Networking and Content Delivery — SOA-C02 Practice Quiz

Question 1

A SysOps administrator manages a CloudFront distribution in front of an Application Load Balancer serving a product catalog application. The application returns different content based on a 'category' query string parameter, but users report they consistently see the same product list regardless of the category they select. CloudWatch shows a high cache hit ratio at CloudFront. What is the MOST likely cause and the correct remediation?

Accepted Answer

The cache behavior's cache policy is not configured to include the 'category' query string in the cache key; update the cache policy to forward and cache based on the required query strings.

Answer

The origin's health check is failing; configure an origin failover group so CloudFront routes to a healthy secondary origin.

Answer

The distribution's default TTL is set to 0; increase the minimum and default TTL so CloudFront caches distinct responses per category.

Answer

The ALB is not sticky; enable session stickiness on the target group so each category request reaches the correct backend instance.

Question 2

A media company serves static images through a CloudFront distribution backed by an S3 origin. Monitoring shows a low cache hit ratio and higher-than-expected origin request volume, driving up S3 GET costs. Investigating the origin responses, the SysOps administrator finds that S3 returns objects with a Cache-Control: max-age=60 header, and the distribution's cache behavior is configured to use origin cache headers with a Minimum TTL of 0, Maximum TTL of 60, and Default TTL of 0. The images rarely change. What is the MOST effective change to increase the cache hit ratio?

Accepted Answer

Increase the Minimum TTL and Maximum TTL on the cache behavior (and adjust the S3 Cache-Control max-age) so objects remain cached longer at edge locations.

Answer

Enable query string forwarding on the cache behavior so that CloudFront caches each variation separately.

Answer

Change the origin from S3 to a custom origin using an Application Load Balancer to reduce origin request latency.

Answer

Create an invalidation for /* to force CloudFront to refresh and cache the objects.

Question 3

A company serves a single-page web application through a CloudFront distribution backed by an Application Load Balancer origin. During brief backend deployments, the origin returns HTTP 502 and 503 errors, and end users see raw CloudFront error XML. The team wants CloudFront to instead return a friendly maintenance HTML page for these errors and to stop hammering the origin with repeated requests during the outage window. Which configuration should the SysOps administrator implement?

Accepted Answer

Add a custom error response in the distribution for HTTP 502 and 503, pointing to an HTML object in the origin, and set an Error Caching Minimum TTL greater than zero

Answer

Create a cache behavior that forwards all query strings and cookies so CloudFront can regenerate the page on each request

Answer

Configure the ALB health check to return a static maintenance page when targets are unhealthy

Answer

Enable origin failover with a second ALB origin group so CloudFront retries the error responses immediately

Question 4

A company runs a single CloudFront distribution for its website. Static assets (images, CSS, JS) are served from an Amazon S3 bucket, while dynamic API requests under the path '/api/*' must be forwarded to an Application Load Balancer. Currently all requests, including '/api/*', are being routed to the S3 origin, causing API calls to fail. Which configuration change correctly routes traffic to the appropriate origins?

Accepted Answer

Add the ALB as a second origin and create a cache behavior with path pattern '/api/*' that points to the ALB origin, keeping the default (*) behavior pointed at S3.

Answer

Create a second CloudFront distribution for the ALB and use Route 53 weighted routing to split traffic between the two distributions.

Answer

Enable origin failover with an origin group so that requests failing at S3 automatically fall back to the ALB origin.

Answer

Modify the S3 bucket policy to redirect '/api/*' requests to the ALB endpoint using an S3 website redirection rule.

Question 5

A SysOps administrator configures a CloudFront distribution with a custom origin pointing to an Application Load Balancer that fronts a set of virtual-hosted websites on shared EC2 instances. The web servers use the incoming Host header to decide which site content to serve. After deployment, all requests through CloudFront return a generic default site instead of the intended site content, but requests made directly to the ALB DNS name return the correct pages. What is the MOST likely cause and fix?

Accepted Answer

CloudFront is forwarding its own distribution domain in the Host header; create a cache policy/origin request policy that includes the Host header so the origin receives the viewer's requested hostname.

Answer

The ALB listener rules are misconfigured; add a fixed-response rule that returns the correct site based on the path pattern.

