Amazon SOA-C02: Networking and Content Delivery — Study Guide

By Laurynas Brazys · 2 August 2026 · #amazon #soa-c02 #certification #exam-prep #study-guide

Part of the AWS SysOps Administrator Associate SOA-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.

Networking and Content Delivery covers the VPC foundation, hybrid connections, DNS and global routing, edge caching with CloudFront, and TLS certificate lifecycle — all critical for availability, security, and performance. Operational mastery ensures workloads are reachable, resilient to failures, and secure both on-prem and in-cloud. This section focuses on practical configuration patterns, CLI/console examples, and decision criteria you’ll use as a SysOps administrator supporting production systems.

VPC design, subnets, routing, and connectivity

Design VPC CIDR space with future growth in mind: allocate a sufficiently large VPC (for example /16 or /20 depending on scale) and split into AZ-local subnets (10.0.0.0/24, 10.0.1.0/24 per AZ) to avoid cross-AZ dependencies. Create explicit route tables per subnet type: public subnets use a route to the Internet Gateway (IGW) — e.g., aws ec2 create-route –route-table-id rtb-01234567 –destination-cidr-block 0.0.0.0/0 –gateway-id igw-abcdef12; private subnets route 0.0.0.0/0 to a NAT Gateway in the same AZ for predictable egress costs and lower latency.

Understand NAT behavior and routing nuances: NAT Gateway/Instance performs source NAT for outbound IPv4 connections and requires the return traffic to follow the subnet’s route table back through the NAT. For IPv6 use an egress-only internet gateway. Use AWS CLI to create NAT Gateway and associate Elastic IP: aws ec2 create-nat-gateway –subnet-id subnet-aaa –allocation-id eipalloc-123. Use route propagation with Transit Gateway or VPN attachments to manage dynamic routes automatically.

Security groups vs NACLs and traffic flow must be deliberate: security groups are stateful (you allow inbound, return is automatic) and are attached to ENIs; NACLs are stateless and evaluated by subnet with ordered rules, so you must allow both inbound and outbound ephemeral ports. Example commands: aws ec2 authorize-security-group-ingress –group-id sg-123 –protocol tcp –port 443 –cidr 0.0.0.0/0; aws ec2 create-network-acl-entry –network-acl-id acl-123 –rule-number 100 –protocol 6 –port-range From=1024,To=65535 –egress –cidr-block 0.0.0.0/0 –rule-action allow. Decision criteria: use security groups for instance-level access control and NACLs for perimeter, high-performance filtering and cross-account isolation.

VPN, Direct Connect, and hybrid networking

Select connectivity based on bandwidth, latency, and resilience needs. Site-to-Site VPN provides encrypted IPsec tunnels over the internet and is quick to deploy using aws ec2 create-vpn-connection –type ipsec. Configure two VPN tunnels for HA; use BGP for dynamic routing and route propagation via Virtual Private Gateway or Transit Gateway. Use AWS Managed VPN for rapid rollout and as a failover for Direct Connect.

Direct Connect gives private, high-bandwidth, low-latency connectivity. Provision a connection (or LAG) with the Direct Connect console and create private virtual interfaces (VIFs) to VPCs via a Direct Connect Gateway for multi-region access. Use BGP with appropriate ASN, and prefer DX + VPN hybrid: advertise critical prefixes over DX with VPN as automatic backup. Decision criteria:

Use VPN for short-term, low-to-medium bandwidth, or encrypted internet-based backup.
Use Direct Connect when sustained high throughput and predictable latency justify port and cross-connect costs.
Use Transit Gateway to centralize many VPC and on-prem connections if you need hub-and-spoke scale and simplified route management.

Operational checklist: confirm BGP sessions up, ensure route table propagation (for TGW use aws ec2 enable-transit-gateway-route-table-propagation), and test failover by bringing down one tunnel or shifting BGP paths.

Route 53 DNS, health checks, and routing policies

Route 53 is both authoritative DNS and a routing control plane. Implement health checks for endpoints (HTTP/HTTPS/TCP) and pair them with failover or weighted records. Example: create a failover record with primary/secondary record types on Route 53 console or use aws route53 change-resource-record-sets with a Failover routing policy and a HealthCheckId. Use TTL tuning based on expected failover SLA — low TTL (30-60s) for active failover, longer (300s+) for stable endpoints.

Choose routing policy by intent:

Simple: single-value returns; use for non-critical or single endpoints.
Failover: primary/secondary with health checks for disaster handling.
Weighted: gradual traffic shift for blue/green or canary deployments.
Latency-based: route users to the region with lowest latency.
Geolocation/geoproximity: comply with data residency or targeted content.

