SOA-C02 Networking and Content Delivery Practice Test 9 — 15 Questions

Question 1

A company has a VPN connection between its on-premises network and AWS VPC. The VPN tunnel shows status as UP, but traffic is not flowing from on-premises to the VPC. Which configuration should be checked?

Accepted Answer

The route tables in the VPC have routes pointing to the virtual private gateway for the on-premises CIDR.. Option B is correct because the route tables in the VPC must have routes pointing to the virtual private gateway for the on-premises network. Without them, traffic from the VPC to on-premises will not be routed. Option A is wrong because the tunnel state is UP, indicating Phase 1 and Phase 2 are fine. Option C is wrong because the customer gateway device must have correct routing, but the question is about VPC side. Option D is wrong because security groups control traffic to/from instances, but if routing is missing, traffic won't reach the VPN.

Answer

The IKE versions on the customer gateway and virtual private gateway match.

Answer

The customer gateway device is configured to forward traffic to the VPC.

Answer

The security groups allow inbound traffic from the on-premises network.

Question 2

A company wants to provide low-latency access to a web application for users in North America and Europe. The application runs on EC2 instances in us-east-1 and eu-west-1. Which AWS service should be used to route users to the nearest region?

Accepted Answer

Amazon Route 53 with latency-based routing. Option D is correct because Amazon Route 53 with latency-based routing directs traffic to the region with the lowest latency for the user. Option A is wrong because Global Accelerator improves performance but does not route based on latency to nearest region; it uses Anycast. Option B is wrong because CloudFront is a CDN for content delivery, not for routing to regional endpoints. Option C is wrong because ALB is region-specific and cannot route across regions.

Answer

Application Load Balancer with cross-region load balancing

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Question 3

A company has a VPC with a public subnet and a private subnet. An Amazon RDS for MySQL database is deployed in the private subnet. Which TWO steps are required to allow an EC2 instance in the public subnet to connect to the database? (Choose two.)

Accepted Answer

Update the security group for the RDS instance to allow inbound traffic on port 3306 from the EC2 instance's security group.. Options B and D are correct: The security group for the RDS instance must allow inbound MySQL traffic (port 3306) from the EC2 instance (or its security group). The route table for the private subnet does not need a NAT Gateway because the connection is initiated from the public subnet; however, the public subnet instance needs a route to the private subnet, which is automatically there because both are in the same VPC. Option A is wrong because the RDS instance does not need a public IP; it can be accessed from within the VPC using its private IP. Option C is wrong because the EC2 instance already has a public IP or can be accessed via internet, but the route to the private subnet is implicit. Option E is wrong because a NAT Gateway is for outbound internet access from private subnets, not for inbound connections.

Answer

Deploy a NAT Gateway in the public subnet to allow the EC2 instance to communicate with the RDS instance.

Answer

Assign a public IP address to the RDS instance.

Answer

Add a route to the public subnet's route table for the RDS subnet CIDR.

Question 4

A company is using Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is configured with HTTPS listeners. Users report that some requests are failing with a 502 error. Which THREE steps should the SysOps administrator take to troubleshoot the issue? (Choose three.)

Accepted Answer

Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.. The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.

Answer

Configure the CloudFront distribution to use a custom error response for 502 errors.

Answer

Verify that the ALB is configured to use the X-Forwarded-For header to route requests.

Question 5

A company is using Amazon Route 53 with a private hosted zone for internal DNS resolution within a VPC. The VPC is connected to an on-premises network via a VPN. On-premises resources cannot resolve DNS names in the private hosted zone. Which TWO actions should be taken to resolve this issue? (Choose two.)

Accepted Answer

Enable DNS resolution and DNS hostnames for the VPC.. Options A and D are correct: To allow on-premises resources to resolve private hosted zone names, you must set up a Route 53 inbound resolver endpoint in the VPC (A) and also enable DNS resolution for the VPC (D). Option B is wrong because a public hosted zone is for public DNS, not private. Option C is wrong because the private hosted zone is already associated with the VPC; the issue is that on-premises cannot query it. Option E is wrong because route propagation does not affect DNS resolution.

