AWS Networking Flashcards
1
Q
What is the RFC for the private address space?
A
RFC 1918
2
Q
What is layer 1 of the OSI layer?
A
Physical, used for Ethernet, DSL, ISDN, WiFi.
3
Q
What is layer 2 of the OSI layer?
A
Data link layer, used for Ethernet frames. Switching layer with switches and hubs.
4
Q
What is layer 3 of the OSI layer?
A
Network layer, used for Ipv4, IPv6, ICMP, IPSec. Routing layer used with routers.
5
Q
What is layer 4 of the OSI layer?
A
Transport layer, TCP, UDP, Apple Talk., SPX.
6
Q
What is layer 5 of the OSI layer?
A
Sessions layer, establish and teardown
7
Q
What is layer 6 of the OSI model?
A
Presetation, translation, compression, excryption.
8
Q
What is layer 7 of the OSI model?
A
Application layer, HTTP, DNS, FTP
9
Q
Where in the OSI layer does TLS fit
A
TLS fits in the Presentation layer where the presentation layer is used for encryption and compression.
10
Q
How many hosts IP’s can I have with an AWS VPC /24?
A
251, you have 256 addresses in this space, 1 for the network, one for broadcast, 1 for the gateway, 1 DNS, 1 for reserve.
11
Q
What is the largest VPC I can have in AWS?
A
/16 (65536)
12
Q
Convert 192.168.0.15 to its bit form?
A
11000000.10101000.00000000.00001111
13
Q
What is the 172.16.0.0 private address space range?
A
is is a /12 address space ranging from 1172.16.0.0 - 172.31.255.255 and has 1M hosts
14
Q
What is the 10.0.0.0 private address space (range)?
A
Its is a /8 address apace ranging from 10.0.0.0 - 10.255.255.255 and has 16M hosts
15
Q
What is the 192.168.0.0 private address space(range)?
A
It is a /16 address space ranging from 192.168.0.0 - 192.168.255.255 and has 65K hosts.
16
Q
What is classless interdomain routing (CIDR)?
A
You can create a subnet mask to mask the network bits in use, this subdivides the network.
17
Q
If we have a CIDR of /8, how many host addresses can I have?
A
16M (16777214)
18
Q
What does a /8 CIDR look like in binary form?
A
11111111.00000000.00000000.0000000
19
Q
What does a /16 CIDR look like in binary?
A
11111111.11111111.00000000.000000000
20
Q
What does a /24 CIDR look like in binary?
A
11111111.11111111.11111111.00000000
21
Q
If we have a /24 network what is the max networks we can subnet from it?
A
7 subnets.
/24 = 1 network 254 hosts
/25 = 2 : 126 hosts
/26 = 4 : 62 hosts
/27 = 8 : 30 hosts
/28 = 16 : 14 hosts
/29= 32: 6 hosts
/30=64 : 2 hosts
22
Q
In a 10.x.x.x network how many bits are available for host or networking?
A
We can use 24bits for host and networking, we can say a 10 network is a /8 network.
23
Q
In a 172.x.x.x. network how many bits can be used for host or network?
A
22 bits can be sued for host or networking, we can say the 172 network is a /12 network.
24
Q
With a CIDR, when we add bits what are we doing?
A
We are increasing the number of bits in the CIDR blocks and subnetting the network.
25
In the following CIDR how may subnet bits is there 192.168.0.0/24? also how many subnets are there?
Zero (0) subnet bits and 1 subnet
This network is a 192.168.0.0/24 network, this means it has only 8bits to play with for both networking and hosts.
The number of subnets is 2 to the power of n where n, in this case, is 0, gives is 1.
26
27
What is the DHCP server port?
67
28
What is the DHCP client port?
68
29
Is UDP a TCP or UDP protocol?
UDP protocol as it sends a UDP broadcast on 255.255.255
30
Is UDP unicast or broadcast?
Broadcast
31
What is the typical DHCP exchange sequence to get an IP address from the server?
DHCPDiscover
DHCPOffer
DHCPRequest
DHCPAck
32
What ports are used for DNS?
Port 53
33
Are message sent over UDP, TCP or both for DNS?
Both
34
A URL is mead up of 4 parts can you name them?
protocal
subdomain
domain
TLD (Top level domain)
35
36
What is a Zone?
It is a domain for which the DNS server will answer for.
37
In DNS was is a Private zone?
A zone for which the server is authoritive, this means the DNS servers has the final say.
38
In DNS what is a secondary zone?
A secondary zone is the DNS server will respond but does not have the final say. The secondary zone must check in with the Primary Zone DNS server.
39
40
In DNS when would you use a secondary zone?
