SOA-C02 Networking and Content Delivery — Timed 20 Questions

Question 1

A company has deployed a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application's IP addresses are used by a third-party service to allowlist traffic. The EC2 instances are part of an Auto Scaling group that may scale up and down. The SysOps administrator needs to ensure that the third-party service always has the current IP addresses of the ALB without requiring manual updates. Which solution should the administrator implement?

20 minute time limit — choose an answer to begin.

Accepted Answer

Use AWS Global Accelerator and provide the static IP addresses to the third party. AWS Global Accelerator and a Network Load Balancer (NLB) with Elastic IPs both provide static IP addresses in front of an ALB. The NLB can be placed in front of the ALB by setting the ALB as a target. This is a well-supported AWS pattern and satisfies the requirement without manual updates. Therefore, both A and D are correct.

Answer

Use Amazon Route 53 with a simple routing policy pointing to the ALB DNS name

Answer

Use an Amazon CloudFront distribution with the ALB as the origin and provide the CloudFront IP addresses

Question 2

A company has three VPCs in the same AWS region: VPC A (production), VPC B (development), and VPC C (shared services). The VPCs have overlapping CIDR blocks (e.g., VPC A: 10.0.0.0/16, VPC B: 10.0.0.0/16, VPC C: 10.1.0.0/16). The SysOps administrator needs to enable private IP communication between VPC A and VPC C, and between VPC B and VPC C, but not between VPC A and VPC B. The solution must also support a growing number of VPCs in the future. Which AWS service should be used?

Accepted Answer

Use AWS Transit Gateway with attachment route tables that isolate traffic between VPCs, ensuring that VPC A and VPC B routes are separate.. AWS Transit Gateway can handle VPCs with overlapping CIDR blocks by using separate route tables for each VPC attachment. This allows VPC A and VPC B to both communicate with VPC C while remaining isolated from each other. The service also scales easily as more VPCs are added. PrivateLink (option B) only provides access to specific services via VPC endpoints, not general private IP communication between all resources in the VPCs. VPC peering (option C) does not support overlapping CIDRs. Site-to-Site VPN (option D) is more complex and unnecessary for this use case.

Answer

Use AWS PrivateLink by creating a Network Load Balancer in VPC C and configuring VPC endpoints in VPC A and VPC B to access the services.

Answer

Create two VPC peering connections: one between VPC A and VPC C, and one between VPC B and VPC C.

Answer

Set up two AWS Site-to-Site VPN connections from VPC C to VPC A and VPC B using virtual private gateways.

Question 3

A company has an Amazon VPC with public and private subnets. The private subnets host database instances that should not have direct internet access. However, the database instances need to download patches from an Amazon S3 bucket. The SysOps administrator needs to enable access to S3 from the private subnets without traversing the internet. Which solution should be used?

Accepted Answer

Create a VPC endpoint for S3 (Gateway type) and update the private route tables to add a route to the S3 prefix list.. A VPC endpoint for S3 of Gateway type allows private subnet resources to access S3 without traversing the internet by routing traffic through the AWS network. Adding a route to the S3 prefix list in the private route table directs S3-bound traffic to the endpoint, which is horizontally scaled and highly available. This solution meets the requirement of no direct internet access while enabling patch downloads from S3.

Answer

Create a NAT gateway in a public subnet and update the private route tables to point 0.0.0.0/0 to the NAT gateway.

Answer

Create a VPC endpoint for S3 (Interface type) and assign a security group to the endpoint.

Answer

Create an AWS Direct Connect connection and route traffic to S3 through the on-premises network.

Question 4

A company wants to host a static website using Amazon S3. The website files are stored in an S3 bucket. The SysOps administrator needs to make the website accessible via HTTP. Which action must be performed on the S3 bucket?

Accepted Answer

Enable static website hosting. To host a static website on Amazon S3, you must enable the 'Static website hosting' property on the bucket. This configures the bucket to serve HTTP responses for index and error documents, and provides a regional website endpoint (e.g., http://bucket-name.s3-website-region.amazonaws.com). Without this setting, the bucket only supports REST API access (via the S3 API endpoint), not standard HTTP browser requests.

Answer

Enable versioning

Answer

Configure a bucket policy to allow public read access

Answer

Attach a CloudFront distribution

Question 5

A company has an Application Load Balancer (ALB) that routes traffic to targets in private subnets. The SysOps administrator needs to log detailed information about HTTP requests, including client IP, request path, and response time. Which ALB feature should be enabled?