Answer

The distribution's TTL is too high; lower the minimum TTL to 0 so CloudFront revalidates and picks up the correct virtual host.

Answer

The origin protocol policy is set to HTTP only; switch it to HTTPS only so the SNI hostname is passed to the web servers.

Question 6

A media company streams licensed video content through a CloudFront distribution backed by an S3 origin. Due to licensing agreements, the content must not be accessible to viewers located in a specific list of countries. The SysOps administrator must enforce this restriction with minimal operational overhead and without modifying the application. Which approach satisfies this requirement?

Accepted Answer

Configure CloudFront geographic restrictions (geo restriction) with a blocklist of the disallowed countries on the distribution.

Answer

Create a network ACL on the VPC hosting the S3 bucket that denies inbound traffic from the disallowed country IP ranges.

Answer

Add an S3 bucket policy with an aws:SourceIp condition listing all IP ranges for the disallowed countries.

Answer

Use Route 53 geolocation routing to return NXDOMAIN for viewers in the disallowed countries.

Question 7

A media company serves static content through a CloudFront distribution. They need to add a lightweight, high-scale function that inspects and modifies HTTP request headers (adding a custom header for A/B testing) on every viewer request. The logic is simple string manipulation, requires sub-millisecond startup, and must run at the lowest possible cost with the highest request throughput. Which solution best meets these requirements?

Accepted Answer

Use a CloudFront Function associated with the viewer request event

Answer

Use a Lambda@Edge function associated with the origin request event

Answer

Use a Lambda@Edge function associated with the viewer response event

Answer

Configure an origin request policy to forward and rewrite the custom header

Question 8

A SysOps administrator serves static website assets from an Amazon S3 bucket through an Amazon CloudFront distribution. The security team requires that users can only reach the objects via the CloudFront distribution URL and must not be able to download objects directly using the S3 bucket URL. The bucket currently has Block Public Access enabled at the bucket level. What should the administrator configure to meet this requirement?

Accepted Answer

Create an Origin Access Control (OAC) for the distribution and add an S3 bucket policy that grants s3:GetObject only to the CloudFront service principal for that distribution.

Answer

Disable S3 Block Public Access and add a public-read bucket policy so CloudFront can retrieve the objects from the origin.

Answer

Attach a security group to the S3 bucket that only allows inbound traffic from the CloudFront edge location IP ranges.

Answer

Configure a Route 53 alias record pointing the S3 bucket endpoint to the CloudFront distribution so requests are forced through CloudFront.

Question 9

A SysOps administrator manages a CloudFront distribution that serves dynamic and static content from an Application Load Balancer origin located in us-east-1. The distribution has edge locations serving global traffic. During traffic spikes, the origin ALB experiences a high volume of requests for the same objects because many regional edge caches independently forward cache misses to the origin. The team wants to reduce the number of duplicate requests reaching the origin without changing the application. Which CloudFront feature should the administrator enable?

Accepted Answer

Enable CloudFront Origin Shield in a Region close to the origin

Answer

Increase the default TTL on the cache behavior to the maximum value

Answer

Enable field-level encryption on the distribution

Answer

Add a second origin and configure an origin group for failover

Question 10

A media company streams paid video-on-demand content through a CloudFront distribution backed by an S3 origin. Subscribers watch multiple videos per session across many files with a common URL path prefix. The company needs to restrict access so only authenticated, paying subscribers can view the content, without generating a separate URL for every individual file the user requests. Which approach meets these requirements?

Accepted Answer

Use CloudFront signed cookies with a policy that grants access to the content path prefix, and set the cookies after the user authenticates.

Answer

Generate a CloudFront signed URL for each individual video file and return it to the browser at the start of every playback request.

Answer

Enable Origin Access Control (OAC) on the distribution so only CloudFront can read the S3 objects.

Answer

Apply an S3 bucket policy that restricts GetObject to the IP ranges of authenticated subscribers.

Question 11

A company runs a hybrid architecture with a 1 Gbps AWS Direct Connect connection between their on-premises data center and a VPC. The Direct Connect link recently experienced a brief outage, and during that time all connectivity to AWS was lost, disrupting critical applications. The SysOps administrator must add a cost-effective backup path that automatically carries traffic if the Direct Connect connection fails, without requiring manual intervention. Which solution meets these requirements?

