based on cookies. Recently, the SysOps team noticed that user sessions are being lost intermittently, causing users to be logged out. The team checks the ALB configuration and finds that the stickiness is enabled with a cookie name 'AWSALB' and duration of 1 hour. The application also sets its own cookie. What is the most likely cause of session loss?

Accepted Answer

The application's session cookie has a shorter expiration than the ALB's stickiness duration. If the application's own session cookie has a shorter expiration than the ALB's stickiness duration (1 hour), the user's session will be lost when the application cookie expires, even though the ALB still routes the user to the same instance. The ALB's 'AWSALB' cookie manages stickiness, but the application's session cookie independently controls the user's login state. When the application cookie expires, the user is logged out, appearing as session loss. Option A is incorrect because health check interval does not directly cause session loss; it could cause session loss if an instance is marked unhealthy, but that is not the most likely cause here. Option B is incorrect because the ALB's 'AWSALB' cookie is set by the ALB and is not overwritten by the application cookie; they are separate. Option C is incorrect because cross-zone load balancing does not affect stickiness; it only distributes traffic across availability zones.

Answer

The ALB's health check interval is too short, causing instances to be marked unhealthy

Answer

The application cookie is overwriting the ALB's stickiness cookie

Answer

Cross-zone load balancing is disabled on the ALB

Question 5

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. Users report intermittent 503 errors. The SysOps Administrator checks the ALB metrics and sees that the Sum of HTTP 503s correlates with spikes in CPU utilization on the EC2 instances. What is the MOST likely cause and solution?

Accepted Answer

Configure the Auto Scaling group to scale out based on average CPU utilization and ensure sufficient capacity.. The 503 errors correlate with CPU spikes, indicating the instances are overwhelmed. Configuring Auto Scaling to scale based on average CPU utilization ensures that capacity is added when needed, preventing 503s. Option A is wrong: disabling cross-zone load balancing would not help; it might unevenly distribute traffic. Option C is wrong: increasing the deregistration delay would not mitigate overload; it only affects instances being deregistered. Option D is wrong: decreasing the health check interval would mark instances unhealthy more quickly, potentially increasing 503s.

Answer

Disable cross-zone load balancing on the ALB.

Answer

Increase the deregistration delay on the ALB target group to allow in-flight requests to complete.

Answer

Decrease the health check interval to detect unhealthy instances faster.

Question 6

A company has a VPC that requires DNS resolution for custom domain names within the VPC. They want to use a private hosted zone in Amazon Route 53. Which resource is required to associate the private hosted zone with the VPC?

Accepted Answer

A VPC. To associate a private hosted zone with a VPC in Amazon Route 53, you must specify the VPC ID and the AWS Region of the VPC. The VPC itself is the required resource because the private hosted zone is scoped to one or more VPCs, enabling DNS resolution for custom domain names only within those VPCs. Without a VPC association, the private hosted zone cannot serve DNS queries.

Answer

A resolver rule

Answer

A public hosted zone

Answer

A CNAME record

Question 7

A SysOps Administrator is setting up a VPC peering connection between two VPCs (VPC-A and VPC-B) in different AWS accounts. After the peering connection is accepted, instances in VPC-A cannot ping instances in VPC-B. Both VPCs have non-overlapping CIDR blocks. What is the MOST likely cause?

Accepted Answer

The route tables in both VPCs do not have routes to the peer VPC CIDR.. The most likely cause is that the route tables in both VPCs do not have routes to the peer VPC CIDR. Even after a VPC peering connection is accepted, traffic cannot flow between the VPCs unless explicit routes are added to each VPC's route table pointing to the CIDR block of the peer VPC, with the VPC peering connection as the target. Without these routes, instances in VPC-A have no path to reach instances in VPC-B, so ping fails.

Answer

VPC peering does not support cross-account connections.

Answer

The CIDR blocks overlap, causing routing conflicts.

Answer

The security groups in VPC-B do not allow inbound ICMP traffic from VPC-A.

Question 8

A company has a web application behind an Application Load Balancer (ALB) in a VPC. The application needs to authenticate users using an external identity provider (IdP). The SysOps Administrator recommends using Amazon Cognito as an identity broker. Which ALB action should be configured to authenticate users before forwarding requests to the target group?

Accepted Answer

An authenticate action using Amazon Cognito as the user pool.. Amazon Cognito integrates directly with Application Load Balancers via an authenticate action. When you configure an ALB rule with an authenticate action using a Cognito user pool, the ALB handles the OAuth 2.0 / OpenID Connect flow with the external IdP, obtains tokens, and only forwards authenticated requests to the target group. This eliminates the need for custom authentication logic in the application.

Answer

A fixed-response action to return a 401 status code.

Answer

A redirect action to the IdP login page.

Answer

A forward action to the target group.

Question 9

A company uses Amazon CloudFront to deliver static content from an Amazon S3 bucket. Users in Europe report slow load times. Which CloudFront feature would MOST effectively improve performance for these users?

