Networking and Content Delivery — SOA-C03 Practice Quiz

Question 1

A CloudOps engineer manages a single Application Load Balancer that fronts three microservices running on separate Amazon ECS services. Requests to /api/orders must reach the orders service, /api/inventory must reach the inventory service, and all other requests must reach a default web frontend service. All three services are already registered in separate target groups. What is the correct way to configure the ALB to achieve this routing?

Accepted Answer

Create listener rules on the HTTPS listener that use path-based conditions (/api/orders*, /api/inventory*) to forward to the respective target groups, and set the default action to forward to the web frontend target group.

Answer

Create three separate Application Load Balancers, one per target group, and use Route 53 weighted records to distribute traffic based on the request path.

Answer

Configure a single listener rule with host-based conditions mapping each hostname to a target group, then rely on the security groups to filter requests by path.

Answer

Attach all three target groups to the listener's default action as a weighted forward action so the ALB balances requests across services.

Question 2

A company runs a stateful web application behind an Application Load Balancer (ALB) with a target group of six EC2 instances across three Availability Zones. To keep user sessions on the same backend, the team enabled duration-based cookie stickiness on the target group. After a marketing campaign, users report slow response times, and CloudWatch shows two instances consistently at high CPU while the other four remain nearly idle. What is the MOST likely cause of the uneven load and the BEST corrective action?

Accepted Answer

Session stickiness is binding long-lived client sessions to a subset of instances; the imbalance is expected with stickiness, and the team should scale based on connection distribution or reduce the stickiness duration.

Answer

Cross-zone load balancing is disabled; enable it on the ALB so requests are distributed evenly across all registered targets.

Answer

The health check interval is too long; shorten it so the ALB detects and reroutes traffic away from busy instances faster.

Answer

The target group deregistration delay is too high; lower it so busy instances drain connections and receive fewer new requests.

Question 3

A company serves a website through Amazon CloudFront with an Application Load Balancer origin. Static assets under /static/* are cached correctly, but API responses under /api/* are being served stale and are also ignoring session-specific results because CloudFront caches responses regardless of the Authorization header and query strings. The default cache behavior uses a caching policy with a long TTL. A CloudOps engineer must ensure that /api/* requests always reach the origin with the Authorization header and all query strings forwarded, while keeping /static/* cached. What is the MOST appropriate solution?

Accepted Answer

Create a separate cache behavior for the /api/* path pattern and associate the AWS managed CachingDisabled cache policy along with an origin request policy that forwards the Authorization header and all query strings.

Answer

Reduce the default cache behavior TTL to zero and enable header forwarding for Authorization on the default behavior so both /api/* and /static/* bypass the cache.

Answer

Add an alternate origin for the API and enable origin failover so dynamic requests are routed to the origin only when the cache misses.

Answer

Create a CloudFront function on the viewer request event that deletes cached objects for /api/* and forwards the Authorization header to the origin.

Question 4

A media company serves images through Amazon CloudFront with an Amazon S3 origin. The CloudOps team notices a low cache hit ratio and higher-than-expected S3 request costs. Investigation shows the application appends a unique tracking query string parameter (for example, ?userId=xxxx) to every image URL, though the parameter does not affect which image is returned. What is the MOST effective change to improve the cache hit ratio?

Accepted Answer

Configure the cache policy to not include any query strings in the cache key while still allowing the requests to succeed

Answer

Enable CloudFront to forward all query strings to the origin and include them in the cache key

Answer

Reduce the default TTL on the cache behavior to force more frequent revalidation with S3

Answer

Add a second CloudFront distribution and split traffic between them with Route 53 weighted routing

Question 5

A CloudOps engineer manages a static website hosted in an S3 bucket and served through Amazon CloudFront with a default TTL of 86400 seconds. The web team just deployed updated HTML and CSS files to the S3 origin, but users continue to see the old versions of the pages when browsing the site. The team needs the updated files to be served to all users as quickly as possible without waiting for the TTL to expire. Which action should the engineer take?

Accepted Answer

Create a CloudFront invalidation specifying the paths of the changed files (or /*) to remove them from the edge caches.

Answer

Disable and re-enable the CloudFront distribution to force all edge locations to refresh their cached objects.

Answer

Enable S3 versioning on the origin bucket so CloudFront automatically fetches the newest object versions.

Answer

Lower the distribution's minimum TTL to 0 and wait for the change to propagate to all edge locations.

