SOA-C02 Networking and Content Delivery Practice Test 9 — 15 Questions

Question 1

EC2 instances in private subnets need to access S3 buckets. Currently the instances use a NAT Gateway to reach S3 over the internet. The team wants to keep S3 traffic private (within the AWS network) and reduce NAT Gateway data processing costs. What is the correct solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an S3 Gateway VPC endpoint and add it to the private subnet's route table; S3 traffic will bypass the NAT Gateway. An S3 Gateway VPC endpoint allows EC2 instances in private subnets to access S3 privately using AWS’s internal network, bypassing the NAT Gateway entirely. This eliminates NAT data processing costs and keeps traffic within the AWS backbone, as the endpoint is added to the private subnet’s route table with a prefix list for S3, directing traffic directly to S3 without internet routing.

Answer

Create an S3 Interface VPC endpoint in the private subnet to route S3 traffic privately

Answer

Add a route in the private subnet's route table directing all traffic (0.0.0.0/0) to an Internet Gateway

Answer

Use S3 Transfer Acceleration to route traffic over AWS edge locations instead of NAT

Question 2

A web application is deployed in us-east-1 (primary) and eu-west-1 (standby). Under normal conditions, all traffic should go to us-east-1. If the us-east-1 health check fails, traffic must automatically redirect to eu-west-1 within 30 to 60 seconds. What Route 53 configuration implements this?

Accepted Answer

Create failover routing records for the domain: a Primary record pointing to us-east-1 with a Route 53 health check, and a Secondary record pointing to eu-west-1 with no health check. Route 53 failover routing records, combined with a health check on the primary record, automatically redirect traffic to the secondary (standby) record when the primary health check fails. The health check interval and failure threshold can be configured to detect failure within 30–60 seconds, meeting the requirement without manual intervention.

Answer

Use weighted routing with 100 weight for us-east-1 and 0 weight for eu-west-1; update the weights via Lambda when a CloudWatch alarm fires

Answer

Enable Route 53 latency routing with records for both regions; Route 53 will automatically switch to eu-west-1 when us-east-1 becomes unavailable

Answer

Configure Route 53 geolocation routing to send all US traffic to us-east-1 and all European traffic to eu-west-1

Question 3

Users are intermittently reporting 502 Bad Gateway errors when accessing the application through an Application Load Balancer. The team needs to identify which target IPs are associated with the failures and the request processing time for those requests. Application logs on instances do not capture failures before the ALB connection. What should be enabled?

Accepted Answer

Enable ALB access logs, specify an S3 bucket destination, and query the logs to filter on elb_status_code=502. ALB access logs capture detailed information about each request, including the target IP address, request processing time, and the HTTP status code returned by the ALB. By enabling these logs and querying for `elb_status_code=502`, you can identify which target IPs were associated with the failures and the `request_processing_time` for those requests. This directly addresses the need to correlate failures with specific targets and timing, without relying on application instance logs that miss pre-connection failures.

Answer

Enable AWS X-Ray on the ALB to trace each request end-to-end from client to target

Answer

Configure a VPC Flow Log on the subnets containing the ALB to capture all network traffic

Answer

Install an agent on the application instances that logs all incoming connection attempts from the ALB

Question 4

A security team applied Network ACL rules to a subnet to allow inbound TCP traffic on port 443 (HTTPS). Users connecting from the internet can initiate connections, but they never receive responses. The NACL is applied to the subnet containing the web servers. What is missing?

Accepted Answer

Add an outbound NACL rule allowing TCP on destination ports 1024–65535 to permit response traffic to clients' ephemeral ports. Network ACLs are stateless, meaning they evaluate each packet independently without tracking connection state. While the inbound rule allows HTTPS traffic (TCP 443) to reach the web servers, the outbound response traffic from the servers to the clients' ephemeral ports (typically 1024–65535) is blocked by the default deny-all outbound rule. Adding an outbound NACL rule allowing TCP traffic on destination ports 1024–65535 permits the response traffic to flow back to the clients, resolving the issue.

Answer

Enable stateful packet inspection on the NACL by toggling the 'track connections' setting in the VPC console

Answer

Add a security group outbound rule allowing all traffic because NACL rules only apply to inbound traffic

Answer

Change port 443 to allow both TCP and UDP protocols in the inbound NACL rule

Question 5

Drag and drop the steps to enable AWS CloudTrail logging for a specific S3 bucket into the correct order.

