CoStudy

Home › Certifications › AWS Certified CloudOps Engineer SOA-C03 › Networking and Content Delivery

Networking and Content Delivery — AWS Certified CloudOps Engineer SOA-C03 practice questions

24 multiple-choice questions and 17 flashcards on Networking and Content Delivery, about 14% of the AWS Certified CloudOps Engineer SOA-C03 bank. Every one carries a written rationale.

Written and maintained by Nick Burton · last updated 2026-08-22 · how we write and review questions

What this chapter covers

Networking and Content Delivery is one of 5 chapters in CoStudy's AWS Certified CloudOps Engineer — Associate (SOA-C03) bank, and it holds 24 of the bank's 174 multiple-choice questions — roughly 14% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.

Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.

Free Networking and Content Delivery practice questions

3 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.

A media site wants CloudFront to fail over from a primary origin to a secondary origin when the primary returns 5xx errors.

  1. Use Lambda@Edge on origin response to retry the request on the second origin
  2. Rely on Route 53 health checks to swap origin DNS entries when failure occurs
  3. Configure CloudFront custom error pages to redirect to a backup S3 bucket URL
  4. Enable an origin group with primary and secondary and configured failover codes

Answer: D — Enable an origin group with primary and secondary and configured failover codes

A) Lambda@Edge can retry but is more complex than the native origin group. B) DNS TTL delays failover; not the CloudFront-native path. C) Error pages serve static content, not a secondary origin. D) Correct — CloudFront origin groups implement native origin failover on configured status codes.

A team wants to allowlist S3 access from a VPC to only the specific bucket used by their workload, blocking other buckets entirely.

  1. Rely on IAM policies attached to the workload's role to grant access only to that bucket ARN
  2. Add a bucket policy on the S3 bucket that references the VPC ID via aws:SourceVpc condition
  3. Configure a security group egress rule to the S3 prefix list and rely on IAM for bucket scope
  4. Attach a VPC endpoint policy on the S3 gateway endpoint that allows only that bucket ARN

Answer: D — Attach a VPC endpoint policy on the S3 gateway endpoint that allows only that bucket ARN

A) IAM scopes the identity, not the network. B) Half-right; bucket policy controls the bucket, not other buckets. C) SGs don't scope by bucket. D) Correct - VPC endpoint policy limits which buckets are reachable through the endpoint.

A workload requires host-based and path-based routing to different services behind a single HTTPS endpoint terminating TLS at the LB.

  1. Provision a Classic Load Balancer with both HTTP and HTTPS listeners configured now here
  2. Use a Network Load Balancer that supports TLS termination and static IPs per AZ today
  3. Attach a Gateway Load Balancer to distribute traffic across third-party appliances here
  4. Deploy an Application Load Balancer with listener rules for host and path patterns

Answer: D — Deploy an Application Load Balancer with listener rules for host and path patterns

A) CLB lacks host/path rules. B) NLB is Layer 4; no host/path. C) GWLB routes to appliances. D) Correct - ALB is Layer 7 with host/path routing.

Networking and Content Delivery flashcards

4 cards from the 17 in this chapter.

Transit Gateway?

Hub for connecting many VPCs and on-prem. Replaces complex peering.

ALB content-based routing?

Route based on path, host, headers, query params, source IP.

ELB types?

Application (HTTP/S, layer 7), Network (TCP/UDP, layer 4), Gateway (firewalls), Classic (legacy).

ELB cross-zone load balancing?

Distributes evenly across all AZs. Default ALB enabled, NLB disabled.

Practise the full chapter

These are a sample. The full Networking and Content Delivery chapter runs 41 items with per-chapter progress tracking, on the web and in the iOS app.

Open AWS Certified CloudOps Engineer SOA-C03 in CoStudy →

Other AWS Certified CloudOps Engineer SOA-C03 chapters

All AWS Certified CloudOps Engineer SOA-C03 practice questions →