SOA-C02 Networking and Content Delivery Practice Question
A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. Users report intermittent 502 errors. What is the most likely cause?
⚠ Common exam trap
The trap is focusing on edge-layer causes (WAF, cache headers, certificates) when the 502 specifically indicates an origin-side failure — candidates must map 502 to unhealthy ALB targets rather than client-facing misconfigurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The ALB is experiencing health check failures or scaling issues.
CloudFront returns HTTP 502 (Bad Gateway) when the origin — here an ALB — cannot successfully serve the request, most commonly because the ALB has no healthy targets registered. Health check failures or scaling events that leave the ALB without healthy backend instances cause CloudFront to receive an error response or no response, resulting in intermittent 502s.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CloudFront distribution does not have Cache-Control headers configured.
Why it's wrong here
Cache-Control headers are used by CloudFront and browsers to determine how long to cache content, but their absence does not cause a 502 Bad Gateway. A 502 indicates CloudFront could not obtain a valid response from the origin (the ALB) due to connection failures, timeouts, or an ALB error status. While a lack of Cache-Control might send more requests to the ALB, it directly impacts caching behavior, not origin connectivity or error propagation.
- ✗
AWS WAF is blocking requests from CloudFront.
Why it's wrong here
If AWS WAF is applied either on CloudFront or the ALB and blocks a request, the client receives a 403 Forbidden response, not a 502. CloudFront returns 502 only when its attempt to reach the ALB fails or the ALB returns an invalid/error HTTP response that CloudFront treats as an origin failure. WAF blocking occurs before the request reaches the ALB, so it would not manifest as a bad-gateway error in CloudFront.
- ✓
The ALB is experiencing health check failures or scaling issues.
Why this is correct
When CloudFront uses an ALB as a custom origin, it relies on the ALB to have healthy targets in its target groups. If the ALB's targets are unhealthy, the ALB cannot route requests and may return 503 or terminate connections, which CloudFront reports as 502 Bad Gateway. Scaling events, such as rapidly changing instance counts or insufficient capacity, can cause intermittent connection timeouts or reset errors. These conditions are the leading cause of transient 502 errors in a CloudFront-to-ALB architecture.
- ✗
The SSL/TLS certificate on the ALB is expired.
Why it's wrong here
An expired SSL/TLS certificate on the ALB would indeed break the TLS handshake between CloudFront and the ALB, resulting in 502 errors because CloudFront cannot establish a secure origin connection. However, this failure mode would be persistent across all requests, not intermittent, and ACM-issued certificates attached to an ALB are automatically renewed, making expiration rare. In contrast, health check failures or scaling issues naturally appear as sporadic 502s while traffic fluctuates, making them the more likely root cause.
Go deeper
Related to this question
About these practice questions
One of 1,169 original SOA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.