5.0 Networking and Content Delivery SOA-C03 Practice Quiz

• A. A NAT gateway in a public subnet with private subnet routes pointing to it
• B. An internet gateway route directly from the private subnets
• C. A VPC peering connection to the same VPC
• D. A Route 53 private hosted zone

A CloudOps engineer creates private subnets for application servers that need outbound internet access for patching but must not accept inbound internet connections. A NAT gateway in a public subnet gives private-subnet instances outbound IPv4 internet access while route tables still prevent unsolicited inbound internet connections to those instances. This is the correct answer.

• A. An S3 gateway VPC endpoint and route table entries for the private subnets
• B. A larger NAT gateway
• C. A Route 53 health check
• D. An ALB listener rule

An EC2 instance in a private subnet cannot reach Amazon S3, and the company wants to avoid NAT data processing charges for S3 traffic. An S3 gateway endpoint keeps S3 traffic on the AWS network through route table entries and avoids sending that traffic through a NAT gateway. This is the correct answer.

• A. A default route to an egress-only internet gateway for IPv4
• B. A default route to an internet gateway associated with the VPC
• C. A route to AWS Backup
• D. A route to an S3 gateway endpoint only

A new public web tier in a VPC cannot reach the internet even though instances have public IPv4 addresses. Public IPv4 instances need a subnet route table path to the internet gateway before their public addresses can be used for internet connectivity. This is the correct answer.

• A. 0.0.0.0/0 for all ports
• B. The load balancer security group
• C. The S3 bucket ARN
• D. The Route 53 hosted zone ID

A security group should allow HTTPS from an Application Load Balancer to EC2 targets. Referencing the load balancer security group allows only traffic forwarded by the ALB to reach the targets on HTTPS. This is the correct answer.

• A. AWS WAF
• B. VPC peering
• C. Amazon SES
• D. AWS Backup Vault Lock

Two VPCs need private connectivity and their CIDR ranges do not overlap. VPC peering provides private, direct connectivity between two non-overlapping VPCs when transitive routing is not required. This is the correct answer.

• A. A NAT gateway for IPv6-only traffic
• B. A CloudFront origin access control
• C. An egress-only internet gateway with an IPv6 default route
• D. An AWS WAF web ACL

An IPv6-only private subnet needs outbound internet access without allowing unsolicited inbound connections. Public IPv4 instances need a subnet route table path to the internet gateway before their public addresses can be used for internet connectivity. This is the correct answer.

• A. Add an IAM permission boundary
• B. Enable S3 Versioning
• C. Add rules that allow required inbound and outbound ephemeral port traffic
• D. Create a CloudTrail Lake query

A stateless network ACL blocks return traffic for application requests. Network ACLs are stateless, so both request traffic and return traffic on ephemeral ports must be explicitly allowed. This is the correct answer.

• A. It has no default route
• B. It routes all traffic to an EFS mount target
• C. It routes all traffic to an IAM role
• D. It has a route to an internet gateway for public traffic

A subnet should host public load balancers. A subnet that hosts public load balancers needs a public route through the VPC internet gateway so clients on the internet can reach the load balancer nodes. This is the correct answer.