- A
Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.
CloudFront uses a set of IP addresses; the ALB must allow traffic from those IPs.
- B
Verify that the ALB's health check is configured correctly and that the targets are healthy.
If the ALB's targets are unhealthy, the ALB may return 502 to CloudFront.
- C
Configure the CloudFront distribution to use a custom error response for 502 errors.
Why wrong: This masks the error but does not fix the underlying issue.
- D
Ensure that the SSL certificate on the ALB is valid and trusted by CloudFront.
If the certificate is invalid or self-signed, CloudFront will fail to connect, causing 502 errors.
- E
Verify that the ALB is configured to use the X-Forwarded-For header to route requests.
Why wrong: X-Forwarded-For is for passing client IP, not for routing.
Quick Answer
The answer is to ensure the SSL certificate on the ALB is valid and trusted by CloudFront, along with verifying the ALB’s security group allows inbound traffic from CloudFront’s IP ranges. A 502 error occurs when CloudFront, acting as a reverse proxy, cannot establish a successful connection to the ALB origin—often because the ALB rejects the request due to a missing security group rule for CloudFront’s IPs or an untrusted certificate. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of origin connectivity and security group configuration, a common trap being that candidates focus only on the certificate while forgetting the network layer. For a quick memory tip, think “502 = Bad Gateway, check the gate: cert trust and IP access.”
SOA-C02 Networking and Content Delivery Practice Question
This SOA-C02 practice question tests your understanding of networking and content delivery. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company is using Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is configured with HTTPS listeners. Users report that some requests are failing with a 502 error. Which THREE steps should the SysOps administrator take to troubleshoot the issue? (Choose three.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.
The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.
Why this is correct
CloudFront uses a set of IP addresses; the ALB must allow traffic from those IPs.
Related concept
Read the scenario before looking for a memorised answer.
- ✓
Verify that the ALB's health check is configured correctly and that the targets are healthy.
Why this is correct
If the ALB's targets are unhealthy, the ALB may return 502 to CloudFront.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Configure the CloudFront distribution to use a custom error response for 502 errors.
Why it's wrong here
This masks the error but does not fix the underlying issue.
- ✓
Ensure that the SSL certificate on the ALB is valid and trusted by CloudFront.
Why this is correct
If the certificate is invalid or self-signed, CloudFront will fail to connect, causing 502 errors.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Verify that the ALB is configured to use the X-Forwarded-For header to route requests.
Why it's wrong here
X-Forwarded-For is for passing client IP, not for routing.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think a custom error response (Option C) resolves the root cause, when in fact it only masks the symptom, or they may confuse the X-Forwarded-For header (Option E) with routing logic, which is unrelated to 502 errors.
Detailed technical explanation
How to think about this question
CloudFront uses a set of globally distributed edge locations, each with its own IP addresses. When CloudFront forwards a request to an ALB, the source IP is one of these CloudFront IPs, not the end user's IP. The ALB's security group must explicitly allow inbound HTTPS (TCP port 443) from these IP ranges; otherwise, the TCP handshake fails, and CloudFront returns a 502. Additionally, the ALB's health check must succeed for the target group to be considered healthy; if all targets are unhealthy, the ALB returns a 502 to CloudFront because no target can serve the request.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Networking and Content Delivery — study guide chapter
Learn the concepts, then practise the questions
- →
Networking and Content Delivery practice questions
Targeted practice on this topic area only
- →
All SOA-C02 questions
1,546 questions across all exam domains
- →
AWS Certified SysOps Administrator Associate SOA-C02 study guide
Full concept coverage aligned to exam objectives
- →
SOA-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SOA-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Monitoring, Logging, and Remediation practice questions
Practise SOA-C02 questions linked to Monitoring, Logging, and Remediation.
Reliability and Business Continuity practice questions
Practise SOA-C02 questions linked to Reliability and Business Continuity.
Deployment, Provisioning, and Automation practice questions
Practise SOA-C02 questions linked to Deployment, Provisioning, and Automation.
Security and Compliance practice questions
Practise SOA-C02 questions linked to Security and Compliance.
Networking and Content Delivery practice questions
Practise SOA-C02 questions linked to Networking and Content Delivery.
Cost and Performance Optimization practice questions
Practise SOA-C02 questions linked to Cost and Performance Optimization.
SOA-C02 fundamentals practice questions
Practise SOA-C02 questions linked to SOA-C02 fundamentals.
SOA-C02 scenario practice questions
Practise SOA-C02 questions linked to SOA-C02 scenario.
SOA-C02 troubleshooting practice questions
Practise SOA-C02 questions linked to SOA-C02 troubleshooting.
Practice this exam
Start a free SOA-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SOA-C02 question test?
Networking and Content Delivery — This question tests Networking and Content Delivery — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges. — The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.
What should I do if I get this SOA-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SOA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a web application that uses Amazon CloudFront and an Application Load Balancer as origin. The application requires HTTPS between CloudFront and the ALB. The ALB uses a certificate from AWS Certificate Manager (ACM) for the custom domain. The administrator notices that CloudFront returns HTTP 502 errors occasionally. The ALB target group shows healthy instances. What is the most likely cause of the 502 errors?
medium- A.The ALB is not configured to support HTTPS
- B.The CloudFront origin response timeout is set too low
- C.The ALB security group denies traffic from CloudFront IP addresses
- ✓ D.The SSL/TLS certificate on the ALB does not match the origin domain name configured in CloudFront
Why D: Option A is correct because a mismatch in the SSL/TLS certificate domain name will cause CloudFront to fail to connect to the origin. Option B is wrong because the origin response timeout of 30 seconds is generous; if the application responds within that, it should be fine. Option C is wrong because if the ALB is healthy, it can handle requests. Option D is wrong because CloudFront can connect to ALB over HTTPS.
Variation 2. A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. Users report intermittent 502 errors. What is the most likely cause?
hard- A.The CloudFront distribution does not have Cache-Control headers configured.
- B.AWS WAF is blocking requests from CloudFront.
- ✓ C.The ALB is experiencing health check failures or scaling issues.
- D.The SSL/TLS certificate on the ALB is expired.
Why C: Option D is correct because if the ALB is overwhelmed or unhealthy, CloudFront returns 502 errors. Option A is wrong because missing cache headers cause performance issues, not 502 errors. Option B is wrong because SSL/TLS issues cause 4xx errors. Option C is wrong because WAF blocking would cause 403 errors.
Last reviewed: Jun 24, 2026
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.