Based on the SOA-C02 exam guideReport an error

SOA-C02· AssociateWeek 8 · Day 5~31 min read

Day 5 - Week 8 Comprehensive Review and 12 Scenario Problems

Week 8 descended through every layer of VPC as a virtual data center. First, we saw VPC's emergence replacing EC2-Classic and Security Group/NACL's stateful/stateless separation. Second, we observed traffic through Flow Logs, Traffic Mirroring, and Reachability Analyzer's three abstraction levels. Third, we explored three ways to meet outside — NAT GW, VPC Endpoint, PrivateLink. Fourth, we connected multiple VPCs and on-premises — Transit Gateway, VPN, Direct Connect, Route 53.

This section doesn't recap those four — instead it synthesizes exam-frequent scenario decision trees into 12 problems. Real operator decisions — "should I add SG or modify NACL now," "NAT GW costs spike, where to cut first," "go Active-Active or Pilot Light DR" — practicing these decision trees helps both exam passing and operations.

Week 8 Core Summary in 12 One-Liners

The 12 most-frequent facts from four previous essays summarized:

SG = Stateful, NACL = Stateless — NACL requires explicit ephemeral port (1024-65535) bidirectional
Each subnet reserves 5 IPs (/28 leaves usable 11)
Public/Private essence is route table's IGW route presence (subnet itself has no attribute)
Flow Logs record metadata only — 169.254.x.x AWS internal traffic unrecorded
Traffic Mirroring supports Nitro instances only — VXLAN encapsulation copies
Reachability Analyzer simulates, NAA scans broad-scale
NAT GW is AZ-bound — 1 per AZ + route to own AZ
Gateway Endpoint = S3/DDB only + free, Interface = PrivateLink + paid
VPC Peering non-transitive, TGW transitive
VPN = immediate & cheap, DX = consistent & high-bandwidth (DX itself unencrypted)
Route 53 8 policies — Latency (performance), Geolocation (regulation), Failover (DR)
Resolver Inbound = on-premises→VPC, Outbound = VPC→on-premises

4 Core Comparison Tables

Four most-frequent comparisons operators face in exams:

Three Observation Tools

Item	Flow Logs	Traffic Mirroring	Reachability Analyzer
Data	Metadata 5-tuple	Actual packets (payload)	Policy graph simulation
Abstraction	L3/L4	L7	Policy evaluation
Cost	Storage volume	Traffic replication	Per-analysis
Target	ENI/Subnet/VPC	Nitro ENI only	Between two resources
Question answered	Who talks to whom how much	What flows	Can reach

Multi-VPC Connectivity

Item	VPC Peering	Transit Gateway
Topology	Mesh (N×N)	Hub-and-Spoke (N)
Transitive	No	Yes
Cost	Data transfer only	Attachment per-hour + data
Management	N(N-1)/2 complex	N simple
Suitable scale	2-5 VPCs	5+ VPCs

Two VPC Endpoint Types

Item	Gateway	Interface (PrivateLink)
Services	S3, DynamoDB only	Almost all AWS + company
Cost	Free	Per-hour + per-GB
Mechanism	Route table prefix list	Private IP on ENI
Routing	Route Table entry	DNS resolution
Cross-Account	No	Yes

On-Premises Connectivity

Item	Site-to-Site VPN	Direct Connect
Medium	Internet + IPsec	Dedicated optical cable
Bandwidth	~1.25 Gbps per tunnel	1/10/100 Gbps
Latency	Variable	Consistent, low
Setup	Immediate (hours)	Weeks to months
Encryption	Built-in (IPsec)	None (MACsec separate)
Cost	Cheap	Expensive

📝 Practice Questions

Click a choice to reveal the answer and explanation.

Question 1

Custom NACL has inbound 80 allowed but HTTP requests arrive while responses don't. Why?

Question 2

Private EC2 sends 1TB daily to S3, NAT GW costs spike. Best solution?

Question 3

Private VPC (Internet blocked), using SSM Session Manager. Required setup?

Question 4

Private EC2 fails external API calls. First tool to use?

Question 5

Company runs 20 VPCs + on-premises integrated network. Most efficient tool?

Question 6

Multi-Region environment, auto-route users to fastest (minimum latency) region?

Question 7

Multi-AZ private subnet HA external communication configuration?

