Networking and Content Delivery (18%)

SOA-C03 · 54 questions

• A research VPC must let private subnets open outbound IPv6 connections and must not accept unsolicited inbound IPv6 from the internet. NAT gateways already handle IPv4. What should they add for IPv6?
• A city application in private subnets reads and writes one S3 bucket and must stop sending that traffic through the NAT gateway. The team also wants to avoid the hourly charge of an interface VPC endpoint. Which change keeps the S3 path on the AWS network?
• Clients time out reaching a university web tier on port 443. The instance security group allows 443 from the internet, and the subnet NACL allows inbound 443. Return traffic never leaves. Which change matches that symptom?
• Users on the internet cannot open a city's public web instances. Those instances have public addresses, and their subnet route table sends 0.0.0.0/0 to a NAT gateway. A private subnet in the same VPC is the one that was meant to use that NAT gateway. What should change?
• A factory's private-subnet instances cannot download patches. Their route table has no route for 0.0.0.0/0. A NAT gateway is already up in a public subnet whose route table sends 0.0.0.0/0 to an internet gateway. What should the operator add first?
• A freight carrier's Route 53 record sends users to a primary Application Load Balancer. DNS must switch to a secondary load balancer only when the primary health check fails. Which routing configuration does that?
• A freight API is reachable from inside its subnet and times out from the office across a VPN. The instance security group allows the API port from the office CIDR. The subnet NACL has no inbound allow for that port from the office CIDR, and a later rule denies the rest. What should change?
• A clinic's public and private subnets were given the same route table to save time. Someone then pointed 0.0.0.0/0 at a NAT gateway so the private instances could patch. The public website in that VPC stopped answering the internet. What is the durable fix?
• A private application must call a partner API that the partner exposes only through AWS PrivateLink. The application must not use the public internet. Which endpoint type is the right one to create?
• Instances in a public subnet cannot download patches. The subnet route table sends 0.0.0.0/0 to an internet gateway. The instances have no public IPv4 address, and there is no route to a NAT gateway. What gives them egress with the least change?
• Two VPCs are peered. Instances in VPC A can send packets toward VPC B, and VPC B never answers. VPC A's route table has a route to VPC B's CIDR through the peering connection. VPC B's route table has no route back to VPC A's CIDR. What is missing?
• Private instances in a factory VPC suddenly cannot reach the internet to pull patches. The private subnet's default route now shows a blackhole status because the NAT gateway was deleted during a cleanup. What restores egress?
• A private application cannot call an interface VPC endpoint on port 443. The endpoint is available. Its security group does not allow the application's security group. What should change?
• Three application VPCs must reach each other. The team peered A to B and B to C, and instances in A still cannot reach C. They expected the path to pass through B. What connectivity should they use instead?
• A private application reaches S3 through a gateway endpoint, and the route to the S3 prefix list is in place. The IAM role allows s3:GetObject. Gets of one bucket still return Access Denied. The gateway endpoint policy does not allow that bucket. What is denying the call?
• An interface VPC endpoint for a service exists in a private subnet, and private DNS on the endpoint is disabled. The application uses the service's normal public DNS name and its traffic still goes out the NAT gateway. What should be enabled?
• A public retail site behind an Application Load Balancer is receiving a flood of HTTP requests that look like a scripted scrape. The team wants to block that request pattern. A security group change was proposed. What fits the HTTP pattern better?
• A public IP on an Application Load Balancer is under a volumetric flood of packets. The proposed fix is a long list of NACL deny rules for the source addresses. Which service is built for that volumetric flood?
• Instances in a VPC are resolving a known malware domain. The team wants those DNS queries blocked. A security group change was suggested. What blocks the name?
• A design places a NAT gateway in every Availability Zone. The availability requirement is that only two of the four zones need outbound internet, and the NAT data charge is the top network cost. What should change?
• Trusted Advisor flags a security group that allows port 22 from 0.0.0.0/0. The audit wants that finding cleared. What should change?
• A manufacturer must filter east-west traffic inside a VPC by domain name and by port. The traffic is not HTTP to a public load balancer. Which control matches that filter?
• A chatty pair of services runs one task in each of two Availability Zones, and cross-AZ data transfer is the largest network charge. The design allows both tasks to run in the same zone. What cuts that charge?
• Most of a private subnet's NAT gateway bill is traffic to Amazon S3. The instances must keep using private addresses. What removes that S3 traffic from the NAT gateway?
• A logistics security review asks which DNS names instances in a VPC resolved last Tuesday, including names that were blocked. VPC Flow Logs are already on. Where is that name evidence?
• A hospital is moving a public DNS name to a new endpoint and wants only a small share of queries to receive the new address. The rest must keep the current endpoint. A geolocation record for one country was proposed. Which policy performs that canary?
