AWS Networking Flashcards Flashcards by David Blocher

You have a central VPC for AD authentications and many other VPCs across multiple regions. How can you use Transit Gateways to route traffic to the shared VPC but NOT allow traffic to other VPCs. (2)

Use (1) transit gateway to associate all vpcs. Route traffic to the shared VPC and use (2) “blackhole routes” to disallow traffic to the other VPCs.

How well did you know this?

Not at all

Perfectly

You need higher DX throughput. How can you achieve this?

Provision a new DX connection and transfer traffic to the new connection.

How well did you know this?

Not at all

Perfectly

What limitation is there for adding secondary CIDR blocks to your VPC?

Must not overlap and must NOT be publicly routable (non-RFC 1918) if your primary CIDR block is publicly routable.

How well did you know this?

Not at all

Perfectly

Which CIDR ranges are RFC 1918?

10.0.0.0–10.255.255.255 (10/8 prefix)
172.16.0.0–172.31.255.255 (172.16/12 prefix)
192.168.0.0–192.168.255.255 (192.168/16 prefix)

How well did you know this?

Not at all

Perfectly

Network Load Balancer feeding EKS cluster distributed across AZs. One AZ’s instances are not receiving traffic. What is the likely reason?

The AZ is not registered with the network load balancer.

How well did you know this?

Not at all

Perfectly

Network Load Balancer feeding EKS cluster distributed across peered VPCs. The clusters in one VPC are not receiving traffic. What is the likely reason?

The instance is in a peered VPC and must be registered via IP address, not instance ID.

How well did you know this?

Not at all

Perfectly

Load Balancer handling traffic between application and RDS MySQL database. How do you ensure encryption end-to-end? (3)

(1) terminate SSL/TLS at the load balancer
(2) configure load balancer to use TLS
(3) set the RDS to accept only SSL connections by using the GRANT command with the REQUIRE SSL option

How well did you know this?

Not at all

Perfectly

Instance Metadata URL

http://169.254.169.254/latest/

How well did you know this?

Not at all

Perfectly

Most operationally efficient method to allow many globally distributed department teams to connect logically isolated VPCs spread across many regions?

Use an AWS Cloud WAN core network with edge locations. Create distinct segments for each department.

How well did you know this?

Not at all

Perfectly

DX connecting on-prem applications to ECS clusters in multiple VPCs. How can you prevent VPC-to-VPC communication?

Use multiple DX Gateways - one for each set of VPCs you want to isolate.

How well did you know this?

Not at all

Perfectly

How do you log and query DNS traffic most easily?

Route 53 Resolver Query logging, query with CloudWatch Logs Insights.

How well did you know this?

Not at all

Perfectly

How do you propagate BGP routes to/from DX connection?

Enable route propagation from the route table and set the vpg as the target.

How well did you know this?

Not at all

Perfectly

What is the purpose of AWS VPN CloudHub?

Connect one VPC to many on-prem locations.

How well did you know this?

Not at all

Perfectly

What are three valid tunnel options for site-to-site VPN?

Pre-shared key (PSK)
Dead peer detection (DPD) timeout
Phase 2 Diffie-Hellman (DH) group numbers

How well did you know this?

Not at all

Perfectly

How do you aggregate multiple DX connections (from disparate DX partners) into a single DX endpoint, which is treated as a single, managed connection?

Link Aggregation Group (LAG)

How well did you know this?

Not at all

Perfectly

What are three INVALID tunnel options for site-to-site VPN?

Bidirectional Forwarding Detection (BFD)
Multiprotocol Label Switching (MPLS)
Path MTU Discovery (PMTUD)

How well did you know this?

Not at all

Perfectly

Site-to-Site VPN: How can you improve bandwidth over multiple paths (multiple connections associated with a transit gateway)?

Configure Equal-Cost Multi-Path (ECMP) routing and enable it in the transit gateway.

How well did you know this?

Not at all

Perfectly

At what number of bytes do you need to consider using jumbo frames for your MTU?

> 1500

How well did you know this?

Not at all

Perfectly

What is the MTU cap for jumbo frames (in bytes)?

9001

How well did you know this?

Not at all

Perfectly

What is billed for Direct Connect?

Port hours
Data transfer OUT

How well did you know this?

Not at all

Perfectly

What information is needed to provision a public virtual interface to connect on-prem to VPC via Direct Connect (Should support Autonomous System [AS] prepending)? (3)

Virtual local area network (VLAN) ID.
Border Gateway Protocol Autonomous System Number (BGP ASN)
CIDR ranges you wish to advertise to AWS

How well did you know this?

Not at all

Perfectly

How can you check EIP assignment to EC2s and validate no spare EIPs?