Accepted Answer

Access logs. Access logs capture detailed information about each HTTP request processed by the ALB, including client IP, request path, response time, and many other fields. This feature stores the logs in an S3 bucket, providing a persistent, queryable record of all requests. CloudWatch metrics aggregate data but do not provide per-request details, making access logs the correct choice for the required granularity.

Answer

CloudWatch metrics

Answer

Connection logs

Answer

Request tracing

Question 6

A SysOps administrator is troubleshooting an issue where an Amazon EC2 instance cannot connect to the internet. The instance is in a public subnet with a route table that has a route to an internet gateway (IGW). The instance has a public IP assigned. What should the administrator check next?

Accepted Answer

Check the security group rules to ensure outbound traffic is allowed. The instance has a public IP and is in a public subnet with a route to an IGW, so network-level routing and addressing are already configured. The most common remaining cause for no internet connectivity is that the security group's outbound rules are blocking traffic. Security groups are stateful, so even if inbound rules allow return traffic, outbound rules must explicitly permit the instance to initiate connections to the internet (e.g., outbound HTTPS on port 443 or all traffic).

Answer

Verify the network ACL associated with the subnet allows inbound traffic from the internet

Answer

Confirm that the route table has a route to the IGW for 0.0.0.0/0

Answer

Ensure the instance has a public IP address

Question 7

Refer to the exhibit. A SysOps administrator created this S3 bucket policy to allow CloudFront to access objects in the bucket using an origin access identity (OAI). However, users are still receiving 403 Access Denied errors when accessing the CloudFront distribution. What is the most likely cause?

Accepted Answer

The OAI ARN in the policy is incorrect. The most likely cause is that the OAI ARN in the bucket policy is incorrect (option D). The OAI ARN must exactly match the CloudFront origin access identity used by the distribution. If it is wrong, CloudFront cannot access the S3 objects and returns 403. S3 Block Public Access settings only apply to anonymous public access and do not affect grants to specific principals like an OAI.

Answer

The CloudFront distribution uses the S3 bucket's regional domain name instead of the distribution domain name

Answer

The CloudFront distribution is in a different region than the S3 bucket

Answer

The S3 bucket has Block Public Access settings enabled that deny all access

Question 8

Refer to the exhibit. A SysOps administrator is troubleshooting internet connectivity for an EC2 instance in subnet subnet-0a1b2c3d4e5f6g7h8. The instance can reach other instances in the VPC but cannot access the internet. Based on the route table output, what is the most likely cause?

Accepted Answer

The NAT gateway does not have a route to an internet gateway. The NAT gateway does not have a route to an internet gateway is correct because, for an EC2 instance in a private subnet to access the internet, the NAT gateway must reside in a public subnet and have a route to an internet gateway. If the NAT gateway's route table lacks a 0.0.0.0/0 route pointing to an internet gateway, it cannot forward traffic from the private subnet to the internet. The exhibit likely shows the private subnet's route table with a default route to the NAT gateway, but the NAT gateway itself is misconfigured.

Answer

The default route (0.0.0.0/0) is missing

Answer

The route table is not associated with the subnet

Answer

The VPC CIDR route is misconfigured

Question 9

A SysOps administrator notices that traffic from an Application Load Balancer to EC2 instances is failing intermittently. Security groups for the instances allow traffic from the ALB security group on port 80. The ALB target group health checks are failing. What is the most likely cause?

Accepted Answer

The network ACL for the instance's subnet is blocking inbound traffic from the ALB's subnet.. Network ACLs are stateless and evaluated at the subnet boundary. If the instance subnet's NACL does not allow inbound traffic from the ALB subnet on the ephemeral ports and port 80, health checks and traffic will fail intermittently, even though the security group allows it.

Answer

The instance security group does not allow outbound traffic to the ALB.

Answer

The ALB security group does not allow outbound traffic to the instances.

Answer

The ALB is in a public subnet without an internet gateway.

Question 10

A SysOps administrator is troubleshooting connectivity issues between two VPCs in different AWS Regions. Both VPCs are connected via a VPC Peering connection. The main route tables in both VPCs have routes pointing to the peering connection. Security groups allow all traffic. However, an EC2 instance in VPC A cannot ping an EC2 instance in VPC B. What is the most likely cause?

Accepted Answer

The route tables in the subnets where the instances reside do not include a route to the peered VPC's CIDR.. The most likely cause is that the route tables associated with the subnets where the EC2 instances reside do not include a route to the peered VPC's CIDR block. Even if the main VPC route tables have the peering route, each subnet must be explicitly associated with a route table that contains the route to the peered VPC's CIDR; otherwise, traffic from the instance will not be directed to the VPC peering connection.

Answer

The network ACLs in subnets are blocking ICMP traffic.

Answer

VPC Peering is not supported across AWS Regions.