• Factory instances resolve a name in their private hosted zone to the wrong address. A Resolver forwarding rule for that same domain sends queries to the plant, and the private zone is associated with the VPC. Why does the private record lose?
• Shoppers in two Regions use a retail checkout site, and each Region has its own Application Load Balancer. Each shopper should reach the balancer with lower latency. A failover record with one primary Region was proposed. Which Route 53 policy fits?
• Factory instances in a private VPC must resolve a corporate DNS name that exists only on the plant's resolvers. Public DNS has no such name, and no inbound endpoint is involved. What should the VPC use?
• On-premises DNS servers must resolve private names that exist only in a VPC. The names must not be published on the public internet. What should the VPC side provide?
• A CloudFront distribution uses an ALB as its origin. Viewers reach CloudFront over HTTPS, but origin fetches fail after the ALB stopped accepting HTTP. The origin protocol policy is still HTTP only. What should change?
• A museum photo site serves the same images to viewers worldwide, and the images rarely change. A teammate wants Global Accelerator in front of the origin so those images are cached near viewers. Which design caches the images at the edge?
• CloudFront must reach an application that runs on a private instance. An operator wants the instance private IP published in a public DNS record and used as the origin domain. What should the origin be instead?
• A factory license name must be returned only to resolvers in one country. Resolvers in other countries must not receive that address. Latency-based routing across the factory Regions was proposed. Which policy enforces the country limit?
• A bank wants a service name to hand clients several healthy endpoints so a client can try more than one address. A simple record containing only the primary address was proposed. Which Route 53 policy fits?
• A retailer needs static anycast IP addresses that accept TCP and forward it to Application Load Balancers in two Regions. A CloudFront distribution in front of those balancers was proposed for the same TCP flows. Which service fits?
• Instances in a private subnet need outbound IPv6 and must not accept connections started from the internet. The route table sends the IPv4 default route to a NAT gateway and has no IPv6 default route. What should be added?
• A private instance in one VPC cannot reach a database subnet in a peered VPC. The peering connection is active, and only the instance side route table sends the database CIDR through that connection. What should be added?
• A payroll service allows its application port from the corporate prefix on the instance security group. Clients still time out. The subnet network ACL has no inbound allow for that port from the prefix. What should be changed?
• A new VPC attachment on a Transit Gateway is available, and the VPC route table sends the remote CIDR to that gateway. Traffic still drops. The attachment is not associated with any Transit Gateway route table. What should be configured?
• Two instances in the same VPC cannot connect on the application port. VPC Reachability Analyzer reports that the path is blocked by a security group. What should the operator do next?
• Private subnets in three Availability Zones send internet-bound traffic to one NAT gateway, and that gateway's zone is impaired. Instances have lost egress. How should outbound access be restored?
• A parts catalog returns the same CloudFront object for two different query strings. The cache policy does not include the query string. What should change so each query string is cached separately?
• Players of a trivia app report errors from an Application Load Balancer. An operator needs the request line and the target status those players hit. Which log contains that HTTP detail?
• A game studio sees REJECT entries in VPC Flow Logs for clients that never reach an API. An engineer wants the HTTP status code those clients received. What do those REJECT entries show?
• A bookstore's web ACL is blocking some checkout requests. The Application Load Balancer access log shows 403 and does not name a rule. Where is the rule that terminated the request?
• A news site's CloudFront cache statistics show a high error rate, and the team needs the per-request HTTP status and error type, including whether the origin caused it. Which source provides that?
• Magazine editors replaced an object in the origin this morning, but viewers still receive yesterday's file from CloudFront. No invalidation has been created, and the cached object has not expired. Why do viewers still see yesterday's file?
• Instances in a spoke VPC reach the transit gateway, and that attachment's transit gateway route table has a route to a shared-services VPC. Return traffic dies. The shared-services attachment uses a route table with no route to the spoke. What should be added?
• A benefits portal caches the signed-in account page at CloudFront. The cache policy includes no cookies, one member receives another member's page, and that page must not be cached. What should that behavior do?
• A plant's Site-to-Site VPN tunnel shows UP on the AWS side and down on the on-premises firewall. The firewall's Phase 2 traffic selector does not match the networks the VPN is set to carry. What should change?
• A hybrid application is losing packets between a private subnet and the on-premises network. Instance CPU is low. Which measurement should be used for that path?
• Users on the public internet report slow responses. The origin in the VPC is healthy and lightly loaded. Operators need the client ISP and the internet path, which a VPC flow log does not show. What provides that view?
• New instances in a shared VPC cannot resolve the corporate DNS zone. Instances that still use a hard-coded plant resolver can. The outbound Resolver rule for that zone targets two resolvers that were retired last week. What should be updated?