You would use a secondary zone when you want to have redundancy for the primary server so when the primary server goes down the secondary zone DNS server responds.
41
In DNS what is a root server used for?
Root server points to the TLD servers.
42
In DNS what is the TLD servers?
TLD's points to the Name servers.
43
In DNS what is the Name servers used for?
Name servers point to the host's when we say hosts,.
44
In DNS what are the 'A' records used for?
An 'A' record is part of a zone and points to the IP of a host.
45
In DNS what is a CNAME record used for?
A CNAME record is part of a zone and points to an 'A' record, with this record we could map bar.google.com to foo.google.com.
46
From your laptop, how is a URL resolved?
Laptop reaches out to it local DSN server, the local DNS server checks the cache and does not find a record it looks up the root hints file and reaches out to the root servers, the root server responds with IP of the TLD, DNS server reaches out to TLD and TLD responds with the IP of the name server, the DNS reaches out to name server and the name server responds with the IP of the host, the DNS server responds to your laptop with the IP of the host you need to contact.
47
In DNS wait is an 'AAAA'' record?
An 'AAA' record is the same as an 'A' record but for IPv6. It points to an host IP.
48
What is an MX record in DNS?
It is a mail exchange record.
49
In DNS what is a TXT record?
"Text records" are typically used for miscellaneous services that require information to be public in your DNS in order to prove ownership of a domain.
50
In DNS what is a PTR record?
A PTR record is a reverse lookup the record and maps an IP back to a server, only one PRT record per server.
51
In DNS what is an SOA record?
The SOA is a "Start of authority", indicating which record is responsible for the DNS zone.
52
In DSN, a records TTL valis is what?
It is the time the server waits before it will check for updates for the record.
53
Can i delete a default security group?
No, this will not be allowed.
54
With a security group can I deny IP addressed?
Security group by default deny all traffic inbound and you open ports. You can not explicitly say deny traffic from this address or port. But you can allow inbound traffic from an IP, Port or protocol.
55
By default, will a security group allow or deny all traffic inbound?
Denys all traffic
56
Can you create a security group rule that denies traffic?
No, rules are always permissive for both inbound and outbound.
57
Are security groups stateful?
Yes if you rend a request to an instance, the response will be allowed to exit regardless of outbound rules.
58
By default is all outbound (initiated by the server) allowed for a security group?
Yes, there is an outbound rule that allowed all outbound traffic.
59
Can I create a security group rule to block port 80?
No, security groups are by default deny all traffic will allow rules, no deny rules are available.
60
I want to block an incoming IP address, what is my best option in the VPC?
Use a NACL as you can not deny traffic on a security group.
61
I have an on-prem application using multicast, I want to move to AWS, what should I be aware of?
Multi-cast is not supported in a VPC, you will need to create an overlay network.
62
I need a public IP, what is the name AWS used for this public IP?
Elastic IP
63
What is a public subnet?
It is a subnet that has an internet gateway and connects with the internet and internet traffic can enter and leave it.
64
Can I have more than a single ACL on a VPC?
Yes
65
When you create a VPC do you get a default ACL?
Yes
66
Is the ACL filtering traffic on a VPC or on a subnet?
ACL filters traffic on a subnet and is assocated with a VPC.
67
When you create an ACL, by default is assocated with all subnets in the VPC?
No, by default is not associated with any subnets, you have to associate with subnet to have the filter applied.
68
When you areas a VPC, do you get an ACL by default?
Yes you bet a default ACL, but it is associated with no subnets
69
Are ACL stateless or stateful?
Stateless, they do not know about connections, so if you allow traffic in, you have to allow traffic out. In a way, ACL is better used to deny traffic in or out.
70
Can I associate an ACL with multiple subnets?
Yes
71
Can subnets be associated with multiple ACL?
No
72
By default do ACLs allow traffic in/out?
Yes
73
In what order is rooting table, ACL and security group applied in the flow of traffic?
Route table
ACL
Subnet
security group
Instance
74
I want to capture all source IP's coming into an interface on an EC2 instance, is this possible and how?
Yes, you use VPC flow logs?
75
I want to capture all source IP's coming into VPC, is this possible and how?
Yes, Use VPC Flow logs.
76
I want to capture all source IP's coming into a subnet, is this possible and how?
Yes, use VPC flow logs, each interface in the VPC will have its own flow logs.
77
For flow logs what are the 3 different scopes I can enable for?
VPC - All ENI's in the VPC
Subnet - All ENI's in the subnet
ENI for the instance.
78
What outputs are available for flow logs?
S3
Cloudwatch
79
I have an application on EC2 instances and I want to be notified if an IP address connects form another country, what options do I have?