Config. Use the EIP-attached AWS Config Managed Rule

How well did you know this?

Not at all

Perfectly

How do you set up a VPC for private Workspaces instances?

With at least one private and one public subnet (to install OS updates)

How well did you know this?

Not at all

Perfectly

Do you need BGP multi-hop to set up active-passive connections with two VPGs?

No, in fact VPGs do not support multi-hop on AWS

How well did you know this?

Not at all

Perfectly

DX: What happens if you set the load-sharing of inbound traffic to your 2 VPGs with similar 'AS_PATH' configurations?

You create an active/active route configuration

DX: How do you configure the 'AS_PATH' attribute for your VPGs to create a active/passive route configuration?

prepend the customer gateway ASN on the secondary connection's 'AS_PATH' attribute twice. ex. ASN of CGW = 123 advertise prefix to secondary connection = 123 123

T/F You can assign an elastic IP to your Lambda function in a private subnet

False.

What service can provide deep packet inspection on ingress and egress traffic in your VPC?

AWS Network Firewall

What does Amazon Network Access Analyzer do?

Analyzes network security settings to identify unintended access. (Does not inspect traffic)

When transferring 3rd-party hosted domains to Route53, how do you enable DNSSEC signing?

Re-enable after transferring domain registration to Route53

In order to optimize DNS calls after a domain registration migration, how should you set the TTL on the NS record?

Set to a high value like 172800 (2 days)

Domain migration: What prerequisite is there to updating NS records in Route53 if there is DNSSEC configured on the current domain registration?

Remove the Delegation Signer (DS) record from the parent zone

DX Connection: When creating a VPI, what information is needed other than BGP ASN and the IP Addresses to advertise to AWS?

VLAN ID (virtual local area network)

Does AWS Transit Gateway automatically create and approve VPC Peering connections?

How do you connect SD-WAN virtual appliances to centrally networked (transit-gateway-connected) VPCs?

Using Transit Gateway Connect attachments

Why can't you use A VPN for redundancy for your DX connection when requiring throughput of 10 Gbps?

The limit for even aggregated throughput on managed VPNs through a virtual private gateway is 1.25 Gbps

What limitation is there on creating CNAME records for your domain?

You cannot create a CNAME record for the top node/zone apex. i.e. 'tutorialsdojo.com'

What is the difference between and alias A record and a non-alias A record?

Non-alias A records can only point to IP addresses, not DNS names.

How to use X-Ray to capture client IP address when monitoring traffic from an ALB?

It will automatically be captured in the 'x-forwarded-for' metric

ALB: how can you get insights on network traffic controls for every service in an application

Appmesh integration

Which IP Address in the 'x-forwarded-for' header likely contains info on the user's geographical location?

the last

EC2 application: How can you get the IP addresses of the users who are visiting your website

You can use a web server variable (e.g. REMOTE_ADDR)

Which UDP Ports must be allowed in your firewall for a NAT-T transmission over an IPsec tunnel on a Site-to-Site VPN? (2)

500 4500 NO TCP required

LBs: Which type of load balancer supports path conditions?

Application Load Balancer ONLY

DX + Public Virtual Interface: What can local servers connect to on AWS? (2)

1. Amazon S3 buckets in any AWS Region excluding the AWS China Region 2. All AWS Public IP addresses globally

T/F You should enable VLAN trunking for the 802.1Q VLAN tag on all intermediate devices for a successful DX connection

True

In a VPN + DX scenario, which types of routes will be highest priority to the virtual private gateway?

BGP propagated routes

How do you designate a new NTP time server in your VPC?

Create a new DHCP options set with the new server. Replace the old DHCP options set with the new one to hot-swap NTP servers.

LB: How can you route traffic to specific target groups based on the DNS host name? ex. newsletter.davidblocher.com vs blog.davidblocher.com, etc

Create a host condition (can be NLB or ALB)

CLoudFront: How do you change the origin based on the protocol being used by the viewer? (HTTP or HTTPS)

Set the Origin Protocol Policy to 'Match Viewer'

T/F A Gateway Load balancer can receive millions of requests per second while achieving low latency

False

How can you achieve low latency for millions of requests per second directed to EKS kubernetes clusters? (2)

1. Set up the AWS Load Balance Controller on the EKS cluster 2. Use a network load balancer

IP Address Manager (IPAM): How do you request an IP address/CIDR block for reference in a CloudFormation template?

Using a Lambda function custom resource

DX: What type of connection allows Autonomous System (AS) prepending?

A public-ASN-based connection

What is the highest allowable netmask for VPCs or subnets?

/28

From where do you enable route propagation?