Accepted Answer

Add additional edge locations in Europe and use regional edge caches.. Adding additional edge locations in Europe and using regional edge caches (Option B) reduces latency by serving content from geographically closer points of presence (PoPs) and by caching objects at a regional layer that aggregates requests from multiple edge locations, which improves cache hit ratios and reduces the load on the origin. This directly addresses the slow load times reported by European users by minimizing the distance data must travel.

Answer

Enable origin shield.

Answer

Enable HTTP/3 (QUIC) support on the distribution.

Answer

Configure geo restriction to allow only European users.

Question 10

A SysOps Administrator is troubleshooting connectivity issues between two EC2 instances in the same VPC but different subnets. The instances can communicate over private IP addresses when security groups are set to allow all traffic, but fail when security groups are configured with specific rules. The Administrator wants to allow HTTP (port 80) and HTTPS (port 443) traffic from the client instance to the server instance. What security group rules are needed?

Accepted Answer

Add inbound rules on the server to allow HTTP and HTTPS from the client security group.. Security groups are stateful, meaning that if you allow inbound traffic, the response outbound is automatically allowed regardless of outbound rules. Therefore, you only need to add inbound rules on the server instance to allow HTTP and HTTPS traffic from the client security group. Option B is incorrect because no inbound rules are needed on the client. Option C is incorrect because no outbound rules are needed on either instance for this traffic. Option D is incorrect because outbound rules on the server are not required.

Answer

Add inbound rules on both the client and server.

Answer

Add outbound rules on both the client and server.

Answer

Add inbound rules on the client and outbound rules on the server.

Question 11

A company is using Amazon Route 53 for DNS and wants to route traffic to multiple endpoints based on the geographic location of the user. Which routing policy should the SysOps Administrator use?

Accepted Answer

Geolocation routing. Geolocation routing (Option A) is correct because it allows Route 53 to route traffic based on the geographic location of the DNS query's source IP address. This is ideal for scenarios where you need to direct users to specific endpoints based on their country, continent, or even US state, such as complying with data sovereignty laws or delivering localized content.

Answer

Weighted routing

Answer

Failover routing

Answer

Latency routing

Question 12

A SysOps Administrator is configuring a Network Load Balancer (NLB) for a TCP-based application. The application requires that clients see the original source IP address of the request. Which configuration should the Administrator use?

Accepted Answer

Use the NLB default behavior; no additional configuration needed.. Network Load Balancers (NLBs) preserve the original source IP address of clients by default when forwarding TCP traffic to targets. This is because NLBs operate at Layer 4 and do not terminate the TCP connection; instead, they pass packets directly to the backend, allowing the target to see the client's IP. No additional configuration is required for this behavior.

Answer

Use an Application Load Balancer instead, which preserves the source IP.

Answer

Enable cross-zone load balancing on the NLB.

Answer

Enable Proxy Protocol v2 on the target group.

Question 13

A company is designing a highly available architecture using an Application Load Balancer (ALB) with multiple target groups. Which TWO statements are correct regarding ALB routing?

Accepted Answer

An ALB can route requests to different target groups based on the URL path.. An Application Load Balancer (ALB) supports path-based routing, allowing you to define rules that forward requests to different target groups based on the URL path (e.g., /api to one group and /images to another). Option E is correct because ALB also supports host-based routing, enabling you to route traffic based on the Host header in the HTTP/HTTPS request, which is essential for multi-domain or multi-tenant architectures.

Answer

An ALB can route requests based on the client IP address.

Answer

An ALB can route requests based on the source TCP port.

Answer

An ALB can only be configured with an IPv4 listener.

Question 14

A SysOps Administrator is configuring VPC Flow Logs to monitor network traffic. Which THREE pieces of information are included in VPC Flow Log records?

Accepted Answer

Protocol number. VPC Flow Logs capture metadata about network traffic, including source IP address (C), destination IP address (E), and protocol number (B). They do not include HTTP status codes (A) or DNS query names (D), as those are application-layer details beyond the scope of network flows.

Answer

HTTP status code

Answer

DNS query name

Question 15

A company wants to use Amazon CloudFront to distribute content globally with low latency. Which TWO features of CloudFront help achieve this?

Accepted Answer

Regional edge caches that provide additional caching layers. CloudFront uses both edge locations and regional edge caches to cache content closer to users, reducing latency. Edge locations are the primary cache points near end users, while regional edge caches provide an additional caching layer to improve cache hit ratios. Option C is incorrect because S3 Transfer Acceleration is for speeding up uploads to S3, not for CloudFront delivery. Option D is wrong since VPC peering is used for private network connectivity between VPCs, not for content delivery. Option E is incorrect because AWS Global Accelerator improves availability and performance for TCP/UDP applications, but it is not a feature of CloudFront; CloudFront is a CDN with its own edge network.

Answer

Use of S3 Transfer Acceleration

Answer

VPC peering to connect to origins

Answer

Integration with AWS Global Accelerator