You can use flow logs and connect with cloud watch and set a cloud watch alarm.
80
I need to enable my instances to access the internet but I do not want the instances to have a public facing the internet, what is my best option?
Use a nat gateway for IPV4 and Egress only GW for ip[v6
81
For a NAT GW do you need an EIP?
Yes, the EIP will be the public facing IP behind it will be the instances.
82
What are you charged for with a NAT GW?
Hours running and per GB processed.
83
I need a NAT GW to span multiple Availability Zones?
A single NAT will not work across Availability zones as it is tied to a single AZ when you select a subnet when you create the nAT, you will have to use two NAT GWs, one in each of the subnets you want to use.
84
I have just created a NAT and my instances can get internet access, what do you think is wrong?
You have not pointed the traffic to the nat from the instance, this will require editing of the ROUTE tables.
85
I need to secure my NAT GW with a Security group, how can I implement this?
You cna not as NAT does not use security groups, you can use ACL to block in or out trafic.,
86
I have a number of instances that I do not what to be public facing, but I will have large amounts of information that I need to access in the internet, about 180GB, how can I architect these instances and what services do I need to enable internet access?
A single NAT GW can handle 5GB of traffic and scale up to 45GB, to get 180GB I will have to create 4 subnets and split the instances between the subnets with each subnet having a single NAT capable of 45GB.
87
Can I have multiple EIPs on a NAT instance?
No, only a single EIP
88
What is the Max number of connections a NATGW can sustain?
55K
89
I have a Site to Site VPN, can I route traffic to my NAT GW over the VPN?
No, traffic over Site to Site VPN, DirectConetc, VPC Peering can not route to NAT GW.
90
I have an application that used DynamoDB and S3 storage, what is my best option for connecting application running on EC2 to this service?
making calls that exit from AWS will have charges, creating an endpoint will l allow you to keep traffic in AWS.
91
As we view networking in relation to AWS, what networks are at play?
- Your regional network (VPC)
- Your on-prem
- Internet
- AWS Public zone
92
IN a VPC how may primary CIDR ranges can I have and how many secondary ranges can I have?
You can have 1 primary and 4 secondary
93
What is the smallest and largest CIDER ranges for a VPC?
16 and 28
94
I have a network (VP{C) that is using a DNS server, this is configured with option sets, I need to add a new server and delete the old one, what must I do.
You can edit an option set, you must create a new one.
95
What are the reserved IPs in a subnet?
- 0 = Network
- 1 VPC Router
- 2= DNS
- 3 reserved
- 255 broadcast
96
I have a VPC in us-west-1 and a CPC in eu-west-1 and I want to connect together, how is this possible?
Use VPC peering as it can be within the same region or in separate regions.
97
What is network + 1 address used for?
It is the subnet router address.
98
What is the network +2 address?
DNS
99
When you create a subnet you get a route table with a default local route, can you modify this route?
No.
100
What is the order routes are processed in the routeing table?
The highest subnet /x wins out, like /22 is processed before /16
101
When I turn on route propagation, what happens to the routeing table?
Routes are learned from the VPGW are auto-populated into the routing table.
102
Can I add a second route table to a subnet?
No, Only one route table per subnet.
103
Can a VPC have more than a single RouteTable?
Yes as VPC can have multiple route tables but subnets can only have a single route table.
104
I have just created an ACL and want to associate it with an instance, is this possible??
No, you can only be created in a VPC and associated with a subnet
105
I have just created an NACL, what can I associate it with, a subnet, instance or VPC?
The NACL will be part of the VPC but you can associate it with one or more subnets, .
106
I am deploying a new application to AWS in a VPC, the application only used port 80 and the ephemeral ports for TCP, what should I do from a network security perspective?
You should reduce footprint, this means locking down all UDP ports as they are not used.
107
I want to explicitly deny all traffic on the inbound, should I use NACL or Subnets?
NACLS as you can explicitly deny traffic, security groups only allow you to allow traffic as they have an inplit deny.
108
How are rules for NACLS processed?
from the lowest number of the highest number.
109
I have a NACL 100# with a DENY rule and a NACL rule #200 with an allow, what will happen to the traffic will it be allowed or denied?
DENY as the DENY rule is the first rule with the lowest number.
110
I have a subnet with two instances and an NACL associated with the subnet the two instances are in, this NACL has DENY all traffic in and out, will it stop the instances talking with each other?
No, as the NACL is on the outside of the subnets and only stops traffic passing it boundary, an example would be traffic from another subnet or traffic from internet or VPN, DirectConnetc.