Answer

Configure route propagation from the VPN to the VPC's route table.

Answer

Associate the private hosted zone with the on-premises network.

Answer

Create a public hosted zone with the same name and associate it with the VPC.

Question 6

A company has a VPC with a CIDR of 10.0.0.0/16. They have two subnets: subnet-A (10.0.1.0/24) and subnet-B (10.0.2.0/24). An EC2 instance in subnet-A needs to send traffic to an EC2 instance in subnet-B. Both instances are in the same VPC and have appropriate security group rules. However, traffic is not reaching the destination. What is the MOST likely cause?

Accepted Answer

The network ACL associated with subnet-B is denying inbound traffic from subnet-A.. Option C is correct because network ACLs are stateless and must allow both inbound and outbound traffic for ephemeral ports. If the NACL on subnet-B does not allow inbound traffic from subnet-A, the traffic will be blocked. Option A is wrong because VPC peering is not needed; both subnets are in the same VPC. Option B is wrong because the route table already has a local route for the VPC CIDR, so no additional routes are needed. Option D is wrong because security groups are stateful; if outbound is allowed, return traffic is automatically allowed.

Answer

The route table for subnet-A does not have a route for subnet-B's CIDR.

Answer

The security group on the destination instance does not allow inbound traffic from the source instance.

Answer

The VPC peering connection is not established between the two subnets.

Question 7

A company is using Amazon CloudFront to distribute content globally. The origin is an S3 bucket. The SysOps administrator notices that cache hit ratio is low. Which configuration change would MOST improve the cache hit ratio?

Accepted Answer

Set longer Cache-Control max-age headers on the S3 objects.. Option D is correct because setting appropriate Cache-Control headers (like max-age) on the objects tells CloudFront how long to cache them, directly increasing cache hits. Option A is wrong because enabling Origin Shield can reduce load on the origin but does not directly improve cache hit ratio; it aggregates requests. Option B is wrong because using query string parameters can fragment the cache if not configured properly, potentially reducing hit ratio. Option C is wrong because custom error responses do not affect caching of successful responses.

Answer

Use query string parameters to differentiate content.

Answer

Configure custom error responses for 404 errors.

Answer

Enable Origin Shield for the distribution.

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent 502 errors. The SysOps administrator checks the ALB access logs and sees that the error occurs when the target group has 'unhealthy' targets. What is the MOST likely cause of the 502 errors?

Accepted Answer

The target instances are not passing health checks.. Option B is correct because unhealthy targets cause the ALB to return 502 errors when it cannot establish a connection or receive a valid response. Option A is wrong because certificate issues cause 503 errors. Option C is wrong because client request timeout causes 408 errors. Option D is wrong because insufficient capacity causes 503 errors.

Answer

The SSL certificate on the ALB is expired.

Answer

The ALB does not have enough capacity to handle the traffic.

Answer

The client request exceeds the idle timeout.

Question 9

A SysOps administrator needs to route traffic for a domain name 'example.com' to an Application Load Balancer. Which AWS service should be used to create the DNS record?

Accepted Answer

Amazon Route 53. Option A is correct. Amazon Route 53 is the DNS service to manage domain records. Option B is wrong because CloudFront is a CDN. Option C is wrong because ALB is the load balancer itself. Option D is wrong because EC2 is compute.

Answer

Amazon EC2

Answer

Application Load Balancer

Answer

Amazon CloudFront

Question 10

A company has a VPC with public and private subnets across three Availability Zones. The public subnets host NAT Gateways, and the private subnets host EC2 instances that need to access the internet. The SysOps administrator notices that EC2 instances in one private subnet cannot reach the internet, while others can. What is the MOST likely cause?