From the VPC

What is the maximum bandwidth of an IPsec VPN connection?

1 Gbps

How can you encrypt communications over a 10 Gbps DX connection?

MACsec

You want to use the proxy protocol to track origin IP addresses for users hitting your load balancer. What type of ELB should you use?

Network LB. Application does not support proxy protocol.

3 ways to connect multiple VPCs

1. Transit GW 2. VPC peering 3. PrivateLink

How do you find the DNS server IP for a VPC?

The IP address of the DNS server is the base of the VPC network range plus two

Site-to-Site VPN: How can you get higher VPN bandwidth than the default VPN bandwidth limit of 1.25 Gbps?

Set up Equal-Cost Multi-Path routing (ECMP)

Site-to-site VPN: Can you enable jumbo frames to increase throughput?

What does CloudWatch RUM do?

performs real-time analysis of your web application performance (no packet inspection or real-time security)

How can you make sure data stored in Microsoft SQL Server on RDS is encrypted BEFORE it is sent to the DB?

Configure the SQL server to use Transparent Data Encryption (TDE)

Security measure to protect against DNS spoofing?

DNSsec

How can you bring your own static IP addresses to be used with Global accelerator? (2)

Set up Rout Origin Authorization (ROA) Use the 'aws globalaccelerator provision-byoip-cidr' CLI Command

2 ways to provide a static IP for a single EC2 instance that shuts down once/week?

1. Global Accelerator 2. Attach an Elastic IP address

CloudFormation: Which properties must be explicitly passed when peering 2 VPCs in different accounts AND Regions?

1. PeerRoleArn (accounts) 2. PeerRegion (region)

BGP: The shortest AS_Path is typically preferred. What is the next preference if AS_PATH attributes are of similar length?

Lowest multi-exit discriminator (MED)

Private subnet - hitting a single 3rd party API through NAT Gateway - receiving increased 'ErrorPortAllocation' for the NAT gateway and dropping connections... How to alleviate?

Distribute instances across AZs and create NAT gateways in each AZ. There is a limit of 55k simultaneous connections to each destination.

After defining a VPC CIDR Block in CF, how can you define an array of equally sized CIDR ranges for subnets?

Using the Fn::Cidr intrinsic function

When would you use subdomain delegation?

When you have to use different DNS providers for a domain and one or more subdomains

How can you manage DNS for two separate applications that share the same root domain?

Route53: Use split-view DNS

DX: When establishing a VPN connection over your DX connection, what type of interface should be used?

Public virtual interface (Private cannot reach virtual private gateway IPsec endpoints)

Route 53 private hosted zone: How can you easily monitor health checks for record sets within the zone which are used by EC2 instances?

Use CloudWatch to monitor "StatusCheckFailed" on EC2 instances

VPC FLow logs: What do you need to capture in a custom log group in order to log EKS pod-to-pod traffic?

pkt-srcaddr, pkt-dstaddr, srcaddr, and dstadrr

DX - V Private Interface - DX Gateway. Can you connect to VPC's in any region with this setup?

Yes.

Can you authorize a VPC access to your R53 private hosted zone if it is in an external AWS account?

Yes, but not from the console.

What IP can reach the Amazon Time Sync service on any EC2 instance?

169.254.169.123

Endpoints for Simple Email Service: Which endpoint ports can be used to protect data in transit using TLS

25, 587, or 2587

How do you derive the third parameter in the fn::Cidr intrinsic function for cloudformation

32 minus the netmask. So if you want /27s, you would use "5"

How can you create a proxy server with network bandwidth of up to 100 Gbps?

Use a compute-intensive instance type like P3 or higher. Enable enhanced networking.

BGP: Which community tag filter will help you only accept routes propagated from the Region in which your DX connection was established?

allow only 7224:8100 community tag 8200 is continent no filter is global

Container Network interface - Kubernetes application: You want at least 5 pods running in each node. How do you guarantee that IP addresses will be available?

Set the MINIMUM_IP_TARGET attribute to '5'

BGP: Which Community Tag prefixes should you advertise to route to a local AWS Region?

7224:9100 9200 is continent 9300 is global

Which BGP community tag is high preference: 7442:7100 or 7300?

7300

Does a NAT gateway support TCP fragmentation?

Nope

What type of wildcard characters are available in a host condition on an ALB?

* - any number of characters ? - any single character

DX - transit virtual interface: what can you connect? (2)

VPCs in multiple accounts Up to 3 Transit Gateways in the same Region

Migrate an application that has static IPs that are whitelisted by your customers. How do you keep those IPs?

Set up a Route Origin Authorization (ROA) document

BGP: How to consolidate routes if they exceed 100?

Summarize them