111
I have two subnets and each subnet has an NACL, I have an instance in both subnets, will one or both NACLs effect the traffic between both instances when talking to each other?
As traffic leaves a subnet it its the firt NACL and as it eenters the second subnet it hist the second NACL.
112
Can I reference a URL with a NACL?
No only Cider blocks
113
Can I reference a resource with a NACL?
No only a CIDR block
114
Where are NACLS applied in the network stack in AWS?
They are applied at the subnet boundry.
115
Where are security groups applied in the AWS network stack?
They are applied at the instance virtual nic interface.
116
If I have a network security group with no rules in it and it is associated with each network interface of each instance, can these instances talk with each other?
No, the traffic will be blocked.
117
Is a security group associated with all instance interfaces or just one?
If the security group is associated with the products then it is again all interfaces, but you can assign to a single interface.
118
Are NACLS stateful?
No
119
Are Security Groups stateful?
Yes.
120
I have a security group and I want to explicitly deny traffic, how can I do this?
You can not explicitly deny traffic with a security group, you can use an NACL to explicitly deny traffic.
121
Is all traffic DENY by default with NACLs
No, they are by default allowed.
122
Is traffic denied by default with a security group?
Yes
123
Is there ordered processing of rules in a security group?
No, they are all evaluated at the same time.
124
With security groups can I reference other resources like security groups?
Yes
125
If I want to allow traffic from an instance in a security group, what do I have to do?
Create an inbound rule that allows all traffic and reference itself.
126
Are NATGW, highly available?
No, if you lose an AZ, then the NATGW is gone.
127
I want to configure a NATGW to allow my bastion host to be connected from my remote home location, what configuration do I need to do?
A NATGW does not allow you to connect form our side.
128
I have my NATGW configured, I want to use filtering of incoming IP's, can I do this?
No, there is no functional available on the eNATGW.
129
I am concerned that the load on my NATGW will cause issues, should I be concerned?
Not up to 5BDS, the NATGW scales up to 5gb, NATGW scales automatically.
130
I have just created a NATGW, do I need to do anything else in my subnets to get instances to use traffic?
Yes, you need to modify the route table and add a default route to point to the NATGW.
131
I have an instance with IPV6 and I want to use NAYGW to enable it to connect to the internet, how can I configure this?
You cna not, NATGW only work with IPv4, IPV6 will require an EGRESS only GW.
132
I have my laptop on the internet and I ping the public DNS of an instance, what IP will I get back, public or private? also, how can I get the instances private IP?
Private. you can use the private DNS.
133
When I use VPC flow logs, am i getting the packet data or something else?
You are getting the metadata and not the packets data.
134
What is the data in the flow log metadata?
It is like src and dest port and address, account-id, interface-id, packets, start and end
135
What is not logged by the VPC flow logs?
DHCP
AWS DNS
Metadata
Licence Activation Requests
136
What are the three level/scopes I cna place the VPC flow logs?
In all cases below the loges are created on the instance ENI, thye cust defines the scope.
VPC
Subnet
Instance
I
137
I want to quickly and easily collect a large number of flow logs and analyze hem in an offline way, the data is stored in s3, what cna I do?
You can use AWS Atena to query the data in S3.
138
What do VPC endpoints do?
They enable access to AWS services from your VPC with traffic exiting to the internet, traffic moves directly from your VPC to the AWS service.
139
I have several instances in a subnet in a VPC, this subnet has not internet gateway (no internet access), I require access to S3, DynamoDB and SQS, do I need to create an internet gateway or is there other options?
I can use VPC endpoints, the endpoint enables traffic to be directed to the AWS service (S3, DynamoDB) with our needing to go to the internet, traffic stays within AWS network infrastructure.
140
For VPC endpoints what services are supported?
Amazon API Gateway
AWS CloudFormation
AWS CloudTrail
Amazon CloudWatch
Amazon CloudWatch Events
Amazon CloudWatch Logs
AWS CodeBuild
AWS CodeCommit
AWS CodePipeline
AWS Config
Amazon EC2 API
Elastic Load Balancing API
Amazon Elastic Container Registry
Amazon Elastic Container Service
AWS Key Management Service
Amazon Kinesis Data Streams
Amazon SageMaker and Amazon SageMaker Runtime
Amazon SageMaker Notebook Instance
AWS Secrets Manager
AWS Security Token Service
AWS Service Catalog
Amazon SNS
Amazon SQS
AWS Systems Manager
AWS Transfer for SFTP
Endpoint services hosted by other AWS accounts
Supported AWS Marketplace partner services
141
I have a private subnet with an instance in it and I what to get access to SNS, I do not have a NAT instance or a NATGW or any king, how can I get access to the SNS?
