AWS Networking Flashcards
What is the role of subnets in a VPC?
Subnets in a VPC are used to group resources based on security or operational needs. They allow you to organize your resources and establish boundaries within the VPC. Subnets can be public or private, with public subnets containing resources accessible by the public and private subnets containing resources accessible only through your private network.
What is the purpose of a network access control list (ACL) in a VPC?
A network access control list (ACL) is a virtual firewall that controls inbound and outbound traffic at the subnet level. It checks packet permissions for subnets, determining who sent the packet and how it is trying to communicate with the resources in a subnet. Network ACLs perform stateless packet filtering and can be used to customize the traffic allowed or denied at the subnet level.
What is the function of a security group in a VPC?
A security group is a virtual firewall that controls inbound and outbound traffic for an Amazon EC2 instance. It provides security at the instance level and can be used to configure custom rules for traffic. Security groups perform stateful packet filtering, meaning they remember previous decisions made for incoming packets. By default, security groups deny all inbound traffic and allow all outbound traffic, but you can add custom rules to control the traffic.
What is the difference between network ACLs and security groups in a VPC?
Network ACLs operate at the subnet level and control inbound and outbound traffic. They perform stateless packet filtering, meaning they evaluate each packet crossing the subnet border independently. Network ACLs remember nothing about previous packets. On the other hand, security groups operate at the instance level and control inbound and outbound traffic for individual instances. They perform stateful packet filtering, remembering previous decisions made for incoming packets. Security groups are associated with instances, while network ACLs are associated with subnets.
What is the default behavior of a network ACL in a VPC?
By default, the default network ACL in an AWS account allows all inbound and outbound traffic. However, you can modify it by adding your own rules. All network ACLs, including the default one, have an explicit deny rule at the end of the rule list. If a packet doesn’t match any of the other rules, it is denied.
What is the default behavior of a security group in a VPC?
By default, a security group denies all inbound traffic and allows all outbound traffic. You can customize the rules to specify which traffic to allow or deny. When a packet response returns to an instance, the security group remembers the previous request and allows the response to proceed, regardless of inbound security group rules.
What is Network Address Translation (NAT) Gateway in Amazon VPC?
NAT Gateway allows instances within a private subnet to initiate outbound internet traffic while keeping them protected from inbound traffic. It provides internet connectivity for instances without exposing them directly to the internet.
What is a Virtual Private Gateway in Amazon VPC?
A Virtual Private Gateway is a VPN connection termination point on the AWS side of a VPN connection. It allows you to establish a secure, encrypted connection between your VPC and your on-premises network or another VPC.
What is VPC Peering in Amazon VPC?
VPC Peering allows you to connect two VPCs together, enabling communication between them using private IP addresses as if they were part of the same network. It can be used to share resources or communicate between different environments.
What is Direct Connect in Amazon VPC?
AWS Direct Connect is a service that enables you to establish a dedicated private connection between your data center and a VPC. It provides a direct, private link between your network and AWS without having to use the public internet. It helps reduce network costs and increase bandwidth for your network traffic.
How does AWS Direct Connect work?
AWS Direct Connect works by establishing a dedicated private connection, similar to a private hallway, between your data center and a VPC. Only the residents (in this case, your organization) have access to this private connection, allowing them to directly access resources in the VPC without using the public road (shared internet).
What are the benefits of AWS Direct Connect?
The benefits of AWS Direct Connect include reduced network costs and increased bandwidth for your network traffic. It provides a more reliable and consistent connection compared to using the public internet. It also enhances security by keeping the network traffic within a dedicated private connection.
Which statement best describes an AWS account’s default network access control list?
It is stateless and denies all inbound and outbound traffic.
It is stateful and allows all inbound and outbound traffic.
It is stateless and allows all inbound and outbound traffic.
It is stateful and denies all inbound and outbound traffic.
The correct response option isIt is stateless and allows all inbound and outbound traffic.
Network access control lists (ACLs) performstatelesspacket filtering. They remember nothing and check packets that cross the subnet border each way: inbound and outbound.
Each AWS account includes a default network ACL. When configuring your VPC, you can use your account’s default network ACL or create custom network ACLs.
By default, your account’s default network ACL allows all inbound and outbound traffic, but you can modify it by adding your own rules. For custom network ACLs, all inbound and outbound traffic is denied until you add rules to specify which traffic should be allowed. Additionally, all network ACLs have an explicit deny rule. This rule ensures that if a packet doesn’t match any of the other rules on the list, the packet is denied.
What is DNS resolution?
DNS resolution is the process of translating a domain name to an IP address.
How does DNS resolution work?
When a user enters a domain name into their browser, a DNS server communicates with a web server to obtain the corresponding IP address for that domain name.
What is DNS in the context of the internet?
DNS (Domain Name System) is like the phone book of the internet. It translates domain names to IP addresses.
What is Amazon Route 53?
Amazon Route 53 is a DNS web service provided by AWS. It allows developers and businesses to route end users to internet applications hosted in AWS.
What infrastructure can Amazon Route 53 route user requests to?
Amazon Route 53 can route user requests to infrastructure running in AWS, such as Amazon EC2 instances and load balancers. It can also route requests to infrastructure outside of AWS.