Question 8

Security team needs actual HTTP headers and body from suspicious instance for IDS analysis?

Question 9

B2B SaaS exposes service to customer VPCs without Internet; some customer CIDRs overlap own company. Which technology?

Question 10

Running on Direct Connect alone; need high availability for circuit failure. AWS recommended pattern?

Question 11

Operator analyzes NAT GW costs via Flow Logs finding "which instance sends most data outbound." Most efficient method?

Question 12

Company policy: "EC2 in VPC access only company-owned S3 buckets, never external accounts." Which tool enforces?

Question 13

Company set up Multi-Region Active-Passive DR. Route 53 Failover on Primary ALB failure works, but due to DNS TTL 300s + some ISPs additional caching, RTO exceeds 7 minutes. Reduce RTO to 1-2 seconds?

Question 14

Operator attached Prod VPC and Dev VPC to Transit Gateway. Policy requires "Prod communicates with Shared Services VPC only, isolated from Dev." How to configure?

Integrated Decision Tree — Tool Selection Quick Reference by Scenario

Organizing frequent operational decisions as tree. Exam scenarios also follow this logic for faster answers:

"Must communicate externally"

Where does traffic go?
├── Any external URL (e.g., external SaaS API)
│   └── NAT Gateway (1 per AZ, route to own AZ)
├── S3 or DynamoDB
│   └── Gateway Endpoint (free)
├── Other AWS services (SSM, ECR, Logs, etc.)
│   └── Interface Endpoint (PrivateLink, paid, Private DNS enabled)
└── Other VPC/account company/third-party service
    └── PrivateLink Endpoint Service (NLB + Allowed Principals)

"Connectivity issue"

What to know?
├── Can reach? Where blocked? (1:1)
│   └── Reachability Analyzer (simulation, 30s)
├── Which instances exposed externally? (broad-scale)
│   └── Network Access Analyzer + Access Scope
├── Who talks to whom how much? (traffic analysis)
│   └── Flow Logs + Logs Insights/Athena
└── Need actual packet payload (security analysis)
    └── Traffic Mirroring → Suricata/Zeek

"Connect multiple VPCs"

How many VPCs? On-premises connection needed?
├── 2-3 VPCs, no on-premises
│   └── VPC Peering (note: non-transitive — A↔B, B↔C exists but A→C needs separate)
├── 5+ VPCs or on-premises integration
│   └── Transit Gateway (hub-and-spoke + RT separation for policy control)
└── B2B SaaS model (possible CIDR conflicts)
    └── PrivateLink

"Connect on-premises"

What are requirements?
├── Immediate, cheap, temporary/small-scale
│   └── Site-to-Site VPN (Internet + IPsec, ~1.25Gbps/tunnel)
├── Consistent bandwidth, low latency, large-scale traffic (SLA)
│   └── Direct Connect (1/10/100Gbps, installation weeks, expensive)
├── Avoid single DX circuit SPOF
│   └── High Resilience: 2 circuits different locations
└── Reduce DX cost while fallback on failure
    └── Hybrid: 1 DX + VPN backup

"Multi-Region DR"

RTO vs Cost trade-off?
├── RTO 0, cost 2x OK, global users
│   └── Active-Active + Latency-based Routing + bidirectional data replication
│       (DynamoDB Global Tables, S3 CRR, Aurora Global DB)
├── RTO minutes to tens of minutes, cost reduction
│   └── Active-Passive (Pilot Light/Warm Standby) + Failover Routing
│       + Health Check + short TTL (60s)
└── Sub-second failover regardless of DNS TTL
    └── Global Accelerator (BGP Anycast, 1-2s failover)

Next Week Preview — Week 9 Security Operations

Week 9 is security operations — KMS, Secrets Manager, GuardDuty, Security Hub. Core of security/compliance exam's 16% weight.

Day 1: KMS — Key Policy, Grant, Rotation, CloudHSM placement
Day 2: Secrets Manager auto-rotation, Cross-Region Replication, Parameter Store comparison
Day 3: IAM Access Analyzer and Trusted Advisor security checks
Day 4: GuardDuty (anomaly detection), Security Hub (integration), Inspector (vulnerabilities), Macie (data classification)
Day 5: Week 9 comprehensive + scenario problems

This week VPC was "network boundary"; next week is "data, credential, threat boundary." Combined, two weeks complete the big picture of operations security.

Official references