Question 6

A company serves a single-page web application from an Amazon S3 bucket through Amazon CloudFront. During brief origin outages and deployment windows, users see raw XML error responses returned directly from S3, which harms the user experience. The CloudOps team wants CloudFront to return a branded, friendly HTML error page whenever the origin responds with HTTP 500, 502, 503, or 504 errors, without changing the application code. Which action meets this requirement?

Accepted Answer

Configure a CloudFront custom error response for each 5xx error code that points to a custom HTML object and set an appropriate error caching minimum TTL.

Answer

Attach an AWS WAF web ACL to the distribution with a rule that blocks 5xx responses and returns a custom block page.

Answer

Enable S3 static website hosting on the origin bucket and configure the bucket's error document, then point CloudFront to the website endpoint.

Answer

Add a Lambda@Edge function on the viewer request event to detect origin failures and rewrite the response body to HTML.

Question 7

A media company distributes licensed video content through an Amazon CloudFront distribution backed by an S3 origin. Due to licensing agreements, the content must not be accessible from viewers located in three specific countries. The CloudOps engineer must enforce this restriction at the edge with minimal operational overhead and without modifying the origin. Which approach meets these requirements?

Accepted Answer

Configure CloudFront geographic restrictions (geo-blocking) with a blocklist of the three countries on the distribution.

Answer

Attach a network ACL to the S3 origin subnet denying inbound traffic from the countries' IP ranges.

Answer

Create a Route 53 geolocation routing policy that returns no answer for viewers in the three countries.

Answer

Add an S3 bucket policy condition using aws:SourceIp to deny requests from IP ranges in the three countries.

Question 8

A company serves a static website from an Amazon S3 bucket through an Amazon CloudFront distribution. The bucket has Block Public Access enabled. After migrating from a legacy Origin Access Identity (OAI) to Origin Access Control (OAC), users report that all requests to the site return HTTP 403 Access Denied. The CloudFront origin is correctly configured to use OAC. What is the MOST likely cause that a CloudOps engineer should investigate first?

Accepted Answer

The S3 bucket policy still grants access only to the old OAI principal and was not updated to allow the CloudFront service principal with the distribution's source ARN condition.

Answer

The CloudFront distribution is missing an SSL/TLS certificate from AWS Certificate Manager in the us-east-1 Region.

Answer

Block Public Access must be disabled on the S3 bucket for OAC to retrieve objects from the origin.

Answer

The CloudFront distribution's default root object is not set, causing S3 to reject the requests.

Question 9

A media company serves web assets through Amazon CloudFront with a single Amazon S3 bucket as the origin. During a recent regional S3 disruption, users received 5xx errors because CloudFront could not reach the origin. The company has already replicated all assets to a second S3 bucket in another Region. A CloudOps engineer must configure CloudFront so that requests automatically fail over to the secondary bucket when the primary origin returns specific error responses, without changing the viewer-facing domain name. What should the engineer do?

Accepted Answer

Create a CloudFront origin group containing both S3 buckets as origins, define the failover criteria to include the desired HTTP status codes, and associate the origin group with the cache behavior.

Answer

Create a Route 53 failover routing policy with health checks that point to each S3 bucket, and set the CloudFront distribution origin to the Route 53 record.

Answer

Enable S3 Cross-Region Replication and configure a Lambda@Edge function to rewrite the origin domain when it detects 5xx responses from the primary bucket.

Answer

Add both S3 buckets as separate origins with separate cache behaviors and use CloudFront weighted origin distribution to shift traffic during failures.

Question 10

A media company hosts premium video files in an Amazon S3 bucket served through Amazon CloudFront. The business requires that only authenticated, paying subscribers can access individual video files, and each access link must automatically expire 15 minutes after it is issued. The company wants to enforce this without exposing the S3 bucket publicly. Which approach meets these requirements?

Accepted Answer

Configure CloudFront signed URLs with a short expiration time and use an Origin Access Control (OAC) so the S3 bucket is only accessible via CloudFront.

Answer

Enable AWS WAF on the CloudFront distribution with a rate-based rule that blocks requests after 15 minutes of activity.

Answer

Attach a bucket policy that allows public read access and rely on CloudFront geo-restriction to limit who can view the content.

Answer

Use CloudFront field-level encryption to encrypt the video files and distribute decryption keys to subscribers.

