SOA-C02 Networking and Content Delivery — Timed 10 Questions

Question 1

A company has two VPCs in different AWS regions (us-east-1 and eu-west-1) that are peered. Applications in both VPCs need to communicate using private IP addresses. The ping tests are successful, but the latency is significantly higher than expected. Which change is most likely to improve the latency between the VPCs?

10 minute time limit — choose an answer to begin.

Accepted Answer

Enable DNS resolution for the VPC peering connection.. Enabling DNS resolution for the VPC peering connection allows instances to resolve public DNS hostnames to the private IP addresses of the peered VPC. Without this, DNS queries may return public IP addresses, forcing traffic to traverse the internet or NAT gateways, which adds significant latency. By resolving to private IPs, traffic stays within the AWS backbone, reducing latency.

Answer

Use a Transit Gateway instead of VPC Peering for cross-region connectivity.

Answer

Increase the MTU on the instances' network interfaces to 9001.

Answer

Configure ECMP (Equal-Cost Multi-Path) routing on the VPC peering connection.

Question 2

A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's IP addresses are used by a third-party service to allowlist traffic. The EC2 instances are part of an Auto Scaling group that may scale up and down. The SysOps administrator needs to ensure that the third-party service always has the current IP addresses of the ALB without requiring manual updates. Which solution should the administrator implement?

Accepted Answer

Use AWS Global Accelerator and provide the static IP addresses to the third party. AWS Global Accelerator and a Network Load Balancer (NLB) with Elastic IPs both provide static IP addresses in front of an ALB. The NLB can be placed in front of the ALB by setting the ALB as a target. This is a well-supported AWS pattern and satisfies the requirement without manual updates. Therefore, both A and D are correct.

Answer

Use Amazon Route 53 with a simple routing policy pointing to the ALB DNS name

Answer

Use an Amazon CloudFront distribution with the ALB as the origin and provide the CloudFront IP addresses

Question 3

A company has two VPCs in the same AWS region. VPC A hosts a web application, and VPC B hosts a database. The SysOps administrator needs to enable private IP communication between the two VPCs without using the public internet. The administrator wants a simple, low-cost solution that uses the AWS network backbone. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering allows direct, private IP connectivity between two VPCs using the AWS network backbone without traversing the public internet. It is the simplest and most cost-effective solution for connecting exactly two VPCs in the same region, as there are no additional hourly charges beyond data transfer costs, and no intermediate devices or bandwidth limitations are introduced.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS Site-to-Site VPN

Question 4

A company has three VPCs in the same AWS region: VPC A (production), VPC B (development), and VPC C (shared services). The VPCs have overlapping CIDR blocks (e.g., VPC A: 10.0.0.0/16, VPC B: 10.0.0.0/16, VPC C: 10.1.0.0/16). The SysOps administrator needs to enable private IP communication between VPC A and VPC C, and between VPC B and VPC C, but not between VPC A and VPC B. The solution must also support a growing number of VPCs in the future. Which AWS service should be used?

Accepted Answer

Use AWS Transit Gateway with attachment route tables that isolate traffic between VPCs, ensuring that VPC A and VPC B routes are separate.. AWS Transit Gateway can handle VPCs with overlapping CIDR blocks by using separate route tables for each VPC attachment. This allows VPC A and VPC B to both communicate with VPC C while remaining isolated from each other. The service also scales easily as more VPCs are added. PrivateLink (option B) only provides access to specific services via VPC endpoints, not general private IP communication between all resources in the VPCs. VPC peering (option C) does not support overlapping CIDRs. Site-to-Site VPN (option D) is more complex and unnecessary for this use case.

Answer

Use AWS PrivateLink by creating a Network Load Balancer in VPC C and configuring VPC endpoints in VPC A and VPC B to access the services.

Answer

Create two VPC peering connections: one between VPC A and VPC C, and one between VPC B and VPC C.

Answer

Set up two AWS Site-to-Site VPN connections from VPC C to VPC A and VPC B using virtual private gateways.

Question 5

A company runs a gaming application that uses Amazon EC2 instances to handle real-time multiplayer sessions. The application requires low-latency communication with users around the world. The SysOps administrator needs to accelerate content delivery for non-cacheable, dynamic content (such as real-time game state updates) and also provide static asset delivery. The solution must support both TCP and UDP traffic. Which AWS service should be used?

Accepted Answer

AWS Global Accelerator. AWS Global Accelerator is the correct choice because it uses the AWS global network and Anycast IPs to route TCP and UDP traffic to the optimal endpoint, providing low-latency performance for non-cacheable dynamic content like real-time game state updates. It also supports static asset delivery by directing traffic to origins such as Application Load Balancers or EC2 instances, and it handles both TCP and UDP protocols natively, which is essential for real-time multiplayer gaming.