Accepted Answer

Provision a Site-to-Site VPN connection as a backup over the public internet and use dynamic (BGP) routing so traffic automatically fails over when Direct Connect is unavailable.

Answer

Order a second Direct Connect connection from the same location and provider to serve as a hot standby that engages when the primary fails.

Answer

Create a VPC peering connection to a second VPC and route on-premises traffic through it if the Direct Connect connection goes down.

Answer

Enable Direct Connect MACsec encryption on the existing connection to improve its availability during outages.

Question 12

A SysOps administrator deploys web servers in a public subnet fronted by an internet-facing load balancer. Inbound HTTPS on port 443 works, but users report that responses time out intermittently. The subnet's network ACL has an inbound rule allowing TCP 443 from 0.0.0.0/0 and an outbound rule allowing only TCP 443 to 0.0.0.0/0. Security groups on the instances allow all necessary traffic. VPC Flow Logs show ACCEPT for inbound requests but REJECT for outbound packets. What is the most likely cause?

Accepted Answer

The network ACL outbound rules do not allow the ephemeral port range required for return traffic to clients

Answer

The security group is missing an outbound rule for port 443, blocking the responses

Answer

The route table lacks a default route to the internet gateway, dropping outbound packets

Answer

The instances are failing EC2 status checks, causing intermittent packet loss

Question 13

A SysOps administrator deploys EC2 instances in a private subnet that must download OS patches from the internet but must not accept any inbound connections initiated from the internet. The private subnet's route table currently only contains the local VPC route. The VPC already has an internet gateway attached, and there is a public subnet with a route to the internet gateway. Instances in the private subnet cannot reach the internet. What is the correct way to enable outbound-only internet access for these private instances?

Accepted Answer

Deploy a NAT gateway in the public subnet and add a route in the private subnet's route table for 0.0.0.0/0 pointing to the NAT gateway.

Answer

Add a route in the private subnet's route table for 0.0.0.0/0 pointing to the internet gateway and assign Elastic IPs to the instances.

Answer

Deploy a NAT gateway in the private subnet and add a route in the private subnet's route table for 0.0.0.0/0 pointing to the NAT gateway.

Answer

Create a VPC peering connection to a shared services VPC that has internet access and add a route to that peering connection.

Question 14

A company hosts a public website on an Application Load Balancer (ALB). They own the domain example.com in a Route 53 public hosted zone and need requests to the zone apex (example.com, with no subdomain) to resolve directly to the ALB. When the SysOps administrator attempts to create a standard CNAME record for example.com pointing to the ALB's DNS name, Route 53 rejects the configuration. What should the administrator do to correctly route apex traffic to the ALB?

Accepted Answer

Create a Route 53 Alias record (type A) for example.com that targets the ALB's DNS name.

Answer

Create a standard A record for example.com with the static public IP addresses of the ALB.

Answer

Create a CNAME record for example.com and lower the TTL to 60 seconds so it is accepted.

Answer

Create an NS record delegating example.com to the ALB's DNS name.

Question 15

A media company must serve users in Germany from an EU-based origin to comply with data residency regulations, regardless of which endpoint offers the lowest network latency. Users everywhere else should be directed to the nearest of three regional endpoints for the best performance. Which Route 53 configuration meets both requirements?

Accepted Answer

Create a geolocation routing policy with a record for Germany pointing to the EU endpoint, and use latency-based records within a broader configuration for all other locations plus a default record.

Answer

Use latency-based routing for all endpoints and rely on AWS to keep German traffic within the EU region.

Answer

Use weighted routing, assigning 100% weight to the EU endpoint for German users and distributing remaining weight across other endpoints.

Answer

Use a geoproximity routing policy with a positive bias applied to the EU endpoint so all traffic prefers it.

Question 16

A SysOps administrator manages a Route 53 public hosted zone for an internal API that runs on eight EC2 instances behind no load balancer (clients connect directly by DNS name). The team wants DNS to return multiple healthy instance IP addresses per query and to automatically stop returning the IP of any instance that fails a health check. The solution must not require provisioning a load balancer. Which Route 53 configuration meets these requirements?