Accepted Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.. First create a log bucket with proper policy, then create the trail and configure it to log events for the target bucket.

Answer

Step 2: Create a CloudTrail trail.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.

Answer

Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 2: Create a CloudTrail trail.

Answer

Step 2: Create a CloudTrail trail.
Step 3: Configure the trail to enable data events for the specific S3 bucket.
Step 1: Create an S3 bucket to store CloudTrail logs with appropriate bucket policy.

Question 6

Match each AWS database service to its type.

Accepted Answer

Amazon RDS: Relational database. The correct matches are: Amazon RDS with relational database, Amazon DynamoDB with NoSQL key-value and document database, Amazon Redshift with data warehouse, and Amazon ElastiCache with in-memory cache. Common confusions include mistaking RDS for NoSQL or Redshift for caching.

Answer

Amazon RDS: NoSQL key-value and document database

Answer

Amazon Redshift: In-memory cache

Question 7

A company uses Amazon CloudFront to deliver its static website hosted on Amazon S3. The security team notices that users are able to access the S3 bucket directly via the S3 endpoint, bypassing CloudFront. What should be done to ensure that content is only accessible through CloudFront?

Accepted Answer

Create an origin access identity (OAI) and update the S3 bucket policy to grant access only to the OAI. An Origin Access Identity (OAI) is a special CloudFront user that can be associated with a CloudFront distribution. By updating the S3 bucket policy to grant read access only to that OAI's canonical user ID, the bucket becomes inaccessible via direct S3 endpoints, while CloudFront can still fetch and serve the content. This enforces that all traffic must go through CloudFront.

Answer

Use AWS WAF to block requests that do not include the CloudFront distribution's domain name

Answer

Create an AWS Lambda@Edge function to validate headers

Answer

Use S3 Block Public Access to prevent all public access

Question 8

A SysOps administrator is troubleshooting connectivity issues between an Amazon EC2 instance in a VPC and an on-premises data center connected via AWS Direct Connect. The EC2 instance can reach other instances in the same VPC but cannot reach the on-premises network. The virtual private gateway (VGW) is attached to the VPC and the Direct Connect virtual interface is up. Which configuration step should the administrator verify first?

Accepted Answer

Add a route in the VPC route table for the on-premises CIDR pointing to the virtual private gateway. For an EC2 instance to reach an on-premises network via Direct Connect, the VPC route table must contain a route for the on-premises CIDR block pointing to the virtual private gateway (VGW). Since the instance can reach other VPC instances, local routing works; the missing piece is the route to the on-premises destination. Without this route, traffic has no path to the VGW and is dropped.

Answer

Check the security group rules for the EC2 instance

Answer

Confirm that the Direct Connect virtual interface is associated with the correct VLAN

Answer

Verify the network ACL inbound and outbound rules for the VPC subnet

Question 9

A company is designing a highly available architecture for a web application using an Application Load Balancer (ALB) across multiple Availability Zones. Which configuration ensures that traffic is distributed evenly across all healthy targets?

Accepted Answer

Enable cross-zone load balancing on the ALB. Cross-zone load balancing enables the ALB to distribute incoming traffic evenly across all healthy targets in all enabled Availability Zones, rather than sending traffic only to targets within the same zone as the requesting client. By default, ALBs distribute traffic equally across zones first, then round-robin within each zone, which can lead to uneven load if target counts differ per zone. Enabling cross-zone load balancing overrides this behavior, ensuring each healthy target receives an equal share of requests regardless of its zone.

Answer

Configure sticky sessions (session affinity) on the target group

Answer

Use a Network Load Balancer with path-based routing

Answer

Enable connection draining on the target group

Question 10

A SysOps administrator is setting up Amazon Route 53 for a domain that will be used for a web application. The application requires failover to a backup data center in another region if the primary becomes unhealthy. The administrator creates a failover routing policy with two records (primary and secondary) associated with health checks. After testing, the failover does not occur when the primary endpoint fails. What is the most likely cause?

Accepted Answer

The health check is configured to monitor the secondary endpoint instead of the primary. Failover routing relies on health checks to determine the health of the primary endpoint. If the health check is mistakenly configured to monitor the secondary endpoint, it will not assess the primary's health. Consequently, Route 53 will not trigger a failover to the secondary when the primary fails. Option A is incorrect because alias records are not required for failover; they are only needed for AWS resources. Option B is incorrect because the registrar's nameservers do not affect Route 53's failover logic once the domain is delegated. Option D is incorrect because while a high TTL can delay propagation, it does not prevent failover from occurring; failover depends on health check status, not TTL.