Answer

Amazon CloudFront with origins configured for both dynamic and static content

Answer

AWS Shield Advanced

Answer

AWS App Mesh

Question 6

A company has two VPCs: VPC-A (10.0.0.0/16) and VPC-B (10.1.0.0/16). The VPCs are in the same AWS region. The SysOps administrator needs to enable private IP connectivity between the two VPCs so that an EC2 instance in VPC-A can communicate with an EC2 instance in VPC-B using their private IP addresses. The administrator wants a simple, low-cost solution with high throughput. Which AWS service should be used?

Accepted Answer

VPC Peering. VPC Peering is the correct choice because it enables direct, private IP connectivity between two VPCs in the same AWS region using the existing AWS network infrastructure, with no bandwidth bottlenecks, no single point of failure, and no additional cost beyond data transfer. It meets the requirements for simplicity, low cost, and high throughput, as traffic stays within the AWS backbone and does not require a separate transit hub or VPN.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

Internet Gateway

Question 7

A company has an Amazon VPC with public and private subnets. The private subnets host database instances that should not have direct internet access. However, the database instances need to download patches from an Amazon S3 bucket. The SysOps administrator needs to enable access to S3 from the private subnets without traversing the internet. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and update the private route tables to add a route to the S3 prefix list.. A VPC endpoint for S3 of Gateway type allows private subnet resources to access S3 without traversing the internet by routing traffic through the AWS network. Adding a route to the S3 prefix list in the private route table directs S3-bound traffic to the endpoint, which is horizontally scaled and highly available. This solution meets the requirement of no direct internet access while enabling patch downloads from S3.

Answer

Create a NAT gateway in a public subnet and update the private route tables to point 0.0.0.0/0 to the NAT gateway.

Answer

Create a VPC endpoint for S3 (Interface type) and assign a security group to the endpoint.

Answer

Create an AWS Direct Connect connection and route traffic to S3 through the on-premises network.

Question 8

A company has an on-premises data center connected to AWS via an AWS Direct Connect connection. The SysOps administrator needs to ensure high availability for the connectivity. Which configuration provides the highest availability for the Direct Connect connection?

Accepted Answer

Establish two Direct Connect connections to different AWS Direct Connect locations.. Establishing two Direct Connect connections to different AWS Direct Connect locations provides geographic redundancy. If one AWS Direct Connect location experiences an outage, the other connection remains operational, ensuring high availability. This configuration eliminates single points of failure at the facility level, which is the most resilient design for hybrid connectivity.

Answer

Establish a single Direct Connect connection with a VPN backup.

Answer

Establish two Direct Connect connections to the same AWS Direct Connect location.

Answer

Use multiple virtual interfaces on a single Direct Connect connection.

Question 9

A company has a VPC with public and private subnets. An Application Load Balancer (ALB) is deployed in the public subnets, and an Auto Scaling group of web servers is deployed in the private subnets. The web servers need to frequently make HTTPS requests to an external API. The API provider requires that all requests originate from a consistent set of static IP addresses for whitelisting. The SysOps administrator must ensure that outbound traffic from the web servers has static source IP addresses. Which solution should be implemented?

Accepted Answer

Deploy a NAT gateway in a public subnet with an Elastic IP and route outbound traffic from the private subnets through the NAT gateway.. A NAT gateway placed in a public subnet with an Elastic IP provides a consistent, static source IP for all outbound traffic from instances in private subnets. The web servers route their outbound HTTPS requests through the NAT gateway, which performs source NAT (SNAT) using the Elastic IP, satisfying the API provider's whitelisting requirement. This design keeps the web servers in private subnets for security while ensuring a fixed public IP for outbound traffic.

Answer

Place the web servers in public subnets and assign each instance an Elastic IP address.

Answer

Create a VPC endpoint for the external API service.

Answer

Use AWS Global Accelerator to provide static IP addresses for outbound traffic.

Question 10

A company has two Amazon VPCs in the same AWS Region with non-overlapping CIDR blocks. The SysOps administrator needs to establish private connectivity between the two VPCs with high throughput and minimal cost. Which solution should the administrator implement?

Accepted Answer

VPC peering. VPC peering is the correct solution because it establishes private connectivity between two VPCs in the same AWS Region using the AWS backbone network, with no bandwidth limits and no single point of failure. It incurs no additional cost beyond data transfer charges, making it the most cost-effective option for high-throughput connectivity between two VPCs with non-overlapping CIDR blocks.

Answer

AWS Transit Gateway

Answer

AWS Direct Connect

Answer

AWS VPN CloudHub