Question 11

A company has a Direct Connect connection between their on-premises data center and AWS. Applications on-premises need to access Amazon S3 buckets over the Direct Connect link without traversing the public internet, while also being able to reach EC2 instances in a private subnet of their VPC. Currently only a private VIF is configured, allowing access to the VPC. Which action should the CloudOps engineer take to enable on-premises access to S3 over Direct Connect while keeping traffic off the public internet?

Accepted Answer

Create a public virtual interface (public VIF) on the Direct Connect connection to reach S3 public endpoints over the private DX link.

Answer

Add a gateway VPC endpoint for S3 and route on-premises traffic to it through the existing private VIF.

Answer

Configure a NAT gateway in the VPC and route the on-premises S3 requests through the private VIF and NAT gateway.

Answer

Enable an internet gateway in the VPC and update the private VIF route table to send S3 traffic to it.

Question 12

A company connects its on-premises data center to a VPC using a single 1 Gbps Direct Connect dedicated connection through a private virtual interface (VIF) to a virtual private gateway. During a recent Direct Connect maintenance event, all connectivity between the data center and the VPC was lost, causing an application outage. The CloudOps team must add a resilient backup path that automatically carries traffic if the Direct Connect connection fails, while keeping ongoing costs as low as possible. Which solution meets these requirements?

Accepted Answer

Provision a Site-to-Site VPN connection to the same virtual private gateway as a backup, relying on BGP so traffic fails over to the VPN when the Direct Connect connection is unavailable.

Answer

Order a second 1 Gbps Direct Connect dedicated connection at a different location and configure both private VIFs to the same virtual private gateway.

Answer

Create a Direct Connect gateway and attach a transit gateway so the existing connection automatically reroutes traffic during maintenance.

Answer

Enable a static route in the VPC route table pointing to the on-premises CIDR through the virtual private gateway as a standby path.

Question 13

A company is migrating an on-premises TCP-based payment processing application to AWS. Their downstream partners require whitelisting a small set of fixed IP addresses for inbound connections, and the backend fraud-detection service needs to see the original client source IP address for each request. The CloudOps engineer must expose the application through a load balancer that satisfies both requirements. Which solution meets these needs?

Accepted Answer

Deploy a Network Load Balancer with an Elastic IP assigned per subnet, and register targets by instance ID so client source IP is preserved.

Answer

Deploy an Application Load Balancer and enable the X-Forwarded-For header so partners can whitelist the ALB's DNS name.

Answer

Deploy a Network Load Balancer with targets registered by IP address, and enable Proxy Protocol v2 to obtain a static set of load balancer IPs.

Answer

Deploy an Application Load Balancer behind a Global Accelerator and register targets by instance ID to preserve the source IP.

Question 14

A company runs an internal application on EC2 instances across two VPCs (VPC-A and VPC-B) in the same AWS account. Developers need to reach the application in VPC-A using the custom domain name app.internal.example.com. A CloudOps engineer created a Route 53 private hosted zone for internal.example.com and associated it only with VPC-A. Instances in VPC-A resolve the name correctly, but instances in VPC-B receive an NXDOMAIN response when querying app.internal.example.com. What is the correct action to enable resolution from VPC-B?

Accepted Answer

Associate VPC-B with the existing private hosted zone for internal.example.com.

Answer

Enable the enableDnsHostnames attribute on VPC-B and reboot the instances.

Answer

Create a VPC peering connection between VPC-A and VPC-B and update the route tables.

Answer

Change the Route 53 hosted zone from private to public so both VPCs can resolve the record.

Question 15

A company runs an on-premises data center connected to an AWS VPC over AWS Direct Connect. Applications running on servers in the data center need to resolve the private DNS names of resources hosted in a Route 53 private hosted zone associated with the VPC. Currently, on-premises DNS queries for these private names fail because the on-premises DNS servers cannot forward queries to AWS. Which solution enables the on-premises servers to resolve the private hosted zone records?

Accepted Answer

Create a Route 53 Resolver inbound endpoint in the VPC and configure the on-premises DNS servers to forward queries for the private zone domain to the endpoint's IP addresses.

Answer

Create a Route 53 Resolver outbound endpoint in the VPC and add a forwarding rule pointing to the on-premises DNS servers.

Answer

Associate the private hosted zone with the on-premises network by adding the data center CIDR to the hosted zone's VPC association list.

Answer

Enable DNS resolution and DNS hostnames on the VPC and add the on-premises DNS server IPs to the VPC DHCP option set.

