Here are 10 AWS Certified SysOps Administrator Associate SOA-C02 practice exam questions to help you gauge your readiness for the actual exam.

Question 1

A financial start-up has recently adopted a hybrid cloud infrastructure with AWS Cloud. They are planning to migrate their online payments system that supports an IPv6 address and uses an Oracle database in a RAC configuration. As the AWS Consultant, you have to make sure that the application can initiate outgoing traffic to the Internet but blocks any incoming connection from the Internet.

Which of the following options would you do to properly migrate the application to AWS?

1. Migrate the Oracle database to an EC2 instance. Launch an EC2 instance to host the application and then set up a NAT Instance.
2. Migrate the Oracle database to RDS. Launch an EC2 instance to host the application and then set up a NAT gateway instead of a NAT instance for better availability and higher bandwidth.
3. Migrate the Oracle database to RDS. Launch the application on a separate EC2 instance and then set up a NAT Instance.
4. Migrate the Oracle database to an EC2 instance. Launch the application on a separate EC2 instance and then set up an egress-only Internet gateway.

Question 2

Option 1

1. Associate a NAT Gateway with your VPC and Subnets
2. Update the Route Tables and Security Group Rules
3. Enable Enhanced Networking in your EC2 instance
4. Assign IPv6 Addresses to the EC2 Instance

Option 2

1. Attach an Egress-Only Internet Gateway to the VPC and Subnets
2. Update the Route Tables
3. Update the Security Group Rules
4. Assign IPv6 Addresses to the EC2 instance
5. Configure the instance to use DHCPv6

Option 3

1. Associate an IPv6 CIDR Block with the VPC and Subnets
2. Update the Route Tables
3. Update the Security Group Rules
4. Assign IPv6 Addresses to the EC2 Instance

Option 4

1. Enable Enhanced Networking in your EC2 instance
2. Update the Route Tables
3. Update the Security Group Rules
4. Assign IPv6 Addresses to the EC2 Instance

Question 3

1. Launch a resource record based on the Geoproximity routing policy
2. Launch a resource record based on the Latency routing policy
3. Launch 2 resource records based on the Failover Routing policy
4. Launch 2 resource records based on the Weighted Routing policy

Question 4

1. Go to Billing Preferences in the management account and disable RI discount sharing. Then, purchase the RIs using individual member accounts.
2. Go to Billing Preferences in the management account and disable RI discount sharing. Then, purchase the RIs using the management account.
3. Disable RI discount sharing in each of the member accounts. Then, purchase the RIs using the management account.
4. Disable RI discount sharing in each of the member accounts. Then, purchase RIs in the member accounts only.

Question 5

1. Set the cache behavior of the CloudFront distribution to forward the User-Agent header.
2. Update the CloudFront distribution origin settings. Add a User-Agent header to the list of origin custom headers.
3. Activate the Enable IPv6 setting on the Application Load Balancer (ALB). Update origin settings of the CloudFront distribution to use the dualstack endpoint.
4. Activate the dualstack setting on the Application Load Balancer (ALB).

Question 6

1. Set up a VPN Connection
2. Set up a Direct Connect connection
3. Set up a VPC peering
4. Set up an AWS VPN CloudHub

Question 7

1. In the Security Group, add a new rule to allow outbound traffic on port 80 and port 443.
2. Allow ephemeral ports in the Security Group by adding a new rule to allow outbound traffic on ports 1024 – 65535.
3. Allow ephemeral ports in the Network ACL by adding a new rule to allow outbound traffic on ports 1024 – 65535.
4. In the Network ACL, add a new rule to allow inbound traffic on ports 1024 – 65535.

Show me the answer!

Correct Answer: 3

To enable the connection to a service running on an instance, the associated network ACL must allow both inbound traffic on the port that the service is listening on as well as allow outbound traffic from ephemeral ports. When a client connects to a server, a random port from the ephemeral port range (1024-65535) becomes the client’s source port.

The designated ephemeral port then becomes the destination port for return traffic from the service, so outbound traffic from the ephemeral port must be allowed in the network ACL. By default, network ACLs allow all inbound and outbound traffic. If your network ACL is more restrictive, then you need to explicitly allow traffic from the ephemeral port range.