Answer

The security groups do not allow traffic from the peered VPC's security group ID.

Question 11

A SysOps administrator is configuring an Application Load Balancer to route traffic to multiple target groups based on the URL path. The ALB is not routing traffic correctly. Which listener rule configuration should be used to route requests with path /api/* to target group A and all other requests to target group B?

Accepted Answer

Create a rule with path pattern /api/* and forward to target group A with priority 10, and a default rule with path pattern /* and forward to target group B with priority 20.. For an ALB, listener rules are evaluated in priority order (lowest number first). To route /api/* to target group A and all other requests to target group B, you need a rule with path pattern /api/* and priority 10 forwarding to A, and a default rule (which has the lowest priority) forwarding to B. The default rule can also have a path pattern /* but it's typically the catch-all. Option C correctly specifies this configuration with explicit priorities.

Answer

Create a rule with a host header condition matching 'api.example.com' and forward to target group A, and a default rule forward to target group B.

Answer

Create one rule with a condition that matches /api/* and forward to target group A, and another condition in the same rule for /* to forward to target group B.

Answer

Create two rules with path patterns /api/* and /*, and set priority based on the pattern length.

Question 12

A company is running a critical application on EC2 instances in a VPC. The instances are in an Auto Scaling group across multiple Availability Zones. The application needs to maintain a fixed, private IP address for each instance. Which approach should be used to ensure each instance receives a consistent private IP address?

Accepted Answer

Use an Elastic Network Interface (ENI) with a predefined private IP and attach it to the instance. An Elastic Network Interface (ENI) can be created with a specific private IP address and then attached to an EC2 instance, and the ENI persists independently of the instance lifecycle. When the Auto Scaling group replaces an instance, the same ENI (with its fixed private IP) can be reattached, preserving the address. This is the only AWS-native mechanism that guarantees a consistent private IP across instance replacements.

Answer

Configure the DHCP option set to assign a static IP

Answer

Assign an Elastic IP to each instance and use that as the private IP

Answer

Use a custom AMI that configures a static private IP address via user data

Question 13

A company has a VPC with an IPv4 CIDR block of 10.0.0.0/16. The company wants to connect two subnets: one in the VPC (10.0.1.0/24) and one in an on-premises network (192.168.1.0/24) via a Site-to-Site VPN. The VPN connection is established. However, instances in the VPC subnet cannot ping the on-premises server at 192.168.1.10. What is a possible cause?

Accepted Answer

The route table for the VPC subnet does not have a route to the on-premises network via the VPN gateway. The VPC subnet's route table must have a route for the on-premises CIDR pointing to the VPN gateway. Without that route, traffic to the on-premises network is not forwarded to the VPN gateway. Option A is incorrect because the question states the VPN connection is established, implying the tunnel is up. If the tunnel were not UP, it would prevent ping, but the scenario indicates the connection is established. Option C is incorrect because security groups control traffic to/from instances, but the route is missing; even if ICMP is allowed, traffic won't reach the on-premises server without a proper route. Option D is incorrect because there is no VPC endpoint for the VPN service; VPN connections use the internet gateway or virtual private gateway, not a VPC endpoint.

Answer

The VPN tunnel is not in the UP state

Answer

The security group for the VPC instances does not allow ICMP traffic

Answer

The VPC does not have a VPC endpoint for the VPN service

Question 14

A company has a VPC with multiple subnets across two Availability Zones. The company wants to set up a Network Load Balancer (NLB) to handle TCP traffic to a fleet of EC2 instances. The instances are in private subnets. Which configuration is necessary to ensure the NLB can route traffic to the instances?

Accepted Answer

Ensure the NLB is deployed in subnets that can route to the target subnets. A Network Load Balancer must be deployed in subnets that can route to the target subnets. Since the instances are in private subnets, the NLB's subnets must have route table entries (e.g., VPC peering or transit gateway) that allow communication with the target subnets. Option B is incorrect because NLB does not use security groups; it relies on network ACLs. Option C is incorrect because NAT gateways are for outbound internet traffic, not for NLB-to-instance traffic. Option D is incorrect because an internet gateway is not required for NLB traffic within the VPC.

Answer

Assign security groups to the NLB to allow inbound traffic

Answer

Configure a NAT gateway in each Availability Zone for the NLB to access the instances

Answer

Attach an internet gateway to the VPC and add a route to the NLB subnets

Question 15

A SysOps administrator is troubleshooting connectivity issues between two VPCs that are peered together. The VPCs are in the same AWS region. An EC2 instance in VPC A (10.0.1.0/24) cannot ping an EC2 instance in VPC B (10.0.2.0/24). Both VPCs have route tables that include the CIDR of the other VPC with the peering connection as the target. The security groups and network ACLs allow all inbound and outbound traffic. What is the most likely issue?