Yes Endpoint, set up an endpoint in the VPC and configure the routeing table to point at it for the SNS service.
142
I have an instance in a private subnet, I also have an endpoint set up for S3, I want to ensure that only traffic from this VPC can access the bucket, how can I do this.
Set up a bucket policy so that it restricts access based on the aws:sourceVpc
143
What is the difference between GW and Interface Endpoints?
Depending on the service users you will get a GW or INterface endpoint, for S3 you get a GW and for SQS you get an interface. The big difference is GW is highly available and at the VPC level.
144
I have an Interface Endpoint, how can I secure it?
Because it is an interface in a subnet you can use a security group to secure the endpoint.
145
I am creating an endpoint to use with SNS, this will be an interface endpoint. I need to ensure it is fault tolerant, what options do I have.
You can select to have endpoints created in each subnet in each AZ, you will get a DNS name for each endpoint.
146
What are the two services that use GW Endpoints?
S3 and Dynamo DB.
147
What is a VPC Peer?
A VPC peer enables you to connect VPC that are in the same region or in a remote region.
148
Do I need to establish two VPC peers for HA and fault tolerance?
N, you only need a single VPC peer, VPC's are fault tolerant.
149
I have two VPCs, one in each separate account, I want to VPC peer across accounts, can I do this?
Yes, you can VPC peer across VPC's in separate accounts.
150
I have two VPCs, I have just created a peering connection between both, but I can not ping t from one instance in VPC 01 to instance in VPC 02, what could be wrong.
It could be the security groups, but it is probaly that we did not add a route in the VPC subnets routing tables.
151
I am using VPC peering between two VPC in separate accounts, I want to reference, the security group in the other account so I can enable traffic, is this possible?
Yes, you use the security group as a reference instead of CIDR.
152
For |VPC peering, where the vPC's are in separate regions, can use used the security group id as a reference?
No t5his is not supported.
153
I have three VPC,s VPC 1 and VPV 2 peer, VPC 2 and VPC 3 also peer, can I ping from an instance in VPC 1 to VPC 3?
No, VPC peering is transitive.
154
I am using VPC peering when I ping an instance using its public IP, in another VPC over the peering, I am getting the public IP, this is normal expected behaviour, what can I do so the private IP is returned?
There are setting in the VPC peering that enables you to have the private ip returned.
155
For VPC peering is ipv6 supported?
Yes but not by default, also IPv6 is not supported across regions.
156
I have two VPCs using VPC peering, cna I use direct connect or VPN to transverse VPCs?
No, you can not, it is not supported.
157
I am using VPC peering, I have a requirement that all data is encrypted in transit, is peering data in transit encrypted?
Yes.
158
I wnat to set up a second VPN with my VPC, can I just add a second APG to my VPC and establish a connection to a second customer GW?
You cna only have one VPG on a VPC, so this would not work. You could use CloudHUB for this. But an important point is only one VPG.
159
Can I create a second VPG on my VPC?
No, only one VPG per VPC, you could use CloudHub.
160
By default do rote tables route to all subnets in the VPC, if do what is the entry in the root table?
Yes, the root table has an entry that roots traffic to any subnet in the VPC, you cna not remove this.
161
I wnat to block traffic going from one subnet to another, can I just remove the default toot to stop the traffic?
No, the default root cannot be removed. Each root table in the VPC gets a default root and this enables the traffic to be rooted to other subnets in the VPC.
162
What are the types of network zones I should be concerned with when thinking about networking in general?
- \> AWS private zone -\> VPC networking, private and public subnets
- \> AWS Public zone
- \> Internet -\> Public routed traffic
- \> On-Prem
163
How many CIDR ranges can I give a VPC?
You can assign one primary and 4 secondaries.
164
What is the largest and smallest CIDR ranges for a VPC?
/16 and /28
165
I need to have my VPC use a DNS server in the VPC, how can I configure this?
You need to create a new VPC Option Set and set the DNS server
166
How many VPC option sets can I add to a VPC?
1
167
I have to set up a new DNS server and edit the VPC OPtion set, how cna I do this?
You can not edit an option set, you have to create a new one.
168
What are the reserved addresses in a Subnet in a VPC?
5 Addresses
10. 0.0.0 Network address
10. 0.0.,1 GW
10. 0.0.2 DNS
10. 0.0.3 Reserved
10. 0.0.255 Broadcast
169
What is a VPC Peer?
It allows you to connect a VPC to another VPC in the same or even a different account?
170
With VPC peering can you transverse a VPC when peered?
No
171
What is the difference between a VPN GW and an Internet GW?
