5.2 - DNS, content delivery and network troubleshooting
AWS SysOps Administrator objective 5.2 covers DNS, content delivery and network troubleshooting. In Amazon Route 53 you pick a routing policy - simple, weighted, latency-based, failover, geolocation, geoproximity or multivalue - use an alias record to point the zone apex at a CloudFront or S3 target, and drive DNS failover with health checks. Amazon CloudFront caches content at edge locations, locks the S3 origin with Origin Access Control, serves private content with signed URLs or cookies, and adds HTTPS with an ACM certificate in us-east-1; AWS Global Accelerator gives static anycast IPs for non-HTTP traffic. To troubleshoot connectivity you read VPC Flow Logs to see ACCEPT or REJECT and whether a security group or NACL blocked traffic, and use Reachability Analyzer. Expect scenario questions about a routing choice, caching, or a blocked connection, and ask which networking feature or diagnostic applies.
Point the zone apex at CloudFront/S3 = Route 53 alias record. Lock the CloudFront S3 origin = Origin Access Control. See what blocked traffic (ACCEPT/REJECT) = VPC Flow Logs.
Practice questions
1. You want to monitor the cache hit ratio and error rate of a CloudFront distribution in CloudWatch. In which region are CloudFront's default metrics published?
- US East (N. Virginia), us-east-1 (correct answer)
- The edge location region that is nearest to each individual viewer request
- Every AWS region where at least one cache hit has occurred
- The region of the origin S3 bucket or the origin load balancer
CloudFront is a global service and publishes its CloudWatch metrics in us-east-1, so you view them and build alarms there. Metrics are not scattered across edge or origin regions.
2. You want CloudWatch to alarm when a Route 53 health check reports an endpoint as unhealthy. In which region are Route 53 health check metrics available?
- US East (N. Virginia), us-east-1 (correct answer)
- The region that hosts the monitored endpoint's primary resources
- A random region that is chosen at health check creation time
- All regions simultaneously through global metric replication
Route 53 is a global service and its health check metrics (HealthCheckStatus, etc.) are published only in us-east-1, where you create the alarm. They are not replicated to every region.
3. You attach a target group to an Auto Scaling group. How do newly launched instances get traffic from the load balancer?
- You must register each instance manually
- They receive traffic only after an instance refresh
- Auto Scaling registers them automatically (correct answer)
- A Route 53 record must be edited each time
When a target group is attached, Auto Scaling registers each new instance and deregisters terminated ones automatically. Manual registration, refresh, or Route 53 edits are not needed for this integration.
4. CloudFront access logs are needed for near real-time alerting on error rates. Which pipeline fits best?
- Standard CloudFront logs to S3, then a nightly batch job scans them
- CloudFront real-time logs to Kinesis Data Streams, then a consumer alerts (correct answer)
- Enable the CloudWatch agent on the CloudFront edge locations directly
- Route the CloudFront logs through Route 53 query logging for immediacy
CloudFront real-time logs stream to Kinesis Data Streams where a consumer (Lambda/analytics) can alert within seconds. Standard S3 logs are delayed and batchy, you cannot run agents on edge locations, and Route 53 query logging is unrelated.
5. A canary must test an internal API that has no public IP, reachable only inside a VPC. What must you configure?
- Assign the internal API a public Elastic IP address and open it up
- Run the canary in the VPC with subnets and a security group (correct answer)
- Open the API to the internet via an internet gateway
- Disable the canary and rely on server-side logs instead
A canary can be configured to run inside the VPC by attaching subnets and a security group, so it reaches private endpoints without exposing them. Giving the API a public IP or an internet gateway defeats the private design, and disabling the canary abandons proactive testing.
6. A VPC-attached canary in private subnets must also reach an external HTTPS URL. What enables that egress?
- A NAT gateway with a route from the private subnets (correct answer)
- A public IP directly assigned to the canary function
- A VPC peering connection to the external website
- An S3 gateway endpoint added to the route table
A canary in private subnets reaches the internet through a NAT gateway with the subnets' route table pointing 0.0.0.0/0 to it. Lambda-based canaries do not take public IPs directly, VPC peering connects VPCs not arbitrary websites, and an S3 gateway endpoint only reaches S3.