Question 16

A company runs applications in a VPC that must resolve DNS records hosted on their on-premises Active Directory DNS servers (domain corp.internal), which are reachable over an existing AWS Direct Connect connection. Currently, EC2 instances in the VPC can resolve public domains and internal AWS resources but fail to resolve any corp.internal hostnames. A CloudOps engineer must enable resolution of corp.internal names from the VPC with the least operational overhead. What should the engineer configure?

Accepted Answer

Create a Route 53 Resolver outbound endpoint and a forwarding rule for corp.internal that targets the on-premises DNS server IPs, then associate the rule with the VPC.

Answer

Create a Route 53 Resolver inbound endpoint in the VPC and point the on-premises DNS servers to it as a conditional forwarder.

Answer

Create a Route 53 private hosted zone named corp.internal, associate it with the VPC, and manually add all on-premises records.

Answer

Deploy custom DNS forwarder EC2 instances in the VPC and update the DHCP options set to use their private IPs as the domain name servers.

Question 17

A company has 12 VPCs across two AWS Regions connected using a full mesh of VPC peering connections. As the number of VPCs grows, the networking team struggles to manage the increasing number of peering connections and route table entries. They need a solution that provides centralized, scalable connectivity between all VPCs (including transitive routing) and supports future growth with minimal operational overhead. Which solution should the team implement?

Accepted Answer

Replace the VPC peering mesh with an AWS Transit Gateway in each Region and use Transit Gateway peering to connect the two Regions.

Answer

Continue using VPC peering but consolidate route table entries by summarizing CIDR ranges across all VPCs.

Answer

Deploy a NAT gateway in a central VPC and route all inter-VPC traffic through it for transitive connectivity.

Answer

Create AWS Site-to-Site VPN connections between each pair of VPCs to enable transitive routing.

Question 18

A CloudOps engineer has enabled IPv6 on a VPC. EC2 instances in a private subnet have IPv6 addresses and must initiate outbound connections to external APIs over IPv6 to download updates. For security, these external hosts must NOT be able to initiate inbound connections to the instances. The instances do not need IPv4 internet access. What should the engineer configure to meet these requirements?

Accepted Answer

Add a route in the private subnet's route table pointing ::/0 to an egress-only internet gateway attached to the VPC.

Answer

Add a route in the private subnet's route table pointing ::/0 to a NAT gateway in a public subnet.

Answer

Add a route in the private subnet's route table pointing ::/0 to an internet gateway attached to the VPC.

Answer

Attach an Elastic IP to each instance and add a route pointing ::/0 to a NAT instance.

Question 19

A CloudOps engineer created a Gateway VPC endpoint for Amazon S3 so that EC2 instances in private subnets can reach S3 without traversing a NAT gateway. Route tables and security groups are correctly configured, and instances can list and download from any S3 bucket. However, the security team requires that traffic through this endpoint be allowed to reach ONLY two specific corporate buckets and be denied access to all other buckets, including buckets in other AWS accounts. What is the MOST appropriate way to enforce this restriction?

Accepted Answer

Attach an endpoint policy to the S3 Gateway endpoint that allows actions only on the two specific bucket ARNs and denies all others.

Answer

Modify the route table associated with the private subnets to add explicit routes only to the CIDR ranges of the two allowed buckets.

Answer

Add outbound security group rules on the EC2 instances that allow HTTPS only to the prefix list of the two allowed buckets.

Answer

Create a NACL on the private subnets that denies all S3 traffic except to the IP ranges of the two allowed buckets.

Question 20

A CloudOps engineer is troubleshooting intermittent connection failures between an application server in a private subnet and an Amazon RDS database in another private subnet within the same VPC. The security groups appear correctly configured to allow the database port. The engineer needs to determine whether traffic is actually reaching the database subnet and identify exactly where packets are being dropped, including which rule set is rejecting them. Which action provides the most direct visibility into the accepted and rejected traffic at the network interface level?

Accepted Answer

Enable VPC Flow Logs on the relevant network interfaces (or subnets) and analyze the ACCEPT and REJECT records for the database port.

Answer

Enable AWS CloudTrail data events for the VPC to capture all packet-level activity between the subnets.

Answer

Use Amazon CloudWatch default EC2 metrics to inspect the NetworkPacketsIn and NetworkPacketsOut counters for dropped packets.

Answer

Enable Route 53 Resolver query logging to confirm the application is resolving the RDS endpoint correctly.

More SOA-C03 practice