ADVANCED VPC Networking Flashcards
allowing the monitoring of traffic flow to and from interfaces within a VPC
VPC Flow Logs
VPC only caputures metadata and not contents
True
When attached to a VPC, flow logs monitor
All ENI in VPC
When attached to a Subnet, flow logs monitor
All ENI in Subnet
Can Flow logs be attached to ENIs directly?
Yes
Are Flow Logs realtime?
NO
VPC Flow Log destinations are S3 or CloudWatch Logs
True
Can Athena be used to query VPC Flow logs in S3?
Yes
Do flow logs monitor packet Contents?
No
Allow outbound (and response) only access to the public AWS services and Public Internet for IPv6-enabled instances or other VPC-based services
Egress-Only internet gateways
Allows private IPs to access public networks without allowing externally initiated connections in
NAT
Internet Gateway IPv6 allows all IPS in and out
True
type of VPC endpoint which allow access to S3 and DynamoDB without using public addressing
Gateway Endpoints
added to route table and points the route table to it
Gateway Endpoints
Gateway endpoints are Highly available across all AZs in a region
True
Controls which things can be connected to by the gateway endpoint
Endpoint Policies
Can Gateway Endpoints access cross-region services?
No
used to allow private IP addressing to access public AWS services apart from S3 and DynamoDb
Interface Endpoints
Are Interface Endpoints highly available by default?
No
1 Endpoint to 1 Subnet Per used AZ to get High Availability
True
Interface Endpoints only support TCP and IPv4
True
Do interface Endpoints use PrivateLink?
Yes
Interface Endpoints provides a NEW service endpoint DNS
True
One single DNS name that works with whatever AZ you’re using to access the interface endpoint
Endpoint Regional DNS
Resolves to one specific interface in one specific availability zone
Endpoint Zonal DNS
OVerrides the default DNS for services
PrivateDNS
Associates a private R53 hosted zone to the VPC changing the default service DNS to resolve to the interface endpoint ip
Private DNS
Uses prefix lists and route tables
Gateway Endpoints
Uses DNS and a private IP address
Interface Endpoints
networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses
VPC peering
One peering connection links two and only two VPCs
True
Does VPC peering work across region/cross account
Yes
Does VPC Perring support transitive peering?
No
are route tables at both sides of the peering connection needed?
Yes
Can VPC peering connections be created where there is overlap in the VPC CIDRS?
No
