← SOA-C02·Amazon Web Services

Question 1,109 of 1,546

Networking and Content Delivery →hardMultiple SelectObjective-mapped

Quick Answer

The answer is to ensure the SSL certificate on the ALB is valid and trusted by CloudFront, along with verifying the ALB’s security group allows inbound traffic from CloudFront’s IP ranges. A 502 error occurs when CloudFront, acting as a reverse proxy, cannot establish a successful connection to the ALB origin—often because the ALB rejects the request due to a missing security group rule for CloudFront’s IPs or an untrusted certificate. On the AWS Certified SysOps Administrator Associate SOA-C02 exam, this scenario tests your understanding of origin connectivity and security group configuration, a common trap being that candidates focus only on the certificate while forgetting the network layer. For a quick memory tip, think “502 = Bad Gateway, check the gate: cert trust and IP access.”

SOA-C02 Networking and Content Delivery Practice Question

This SOA-C02 practice question tests your understanding of networking and content delivery. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A company is using Amazon CloudFront with an Application Load Balancer (ALB) as the origin. The ALB is configured with HTTPS listeners. Users report that some requests are failing with a 502 error. Which THREE steps should the SysOps administrator take to troubleshoot the issue? (Choose three.)

Question 1hardmulti select

Full question →

A
Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.
CloudFront uses a set of IP addresses; the ALB must allow traffic from those IPs.
B
Verify that the ALB's health check is configured correctly and that the targets are healthy.
If the ALB's targets are unhealthy, the ALB may return 502 to CloudFront.
C
Configure the CloudFront distribution to use a custom error response for 502 errors.
Why wrong: This masks the error but does not fix the underlying issue.
D
Ensure that the SSL certificate on the ALB is valid and trusted by CloudFront.
If the certificate is invalid or self-signed, CloudFront will fail to connect, causing 502 errors.
E
Verify that the ALB is configured to use the X-Forwarded-For header to route requests.
Why wrong: X-Forwarded-For is for passing client IP, not for routing.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.

The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges.
Why this is correct
CloudFront uses a set of IP addresses; the ALB must allow traffic from those IPs.
Related concept
Read the scenario before looking for a memorised answer.
✓
Verify that the ALB's health check is configured correctly and that the targets are healthy.
Why this is correct
If the ALB's targets are unhealthy, the ALB may return 502 to CloudFront.
Related concept
Read the scenario before looking for a memorised answer.
✗
Configure the CloudFront distribution to use a custom error response for 502 errors.
Why it's wrong here
This masks the error but does not fix the underlying issue.
✓
Ensure that the SSL certificate on the ALB is valid and trusted by CloudFront.
Why this is correct
If the certificate is invalid or self-signed, CloudFront will fail to connect, causing 502 errors.
Related concept
Read the scenario before looking for a memorised answer.
✗
Verify that the ALB is configured to use the X-Forwarded-For header to route requests.
Why it's wrong here
X-Forwarded-For is for passing client IP, not for routing.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates may think a custom error response (Option C) resolves the root cause, when in fact it only masks the symptom, or they may confuse the X-Forwarded-For header (Option E) with routing logic, which is unrelated to 502 errors.

Detailed technical explanation

How to think about this question

CloudFront uses a set of globally distributed edge locations, each with its own IP addresses. When CloudFront forwards a request to an ALB, the source IP is one of these CloudFront IPs, not the end user's IP. The ALB's security group must explicitly allow inbound HTTPS (TCP port 443) from these IP ranges; otherwise, the TCP handshake fails, and CloudFront returns a 502. Additionally, the ALB's health check must succeed for the target group to be considered healthy; if all targets are unhealthy, the ALB returns a 502 to CloudFront because no target can serve the request.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SOA-C02 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Monitoring, Logging, and Remediation practice questions

Practise SOA-C02 questions linked to Monitoring, Logging, and Remediation.

Reliability and Business Continuity practice questions

Practise SOA-C02 questions linked to Reliability and Business Continuity.

Deployment, Provisioning, and Automation practice questions

Practise SOA-C02 questions linked to Deployment, Provisioning, and Automation.

Security and Compliance practice questions

Practise SOA-C02 questions linked to Security and Compliance.

Networking and Content Delivery practice questions

Practise SOA-C02 questions linked to Networking and Content Delivery.

Cost and Performance Optimization practice questions

Practise SOA-C02 questions linked to Cost and Performance Optimization.

SOA-C02 fundamentals practice questions

Practise SOA-C02 questions linked to SOA-C02 fundamentals.

SOA-C02 scenario practice questions

Practise SOA-C02 questions linked to SOA-C02 scenario.

SOA-C02 troubleshooting practice questions

Practise SOA-C02 questions linked to SOA-C02 troubleshooting.

Practice this exam

Start a free SOA-C02 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SOA-C02 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SOA-C02 question test?

Networking and Content Delivery — This question tests Networking and Content Delivery — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Check that the ALB's security group allows inbound traffic from the CloudFront IP ranges. — The ALB's security group must allow inbound traffic from CloudFront's IP ranges, because CloudFront forwards requests to the ALB using its own IP addresses. Without this rule, the ALB will reject the connection, resulting in a 502 error (Bad Gateway) as CloudFront cannot reach the origin. You can obtain the current CloudFront IP ranges from the AWS IP Address Ranges list and update the security group accordingly.

What should I do if I get this SOA-C02 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on SOA-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company has a web application that uses Amazon CloudFront and an Application Load Balancer as origin. The application requires HTTPS between CloudFront and the ALB. The ALB uses a certificate from AWS Certificate Manager (ACM) for the custom domain. The administrator notices that CloudFront returns HTTP 502 errors occasionally. The ALB target group shows healthy instances. What is the most likely cause of the 502 errors?

medium

A.The ALB is not configured to support HTTPS
B.The CloudFront origin response timeout is set too low
C.The ALB security group denies traffic from CloudFront IP addresses
✓ D.The SSL/TLS certificate on the ALB does not match the origin domain name configured in CloudFront

Why D: Option A is correct because a mismatch in the SSL/TLS certificate domain name will cause CloudFront to fail to connect to the origin. Option B is wrong because the origin response timeout of 30 seconds is generous; if the application responds within that, it should be fine. Option C is wrong because if the ALB is healthy, it can handle requests. Option D is wrong because CloudFront can connect to ALB over HTTPS.

Variation 2. A company uses Amazon CloudFront with an Application Load Balancer (ALB) as the origin. Users report intermittent 502 errors. What is the most likely cause?

hard

A.The CloudFront distribution does not have Cache-Control headers configured.
B.AWS WAF is blocking requests from CloudFront.
✓ C.The ALB is experiencing health check failures or scaling issues.
D.The SSL/TLS certificate on the ALB is expired.

Why C: Option D is correct because if the ALB is overwhelmed or unhealthy, CloudFront returns 502 errors. Option A is wrong because missing cache headers cause performance issues, not 502 errors. Option B is wrong because SSL/TLS issues cause 4xx errors. Option C is wrong because WAF blocking would cause 403 errors.

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.