The internet GW is the exit point to the internet and the VPN GW is the exit point to the network associated with the VPN. Also the VPN GW is used to access the network associated with the DirectConect.
172
What is a VPC endpoint?
It enables you to connect directly to the AWS Public Zone services such as S3, DynamoDB and CWLOgs
173
What is an egress only GW?
It enables traffic to only flow to the internet, meaning you would not be able to connect from the internet to the any resources behind the egress GW.
174
What are the network elements I can use in AWS?
Transit GW
VPN GW - VPN
VPN GW - DirectConentc
Intenet GW
Peering
Subnets
egress only GW
NAT Instance
NAT GW
VPC Option Sets
ACL's
NSG's
175
When using the routeing table, what is the order of the routes?
the higher the / the higher the priority. For example, a /16 vs ./8 the /16 is first chose if it matches.
176
When I set up an IG, VPN GW or egress GW, NAT instance and I wnat traffic to flow to it, what do I need to set up?
A route in the routeing table associated with the subnet and VPC.
177
178
Do I need a route in the routing table for a peering connection?
Yes 100%.
179
Where are ACL applied in the VPC?
Around the outside of the subnet. ACLs are associated with a subnet. They block traffic entering and leaving the subnet.
180
Are ACL stateful or stateless?
Stateless meaning you have to allow traffic in and out.
181
Can I block traffic with an ACL?
yes you can block on incoming and outgoing, but you will only have the SRC, no DST.
182
How many ACL can you associate to a subnet?
One
183
If you block on an ACL, will you block traffic between subnets?
Yes are the ACL is applied on the outside of it associated subnet all traffic is blocked from/to other subnets.
184
How are ALS evaluated?
Lowest to highest number?
185
Can I explicitly deny traffic with an ACL?
Yes 100%, you can deny.
186
If I know bad traffic is coming from an extern IP, how cna I block it, just using basic VPC constructs?
You can block it incoming using an ACL with a deny rule, as this rule would be on a source?
187
As I can block incoming traffic form a source if I have the source URL as part of a blacklist can I apply an ACL deny rule?
No, as the ACL source is IP only and even resolved URL IP may change.
188
Can I associate an ACL with multiple subnets?
Yes, but a subnet can only have one ACL.
189
I have two VM's in a single subnet can I use an ACL to block all traffic, will the VM's be able to talk to each other?
Yes, as the ACL is applied on the outside boundary of a Subnet.
190
If I have two subnets (A and B and each has an instance VMA and VMB, and each subnet has an ACL when the two instances connect how may ACL be the traffic passing through?
Tow as it will pass through both ACL.
191
I am using ACL can I reference another ACL or security group as the SRC?
No, ACL SRC only accepts a CIDR like 10.0.0.0/32
192
I have a VPC and a subnet, I also have a peered VPC, my subnet has an ACL, how could I block all traffic coming from the peer?
Using the ACL you can deny traffic coming form the SRC CIDR like 10.0.20.0/24 if the peered VPS was using this CIDR.
193
Are security groups stateless?
No, they stateful meaning if you initiate a connection they will remember and allow outgoing traffic.
194
Where are security groups applied?
They are applied at the ENI.
195
I have two instances in the same subnet and I am blocking all traffic, will the instance be able to talk to each other?
No, as SG are applied at the ENI all traffic will be blocked even in the subnet.
196
Can I block traffic from an IP with security groups?
No there is no way to block an IP.
197
Are security groups applied to the instance?
No, they are applied to the ENI.
198
How do SG's work when filtering traffic?
An SG is normally blocking traffic and you add allow rules.
199
If I need to allow traffic to my instance from another security group, how cna I do this with a security group with no current rules?
You would create an allow rule and reference the other security group as the source. Security groups allow you to use another security group as an SRC reference.
200
I have two instances in the same subnet in the same security group, I can not ssh from one instance to another, how cna I fix this?
The security group is blocking the traffic between both instances, you will have to create an allow all traffic rule and set the SRC to reference itself as in the security groups own name.
201
What are public and private subnet?
A private subnet has no IG and a public subnet has an IG.
202
I have a VPC with 4 subnets, two subnets are public subnets to the internet and two subnets are private. I have instances in the private subnets, 1 instance in each. I wnat these instance to download updates, how cna I achieve this?
You will have to add a NAT GW, in this case as there are two separate private subnets you would be better to add two separate NAT instance in the two private subnets.
203
When I am using a NAT GW do I need an elastic IP allocated and assigned?
Yes.
204
Are NAT GW highly available, explain?
A NAT GW is tied to an AZ, it the AZ fails then your NAT is gone, you need to have a NAT perr AZ, this way if the AZ fails then other AZ have there own NAT.