Accepted Answer

The route table for the private subnet does not have a default route to the NAT Gateway.. Option C is correct. The route table for the private subnet must have a default route (0.0.0.0/0) pointing to the NAT Gateway. If missing, internet access fails. Option A is wrong because NAT Gateways are in public subnets. Option B is wrong because NACLs are stateless but would affect all instances. Option D is wrong because the secondary private IP is irrelevant.

Answer

The EC2 instances have a secondary private IP address that is not registered.

Answer

The NAT Gateway is not in a public subnet.

Answer

The network ACL for the private subnet blocks outbound traffic.

Question 11

A company uses Amazon CloudFront to deliver static content from an S3 bucket. The SysOps administrator wants to restrict access so that only CloudFront can access the S3 bucket. Which solution should be used?

Accepted Answer

Configure an origin access control (OAC) and update the S3 bucket policy to allow CloudFront access.. Option D is correct because Origin Access Control (OAC) is the recommended method to restrict S3 bucket access exclusively to CloudFront. OAC uses a CloudFront-owned service principal to sign requests, and the S3 bucket policy must explicitly grant the `s3:GetObject` action to that principal, ensuring no direct S3 access from other sources.

Answer

Use pre-signed URLs for all objects.

Answer

Use an S3 bucket policy that allows access from any AWS service.

Answer

Generate CloudFront key pairs and configure signed URLs.

Question 12

A SysOps administrator needs to monitor network traffic to and from an EC2 instance for troubleshooting. Which AWS feature captures IP traffic information at the VPC level?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic information for network interfaces within a VPC, including source/destination IPs, ports, protocols, and packet accept/reject decisions. This feature operates at the VPC level and is specifically designed for network traffic monitoring and troubleshooting, making it the correct choice for capturing IP traffic information to and from an EC2 instance.

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Answer

AWS Config

Question 13

A company's web application is hosted on EC2 instances behind a Network Load Balancer (NLB) with a static IP address. The application receives a sudden spike in traffic, and some clients report connection timeouts. Which NLB feature should the SysOps administrator configure to handle the increased load?

Accepted Answer

Enable cross-zone load balancing.. Option B is correct. NLB cross-zone load balancing distributes traffic across all registered instances in all AZs, improving capacity. Option A is wrong because health checks help identify unhealthy instances but do not increase capacity. Option C is wrong because stickiness is for session persistence. Option D is wrong because deletion protection prevents accidental deletion.

Answer

Enable sticky sessions.

Answer

Enable deletion protection.

Answer

Enable health checks to mark unhealthy instances.

Question 14

A SysOps administrator needs to ensure that all traffic between an on-premises data center and the AWS VPC is encrypted and goes over the internet. Which AWS service should be used?

Accepted Answer

AWS Site-to-Site VPN. AWS Site-to-Site VPN creates an encrypted tunnel between an on-premises data center and an AWS VPC using IPsec (IKEv1/IKEv2) over the public internet. This meets the requirement for encryption and internet-based connectivity, as the VPN traffic traverses the internet but is secured by IPsec tunnels.

Answer

VPC Peering

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Question 15

A company has a VPC with multiple subnets. The SysOps administrator wants to ensure that EC2 instances in a private subnet can access Amazon S3 without going through a NAT Gateway or internet gateway. Which solution meets this requirement?

Accepted Answer

Create a VPC Gateway Endpoint for S3.. Option D is correct. VPC Gateway Endpoint for S3 allows private access to S3 without internet. Option A is wrong because NAT Gateway requires an internet gateway. Option B is wrong because S3 Transfer Acceleration is for speed, not private access. Option C is wrong because VPC Interface Endpoint is for other services, but Gateway Endpoint is more cost-effective for S3.

Answer

Set up a NAT Gateway in a public subnet and route traffic through it.

Answer

Use S3 Transfer Acceleration.

Answer

Create a VPC Interface Endpoint for S3.