You might want to use a different range for your network ACLs depending on the type of client that you’re using or with which you’re communicating. The client that initiates the request chooses the ephemeral port range. The range varies depending on the client’s operating system.

– Many Linux kernels (including the Amazon Linux kernel) use ports 32768-61000.

– Requests originating from Elastic Load Balancing use ports 1024-65535.

– Windows operating systems through Windows Server 2003 use ports 1025-5000.

– Windows Server 2008 and later versions use ports 49152-65535.

– A NAT gateway uses ports 1024-65535.

– AWS Lambda functions use ports 1024-65535.

For example, if a request comes into a web server in your VPC from a Windows XP client on the Internet, your network ACL must have an outbound rule to enable traffic destined for ports 1025-5000.

If an instance in your VPC is the client initiating a request, your network ACL must have an inbound rule to enable traffic destined for the ephemeral ports specific to the type of instance (Amazon Linux, Windows Server 2008, and so on).

In practice, to cover the different types of clients that might initiate traffic to public-facing instances in your VPC, you can open ephemeral ports 1024-65535. However, you can also add rules to the ACL to deny traffic on any malicious ports within that range. Ensure that you place the deny rules earlier in the table than the allow rules that open the wide range of ephemeral ports.

Since NACLs are stateless, you will also need to explicitly add outbound allow rules for ports 80 and 443.

Hence, the correct answer is: Allow ephemeral ports in the Network ACL by adding a new rule to allow outbound traffic on ports 1024 – 65535.

The option that says: In the Security Group, add a new rule to allow outbound traffic on port 80 and port 443 is incorrect because security groups are stateful, which means that if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules. Conversely, responses to allowed inbound traffic are allowed to flow out, regardless of outbound rules.

The option that says: In the Network ACL, add a new rule to allow inbound traffic on ports 1024 – 65535 is incorrect because these ports should be added on the outbound rule and not on the NACL inbound rule. Ephemeral ports can be added to both the inbound and outbound rules of your NACL, however, in this scenario, the clients are accessing the web portal from the public Internet. If the clients or the requests originate from the same VPC, then this is the only time that you have to add the ephemeral ports on the inbound rules.

The option that says: Allow ephemeral ports in the Security Group by adding a new rule to allow outbound traffic on ports 1024 – 65535 is incorrect as you don’t have to manually allow the ephemeral ports to your security groups. This should be done in your Network ACL.

References: 
https://aws.amazon.com/premiumsupport/knowledge-center/resolve-connection-sg-acl-inbound/
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html#nacl-ephemeral-ports
https://aws.amazon.com/premiumsupport/knowledge-center/connect-http-https-ec2/

Security Group vs. NACL:
https://tutorialsdojo.com/security-group-vs-nacl/

Question 8

1. In the Cache Behavior settings of your distribution, configure to forward only the query string parameters for which your origin will return unique objects.
2. Set the Viewer Protocol Policy of your web distribution to only use HTTPS to serve media content.
3. Use Signed URLs to your CloudFront web distribution.
4. Always add the Accept-Encoding header to compress all the content for each and every request.
5. Configure your origin to add a Cache-Control max-age directive to your objects, and specify the longest practical value for max-age to increase your TTL.

Question 9

1. AWS Trusted Advisor
2. AWS Budgets
3. Amazon CloudWatch Billing Alarm
4. AWS Cost Explorer

Question 10

1. Enable versioning on the S3 bucket.
2. Set up a lifecycle policy that moves the employee files older than 60 days to Infrequent Access storage class.
3. Create a lifecycle policy to move files older than 60 days to Glacier Deep Archive storage class.
4. Set up an S3 bucket policy to limit user access to only newer files that are created in less than 60 days.

For more practice questions like these and to further prepare you for the actual AWS Certified SysOps Administrator Associate SOA-C02 exam, we recommend that you take our top-notch AWS Certified SysOps Administrator Associate Practice Exams, which have been regarded as the best in the market. 

Also check out our AWS Certified SysOps Administrator Associate SOA-C02 Exam Study Guide here.