205
Do NAT GW scale automatically?
Yes, they scale with load.
206
If I have a private and public subnet using IPv6 and I wnat the instance in the private subnet to access the internet to download files can I use the NAT GW?
No, the NAT GW is for IPv4 only, you have to use egress GW for IPv6, egress GW is not doing a Port Nat, it is just doing the same thing as an IG but will only allow outgoing traffic. All incoming traffic is blocked.
207
When using a VPC, at what address is the DNS server?
The DNS server is always located at the +2 address (10.0.0.2) and is only available internal to the VPC, it is connected with the R53 resolver.
208
What DNS names does an instance get?
They get a public DNS that is resolved to a public IP if resolved outside the VPC, if resolved inside the VPC you get a private IP. And also a private DNS that is resolved to the private (10.0.0.50) IP.
209
I need to enable R53 so it can be accessed over the corporate network, how can I do this?
You have to have a VPC and a subnet, the VPC has to be connected to the corporate network over VPN/Direct Connect. You use the R53 resolver to create an inbound endpoint. This endpoint is an ENI type interface created in tNexthe VPC subnet and can be accessed from the corporate network.
210
Is the R53 resolver inbound endpoint highly available or is is just in on AZ?
When you create an inbound endpoint in R53 you have to define two AZ and subnets, two endpoints are created.
211
What is an R53 Resolved inbound endpoint used for?
It is used to create a DNS endpoint that can resolve DNS queries for R53 that can be accessed from the external corporate network.
212
What is the R53 outbound endpoint used for?
This is used when we set up forwarding rules in R53 to forward DNS queries.
213
What is an R53 resolved rule used for?
The R53 rules are used as part of the R53 Resolver outbound endpoint to set up forwarding rules.
214
What is the R53 Resolver used for?
It is used to when inbound endpoints are placed in the VPC subnet to allow an external corporate network to resolve a DNS query. Alos outbound endpoints can be sued with forwarding rules to forward DNS queries to an external DNS server.
215
I need to identify traffic coming from a source of how can I do this?
You can use VPC flow logs to capture the incoming VPC traffic metadata and have it stored to S3.
216
I want to capture VPC traffic data (not metadata), how can I do this with VPC Flow logs?
You can not with flow logs, Flow logs only allow you to capture the traffic metadata as in SRC IP, DST IP, etc.
217
What traffic is not captured in FlowLogs?
DHCP
AWS DNS
Metadata
Licence Activation
218
What op[tion do mI have with VPC flow logs to reduce the scope of the traffic I am monitoring?
You can select to have traffic captured at, VPC, Subnet or ENI level.
219
What output is available for VPC Flow Logs?
You can capture VPC Flow Logs to CWLogs or S3.
220
I want to analyze VPC traffic form all my accounts to search for know hackers IP's, how can I do this?
You can set up all the VPC's so you log thereFlow log traffic to S3 and use S3 Atenato search for know hackers IP's
221
I what to get access to AWS public services but for security reasons, I do not what to have the traffic flow over the internet, what options do I have?
Some of the AWS services can be accessed vis endpoints, and endpoint can be either an Interface EP and is placed in you VPC subnet or it can be an EP GW is attached to the VPC router.
222
What are the two types of VPC endpoints?
Interface endpoints are placed in the VPPC subnet
EP GW is attached to the VPC router and effected by route tables.
223
What services are EP GW used for?
S3, DynamoDB.
224
When I use VPC interface endpoint what service am I connected with?
SQL, etc. Not s3 or dynamo DB as they use EP GW.
225
When I am using VPC interface endpoints for SQS, how can I ensure my app is always going to have access to an available endpoint even if an EP fails?
Use the highly available DNS name to refer to the SQL, this DNS name is updated with all the available EPs, if one goes offline then it is taken out of the list.
226
My application is using the sqs.us-eadt-1.amazonaws.com URL to access SQL, I have now deployed an interface endpoint into the VPC and I want to do not what to change the app but I do what this URL to resolve to my endpoint, how can I do it?
There is a feature in the VPC that when switched on will resolve the public SQS URL to the deployed endpoint.
227
Do gateway endpoints use route tables to route traffic to the service?
Yes, they use the prefix lists.
228
I have a VPC in APAC and EU and I need to connect both together, what are my option?
You can use VPC peering but you have to ensure there is no overlapping IP's.
229
When creating a VPC do you have to accept a peering connection?
Yes, this is when another account requests you have to accept.
230
After creating a peering connection what do I have to do to get traffic to flow?
Set up routes in the routing tables.
231
When using VPC peering, is traffic transitive?