Accepted Answer

Create eight separate A records with the same name using multivalue answer routing, each with its own health check referencing one instance.

Answer

Create a single simple routing record of type A containing all eight instance IPs, and associate a health check with the record set.

Answer

Create eight A records with the same name using weighted routing, assigning each an equal weight and a health check.

Answer

Create a single A record using failover routing with all eight IPs listed as the primary and a health check on the record.

Question 17

A company runs an internal application in a VPC. Developers created a private hosted zone in Route 53 for the domain 'internal.example.com' and added an A record for 'api.internal.example.com' pointing to an internal ALB. EC2 instances in the VPC cannot resolve 'api.internal.example.com' and receive NXDOMAIN, even though the record exists. The VPC has DNS resolution and DNS hostnames enabled. What is the MOST likely cause?

Accepted Answer

The private hosted zone has not been associated with the VPC where the EC2 instances run.

Answer

The instances are missing an inbound security group rule allowing DNS on UDP port 53.

Answer

A network ACL is blocking outbound traffic to the Route 53 resolver at 169.254.169.253.

Answer

The A record must be created as an alias record for Route 53 to resolve it inside a VPC.

Question 18

A company connects its on-premises data center to an AWS VPC using a Site-to-Site VPN. On-premises servers need to resolve the private DNS names of resources hosted in a Route 53 private hosted zone associated with the VPC. Currently, on-premises DNS queries for these private names fail, while EC2 instances inside the VPC resolve the names correctly. What should the SysOps administrator implement to enable on-premises resolution of the private hosted zone records?

Accepted Answer

Create a Route 53 Resolver inbound endpoint in the VPC and configure on-premises DNS servers to forward queries for the private domain to the endpoint's IP addresses.

Answer

Create a Route 53 Resolver outbound endpoint in the VPC and add a forwarding rule pointing to the on-premises DNS servers.

Answer

Convert the private hosted zone to a public hosted zone so that on-premises servers can resolve the records over the internet.

Answer

Associate a second VPC CIDR block with the private hosted zone and update the VPN route tables to include it.

Question 19

A SysOps administrator deploys an EC2 web server in a public subnet. The security group allows inbound TCP 443 from 0.0.0.0/0 but has NO outbound rules configured (all outbound rules were removed). The associated network ACL uses the default allow-all rules. Users report they cannot receive responses when connecting to the web server over HTTPS. What is the MOST likely cause and the correct fix?

Accepted Answer

Security groups are stateful, so return traffic is automatically allowed regardless of outbound rules; the real problem must be the route table missing an internet gateway route.

Answer

Security groups are stateful, so removing all outbound rules blocks the return traffic; add an outbound rule allowing the response traffic (or restore the default allow-all outbound rule).

Answer

The network ACL is blocking ephemeral return ports; add an inbound NACL rule for ports 1024-65535.

Answer

The inbound rule must specify the client's ephemeral source ports instead of 0.0.0.0/0; change the inbound rule to allow TCP 1024-65535.

Question 20

A company runs 12 VPCs across a single AWS Region, all attached to a Transit Gateway. To reduce cost and management overhead, the networking team deployed a single 'egress' VPC containing a NAT gateway and an internet gateway, and they want all private subnets in the 12 spoke VPCs to reach the internet through this shared egress VPC. Instances in the spoke VPCs currently cannot reach the internet. The Transit Gateway attachments and association/propagation appear correct. Which additional configuration is required to make centralized internet egress work?

Accepted Answer

In each spoke VPC's private subnet route table, add a default route (0.0.0.0/0) pointing to the Transit Gateway; in the egress VPC, add a Transit Gateway route table static route for the spoke CIDRs and route 0.0.0.0/0 to the NAT gateway.

Answer

Enable VPC peering between each spoke VPC and the egress VPC in addition to the Transit Gateway attachments.

Answer

Attach an internet gateway to each of the 12 spoke VPCs and add a 0.0.0.0/0 route to it in the private subnets.

Answer

Enable appliance mode on the spoke VPC attachments and add the NAT gateway to each spoke VPC's route table.

More SOA-C02 practice