A company has a VPC with EC2 instances in a private subnet that need to access an S3 bucket and DynamoDB table. Currently, they use a NAT gateway for this traffic, and the data transfer costs are high. They want to reduce costs. What is the most cost-effective solution?

Replace the NAT gateway with a NAT instance.

Create interface VPC endpoints for both S3 and DynamoDB.

Move the EC2 instances to a public subnet.

Create gateway VPC endpoints for both S3 and DynamoDB.

What is required for a VPC peering connection to be established between two VPCs?

The VPCs must be in the same Availability Zone.

The VPCs must be in the same AWS account and same Region.

The VPCs must use the same route table.

The VPCs must have non-overlapping CIDR blocks.

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The security group attached to the instance allows outbound HTTPS (port 443) to 0.0.0.0/0. The network ACL for the private subnet has an inbound rule that denies all traffic and an outbound rule that allows all traffic. A gateway VPC endpoint for S3 has been created and associated with the private subnet's route table. The instance cannot access the S3 bucket. What is the most likely cause?

The security group's outbound rule is not sufficient for the gateway endpoint.

The instance does not have a public IP address.

The network ACL's inbound deny-all rule is blocking the response traffic from S3.

The gateway VPC endpoint is not correctly associated with the route table.

A company runs a fleet of EC2 instances in a private subnet that need to access an S3 bucket to read and write data. Currently, they use a NAT gateway for this traffic, but the data transfer costs are high. The company wants to reduce costs and improve security by keeping traffic within the AWS network. What should they do?

Create a gateway VPC endpoint for S3 and add a route in the private subnet's route table pointing to the endpoint.

Move the EC2 instances to a public subnet and use an internet gateway.

Replace the NAT gateway with a NAT instance.

Create an interface VPC endpoint for S3 and attach it to the private subnet.

A company has a public-facing web application behind an Application Load Balancer (ALB). They are concerned about both DDoS attacks and application-layer attacks like SQL injection and cross-site scripting. They want to implement a comprehensive security solution that provides protection against both types of attacks while minimizing cost. What should they do?

Enable AWS Shield Advanced only.

Attach an AWS WAF web ACL to the ALB only.

Enable AWS Shield Standard and attach an AWS WAF web ACL to the ALB.

Enable AWS Shield Advanced and attach an AWS WAF web ACL to the ALB.

AWSCertified CloudOps Engineer - Associate

Domain 5Objective 1

Task 5.1: Implement and Optimize Networking Features and Connectivity. SOA-C03 Practice Questions (Page 6)

Part of the Content Domain 5: Networking and Content Delivery domain, which makes up ~20% of our current practice bank. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~10–17 in this domain), expect 3–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

12concepts

Questions 26–30

26application · medium
A company has a VPC with EC2 instances in a private subnet that need to access an S3 bucket and DynamoDB table. Currently, they use a NAT gateway for this traffic, and the data transfer costs are high. They want to reduce costs. What is the most cost-effective solution?
Select an answer first
27foundation · easy
What is required for a VPC peering connection to be established between two VPCs?
Select an answer first
28expert · hard
A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to access an S3 bucket. The security group attached to the instance allows outbound HTTPS (port 443) to 0.0.0.0/0. The network ACL for the private subnet has an inbound rule that denies all traffic and an outbound rule that allows all traffic. A gateway VPC endpoint for S3 has been created and associated with the private subnet's route table. The instance cannot access the S3 bucket. What is the most likely cause?
Select an answer first
29application · medium
A company runs a fleet of EC2 instances in a private subnet that need to access an S3 bucket to read and write data. Currently, they use a NAT gateway for this traffic, but the data transfer costs are high. The company wants to reduce costs and improve security by keeping traffic within the AWS network. What should they do?
Select an answer first
30expert · hard
A company has a public-facing web application behind an Application Load Balancer (ALB). They are concerned about both DDoS attacks and application-layer attacks like SQL injection and cross-site scripting. They want to implement a comprehensive security solution that provides protection against both types of attacks while minimizing cost. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SOA-C03

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “SOA-C03” is a trademark of its owner, used for identification only.

Task 5.1: Implement and Optimize Networking Features and Connectivity. SOA-C03 Practice Questions (Page 6)

Questions 26–30

A company has a VPC with EC2 instances in a private subnet that need to access an S3 bucket and DynamoDB table. Currently, they use a NAT gateway for this traffic, and the data transfer costs are high. They want to reduce costs. What is the most cost-effective solution?

What is required for a VPC peering connection to be established between two VPCs?

Keep studying — Content Domain 5: Networking and Content Delivery