No
232
If I have 3 VPC (VPC-A, VPC-B, VPC-C), how can I connect them all together?
You will need a mesh,
VPC-A -\> VPC-B
VPC-A -\> VPC-C
VPC-B -\> VPC-C
233
IVPC Peering: if I have two VPC's and two subnets and two instances, on in each subnet, if I use the public DNS of the instance t, what will it resolve to?
It will resolve to the public IP and this IP would require traffic to go out over the internet, you have the option to select so this public DNS of the instance will resolve to the privet IP of the instance.
234
I am using direct connect to connect from an instance on my corporate network to an instance in a VPC that is peered through another VPC, will this work and why?
No, a transitive peered connection does not work and also you can no route peered connection through direct connect.
235
When using VPC peering is the traffic over the backbone between two inter-region VPC's encrypted?
Yes, traffic is encrypted and secure.
236
What is an Endpoint GW?
EP GW is located in the VPC and connected to the VPC router, you have to add a rote to the routeing table. The connect to two services, DynamoDB and S3. They are highly available and redundant.
237
What is an EndPoint Interface?
These are like ENI and are placed inside the subnet, they are subject to security groups and ACL's, they are subject to failure from an AZ failure and you would need to have one in more than a single AZ. They have several DNS names, one that is tied to the AZ, and a group that is managed by AWS, where AWS will add or remove failed EP interfaces.
238
What is an AWS public zone?
It is a network region belong to AWS where AWS makes there internal services available, services in this zone are accessible over the internet, through Direct Connect and also using endpoint interface and endpoint gW.
239
When using VPC endpoint GW, what is a prefix-list?
It is a list of routes maintained by AWS for the services such as S3 in the region. it looks like pl-xxxxx the pl is the prefix list.
240
What are the logical components of a VPN?
Customer GE
Virtual Private GW
Site to site VPN conenctions
241
Do VPN support IPv6?
No only IPv4 is supported.
242
For AWS VPN, what is the important info for a customer GW?
The customer endpoint IP, this is a public-facing and accessible IP and is connected with a VPN router or software appliance. Alos Static or Dynamic IP.
243
What is the AWS VPN Virtual Private GW?
It is the AWS side of the connection and is a logical GW connected to the VPC much like the internet gateway but in this case, it connects to the VPN. You have to attach it to a VPC and you also have to set up routes in the route tables to have the traffic flow over it.
244
When using the AWS VPN, what si the Site-to-Site VPN connection?
It hokes the customer GW and the site-to-site GW.
245
When using AWS VPN's, how can I improve VPN high availability?
For the VPN connection, you can use two tunnels, this gives you two sperate tunnels. You can also add a second customer GW and two more tunnels to improve high availability.
246
For AWS VPN, when using a high availability setup, can I use static routing?
No, you have to be using dynamic routing.
247
When using AWS VPN, what is diffe-Helman used for?
It is the security function used to share key information between two parties in a VPN session.
248
When using AWS VPN, what is the encryption?
It is probably going to be AWS-256 but others are available.
249
When using AWS VPN, what is the hashing algorithm used for?
It is used to validate packets and ensure they were not tampered with.
250
How are routes evaluated in the routing table?
They are evaluated as largets first ./32.
251
Do static route in a routing table take preference over dynamic routes?
Yes.
252
In routing table is direct connect preferred over VPN?
Yes.
253
What is the physical requirement for direct connect?
Single-mode fibre.
Router with BGP and MDB
8021Q (VLAN)
254
What is a DX location?
This is a physical location where you place you router with it single-mode fibre to connect to AWS.
255
Why would you use AWS DirectConnect?
Lower latency as traffic does not go over the internet, SLA and reliable packet delivery.
256
What are the key components indirect connect?
DX Location is where the DirectConnect terminates and you do the cross-connect over single-mode fibre.
You have a switch capable of SMF, BGP and 8021Q (VLAN) BGP-MD5 auth.
you cross-connect you switch to AWS, to do this you need a LOCFA (letter of authorization).
257
What speeds have you available for DirectConnect?
1 or 10GB
258
When using DirectConnect are you billed for data out the same as data out to the internet?
No, you are billed at a lower cost.
259
I need to get a reliable, low latency connection to transfer a large amount of data, this needs to happen this week, is directly connect a good option and why is it a good option?
Direct connect is not an option, it takes several weeks to order and configure a direct connect.
260
I am a SAAS provider a and my clients are already on AWS, I wnat to share my service through my VPC, how cna I do this?
One could use VPC peering, but this is not correct as you have many customers an IP overlap is an issue. You will wnat to share your service through Privatelink so your customers will be able to create an endpoint in there VPC and access your service.