Decision-making bullets:

For global app with active-active regions and ELB: use Alias records pointing to ALB/ELB to avoid extra charges and leverage endpoint health.
For planned migrations or traffic shaping: use Weighted records and change weights incrementally via CLI (aws route53 change-resource-record-sets).
For quick recovery from data-center failures: use Failover routing with low TTLs and robust health checks.

CloudFront CDN, caching strategies, and invalidation

CloudFront accelerates content by caching at edge locations and reducing origin load. Configure Cache Behaviors per path pattern; control caching using Cache-Control and Expires headers from the origin or override via Forwarded Values and Minimum/Maximum TTL in the distribution settings. Use Origin Shield to reduce origin load from multiple edge locations.

Key cache strategies:

Static assets: long TTLs, use fingerprinting (object versioning) so invalidation is unnecessary.
Dynamic content: set Cache-Control: no-cache or minimal TTL and use Lambda@Edge or Cache Policy to selectively cache based on headers/cookies.
APIs: consider regional cache (API Gateway + CloudFront) with short TTLs.

Invalidation and management patterns:

Use aws cloudfront create-invalidation –distribution-id E123 –paths “/index.html” or “/*” for immediate removal; note invalidation costs for large patterns.
Prefer object versioning (change filename or query string versioning) to avoid frequent invalidations.
Ensure origin configuration: S3 origin should be locked down with Origin Access Control (OAC) or OAI so only CloudFront can read; for ALB origin ensure health checks and stickiness settings align with CloudFront behavior.

TLS certificates, ACM, and certificate lifecycle

Use AWS Certificate Manager (ACM) to provision certificates for ELB, CloudFront, and API Gateway. Request public certificates with aws acm request-certificate –domain-name example.com –validation-method DNS for DNS validation, which allows automated renewal. Important: CloudFront requires ACM certificates in the us-east-1 region; regional services (ALB, API Gateway regional) require certificates in the target region.

Validation and rotation patterns:

DNS validation automates renewal and is the preferred method for production; create CNAME records in Route 53 via console or aws route53 change-resource-record-sets.
For manual or imported certificates, use aws acm import-certificate and track expiration using aws acm list-certificates –certificate-statuses ISSUED.
Rotate certificates by deploying the new certificate alongside the old (add to ALB or CloudFront distribution), verify traffic, then remove the old cert before expiration.

Decision criteria: use ACM for public certs attached to AWS-managed endpoints. Use imported certificates only when private CA or external trust anchors are required.

Common Pitfalls and Decision Criteria

Incorrect security group or route table rules causing unreachable instances — verify security group inbound and outbound rules and route table 0.0.0.0/0 entries; remember security groups are stateful, NACLs are stateless and require explicit ephemeral port allowances.
Misconfigured DNS TTLs causing stale routing after failover — set TTLs based on failover windows (short TTLs for active failover), and test failover with health checks enabled.
Overlooking CloudFront origin configuration and OAC/OAI — lock S3 origins so buckets aren’t public and ensure CloudFront’s origin identity can read objects.
Relying on Direct Connect without VPN backup — always architect DX + VPN hybrid for resilience and validate BGP failover behavior.
Placing NAT Gateways in one AZ only — create NAT gateways per AZ to avoid cross-AZ data paths and single-AZ egress failure.
Forgetting ACM region rules for CloudFront — request public certificates in us-east-1 for CloudFront; federated or regional services require regional certificates.

Practical Problem: Use-Case Scenario

AcmePayments operates a global payments app with regional ALBs, an S3-backed static site, and an on-prem datacenter requiring high-throughput settlement links. They need predictable latency, secure distribution for static content, and fast failover if a region degrades.

Design VPCs with AZ-local public and private subnets; deploy NAT Gateways per AZ and configure route tables so private subnets egress through the local NAT.
Provision Direct Connect with a private VIF to the nearest Region and configure a redundant Site-to-Site VPN as automatic failover using BGP with appropriate route propagation to a Transit Gateway.
Use Route 53 latency-based routing for ALBs with health checks and low TTLs for critical endpoints; implement weighted records for staged failover testing.
Deploy CloudFront for the static site with an S3 origin secured by Origin Access Control and set long TTLs plus object versioning to avoid invalidation; use Lambda@Edge for required header manipulation.
Request ACM certificates via DNS validation (in us-east-1 for CloudFront) and deploy new certs alongside existing ones for blue/green rotation, then remove the old before expiration.

Rationale: these steps isolate failure domains, provide low-latency global routing, secure and cache static assets at the edge, and ensure certificate lifecycle is automated and non-disruptive — aligning with operational availability and security best practices.

← Security · All domains · Storage and Data Management →

Practice these questions → · Timed practice on ExamRoll.io →