Accepted Answer

The VPC peering connection is not enabled for DNS resolution.. Although the route tables and security groups/NACLs appear correctly configured, the scenario likely involves pinging by private DNS hostname rather than by IP address. For VPC peering, DNS resolution must be explicitly enabled on the peering connection to allow instances in one VPC to resolve the private DNS hostnames of instances in the peered VPC. Without this setting, a ping by hostname will fail even if ICMP traffic is allowed. The answer assumes the administrator is using private DNS hostnames for the ping.

Answer

The route tables do not have a route to the other VPC's CIDR.

Answer

There is a third VPC C that is peered with both VPC A and VPC B, and VPC A is trying to reach VPC B through VPC C.

Answer

The VPCs are in different AWS regions.

Question 16

A company uses Amazon CloudFront to distribute content to users worldwide. The origin is an Application Load Balancer (ALB) that routes to EC2 instances. The SysOps administrator notices that some users are receiving cached responses even though the content has been updated on the origin. The administrator needs to ensure that users always receive the latest version of the content. What should the administrator do?

Accepted Answer

Use CloudFront cache invalidation to remove the old objects after updating the origin.. CloudFront cache invalidation removes objects from edge caches before their TTL expires, ensuring users receive the latest content from the origin. After updating the origin, the administrator should create an invalidation for the affected paths (e.g., /*) to force CloudFront to fetch fresh content.

Answer

Configure the ALB to send a Cache-Control: no-cache header.

Answer

Set up a Lambda@Edge function to change the origin request path.

Answer

Reduce the CloudFront TTL to 0 seconds.

Question 17

A company has an internal Application Load Balancer (ALB) in a VPC. The ALB is used by an on-premises application via AWS Direct Connect. The on-premises application needs to resolve the ALB's DNS name. The VPC has Route 53 private hosted zone associated with the VPC. The on-premises DNS servers are configured to forward queries for the company's domain to the VPC's Route 53 inbound resolver endpoints. However, the on-premises application cannot resolve the ALB's DNS name. What is the likely cause?

Accepted Answer

The ALB's DNS name is not in the Route 53 private hosted zone.. The ALB's DNS name is not automatically added to the Route 53 private hosted zone. For on-premises applications to resolve the ALB's DNS name, a record must be created in the private hosted zone that maps the ALB's DNS name to its IP addresses. Without this record, the on-premises DNS servers, which forward queries to the Route 53 inbound resolver, will not find the ALB's DNS name.

Answer

The ALB's security group blocks inbound traffic from the on-premises CIDR.

Answer

The ALB is internal and does not have a public DNS name.

Answer

The Route 53 inbound resolver is not configured to forward queries to the public internet.

Question 18

A company has a VPC with public and private subnets. A NAT Gateway is in the public subnet, and a private EC2 instance needs to download patches from the internet. The instance can reach the internet after a reboot. Which action should the SysOps administrator take to make the internet access persistent?

Accepted Answer

Update the route table of the private subnet to point 0.0.0.0/0 to the NAT Gateway.. Route tables must be manually updated after adding a NAT Gateway. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway.

Answer

Attach an internet gateway to the private subnet.

Answer

Associate an Elastic IP with the NAT Gateway.

Answer

Enable DNS resolution in the VPC.

Question 19

A company uses AWS Direct Connect to connect its on-premises data center to a VPC. The connection is redundant with two virtual interfaces (VIFs). Recently, one VIF failed, and the administrator notices that traffic is not automatically failing over. What must be configured to enable automatic failover?

Accepted Answer

Create a VPN connection as a backup and configure route propagation with a lower priority.. Direct Connect VIFs do not automatically fail over to each other by default; a common resilient design is to pair Direct Connect with a Site-to-Site VPN backup and use BGP to prefer the Direct Connect path, with the VPN taking over when the DX VIF fails. Configuring route propagation with a lower priority (higher AS path or local preference) enables automatic failover.

Answer

Configure BGP metrics to prefer the primary VIF.

Answer

Place both VIFs in the same VLAN.

Answer

Enable equal-cost multi-path (ECMP) routing.

Question 20

An organization wants to block traffic from specific IP addresses at the edge of the AWS network before it reaches the application. Which service should be used?

Accepted Answer

AWS WAF. AWS WAF integrates with CloudFront and ALB to filter traffic based on IP addresses. For edge blocking, CloudFront with WAF is the best choice.

Answer

Security groups

Answer

AWS Shield Advanced

Answer

Network ACLs