Answer

The primary record is not an alias record

Answer

The domain registrar's nameservers are not pointing to Route 53

Answer

The TTL on the primary record is set too high

Question 11

A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The SysOps administrator needs to restrict access to the ALB so that it only accepts requests from CloudFront. Which solution should the administrator implement?

Accepted Answer

Configure CloudFront to add a custom HTTP header to requests, and configure the ALB to only forward requests that contain that header. It uses a shared secret mechanism: CloudFront is configured to add a custom HTTP header (e.g., X-Origin-Verify) to all requests, and the ALB's listener rule is configured to only forward requests that contain that specific header value. This ensures that only requests originating from your CloudFront distribution reach the ALB, as the header is not present in direct client requests. This approach is recommended by AWS for restricting ALB access to CloudFront when the origin is an ALB, because CloudFront does not support Origin Access Identity (OAI) with ALB origins.

Answer

Replace the ALB with a Network Load Balancer and use a VPC endpoint

Answer

Create an origin access identity (OAI) and attach it to the CloudFront distribution

Answer

Add a security group rule to the ALB that allows traffic only from the CloudFront IP ranges

Question 12

A company has deployed a web application across multiple AWS regions and wants to use Amazon Route 53 to direct users to the region with the lowest latency. Which routing policy should the SysOps administrator use?

Accepted Answer

Latency routing policy. Latency routing policy is correct because it directs user traffic to the AWS region that provides the lowest network latency for the end user. Route 53 measures latency between the user's DNS resolver and each region's edge location, then responds with the IP of the region that has the lowest latency. This is ideal for multi-region deployments where the goal is to minimize response time.

Answer

Geolocation routing policy

Answer

Geoproximity routing policy

Answer

Weighted routing policy

Question 13

An organization has a VPC with public and private subnets. The private subnets need to access the internet for software updates. A NAT gateway is deployed in a public subnet and the private subnet route table has a route for 0.0.0.0/0 pointing to the NAT gateway. However, instances in the private subnet cannot reach the internet. What could be the issue?

Accepted Answer

The NAT gateway's subnet does not have a route to an internet gateway. The NAT gateway must be in a public subnet with a route table that includes a default route (0.0.0.0/0) pointing to an internet gateway (IGW). Without this route, the NAT gateway cannot forward traffic from the private subnet to the internet, because the IGW is the only way to reach public IP addresses. The question states the NAT gateway is deployed in a public subnet, but if that subnet's route table lacks the IGW route, outbound traffic from the NAT gateway will fail.

Answer

The private subnet's network ACL blocks outbound HTTPS traffic

Answer

The security group attached to the NAT gateway does not allow outbound traffic

Answer

The private instances do not have a public IP address assigned

Question 14

A SysOps administrator is configuring Amazon CloudFront to serve content from an Amazon S3 bucket. The content is sensitive and should be encrypted at rest. Which option ensures that content is encrypted at rest in S3?

Accepted Answer

Enable server-side encryption (SSE-S3) on the S3 bucket. Enabling server-side encryption (SSE-S3) on the S3 bucket ensures that objects are encrypted at rest using AES-256 encryption managed by Amazon S3. This directly addresses the requirement for content to be encrypted while stored in S3, independent of how CloudFront accesses the bucket.

Answer

Enable CloudFront HTTPS-only access to the S3 bucket

Answer

Configure signed URLs for the distribution

Answer

Use CloudFront field-level encryption

Question 15

Which TWO actions can a SysOps administrator take to improve the availability of a web application using an Application Load Balancer (ALB) and EC2 instances? (Choose two.)

Accepted Answer

Configure health checks on the target group. Health checks allow the ALB to automatically detect unhealthy EC2 instances and stop routing traffic to them, which prevents failed requests from reaching users. By configuring health checks on the target group, the ALB can mark instances as unhealthy based on criteria like HTTP response codes or timeout thresholds, and then route traffic only to healthy instances. This directly improves availability by ensuring that requests are not sent to failed or degraded instances.

Answer

Place all instances in a single subnet to reduce latency

Answer

Use larger instance types to handle more traffic

Answer

Increase the deregistration delay (connection draining) timeout