Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cloud Practitioner (Digital Cloud) > AWS Networking Services > Flashcards

AWS Networking Services Flashcards

1
Q

What is Amazon Virtual Private Cloud (VPC)?

A

A virtual private cloud (VPC) is a virtual network dedicated to your AWS account.

It is logically isolated from other virtual networks in the AWS Cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

VPC Diagram

A

Subnet reside in Availability Zone
Multiple AZs reside in VPC
One VPC in a region

Router on AZ level
Internet Gateway on VPC level

Route table used to configure VPC router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What must you specify when you create a VPC?

A

When you create a VPC, you must specify a range of IPv4 addresses for the VPC in the form of a Classless Inter-Domain Routing (CIDR) block; for example, 10.0.0.0/16.

This is the primary CIDR block for your VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does VPC allow control of?

A

Provides complete control over the virtual networking environment including selection of IP ranges, creation of subnets, and configuration of route tables and gateways.

You can create your own IP address ranges, and create subnets, route tables and network gateways.

You can launch your AWS resources, such as Amazon EC2 instances, into your VPC.

You have full control over who has access to the AWS resources inside your VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What AZs does a VPC span across in a region?

A

A VPC spans all the Availability Zones in the region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Is default VPC created upon AWS account creation?

A

When you first create your AWS account a default VPC is created for you in each AWS region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Where are default VPCs created in a region?

A

A default VPC is created in each region with a subnet in each AZ.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How many VPCs can be created in a region?

A

By default you can create up to 5 VPCs per region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Is it possible to specify instances to launch on dedicated hardware in a VPC?

A

You can define dedicated tenancy for a VPC to ensure instances are launched on dedicated hardware (overrides the configuration specified at launch).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Does default VPC have all public subnets?

A

The default VPC has all-public subnets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are public subnets in VPCs?

A

Public subnets are subnets that have:

  • “Auto-assign public IPv4 address” set to “Yes”.
  • The subnet route table has an attached Internet Gateway.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What IP addresses does an instance in a VPC have?

A

Instances in the default VPC always have both a public and private IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How are AZ names mapped in a VPC?

A

AZs names are mapped to different zones for different users (i.e. the AZ “ap-southeast-2a” may map to a different physical zone for a different user).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the components of a VPC?

A 
A Virtual Private Cloud
Subnet
Internet Gateway
NAT Gateway
Hardware VPN Connection
Virtual Private Gateway
Customer Gateway
Router
Peering Connection
VPC Endpoints
Egress-only Internet Gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

VPC Component: Virtual Private Cloud

A

A Virtual Private Cloud: A logically isolated virtual network in the AWS cloud. You define a VPC’s IP address space from ranges you select.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

VPC Component: Subnet

A

Subnet: A segment of a VPC’s IP address range where you can place groups of isolated resources (maps to an AZ, 1:1).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

VPC Component: Internet Gateway

A

Internet Gateway: The Amazon VPC side of a connection to the public Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

VPC Component: NAT Gateway

A

NAT Gateway: A highly available, managed Network Address Translation (NAT) service for your resources in a private subnet to access the Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

VPC Component: Hardware VPN Connection

A

Hardware VPN Connection: A hardware-based VPN connection between your Amazon VPC and your datacenter, home network, or co-location facility.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

VPC Compnent: Virtual Private Gateway

A

Virtual Private Gateway: The Amazon VPC side of a VPN connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

VPC Component: Customer Gateway

A

Customer Gateway: Your side of a VPN connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

VPC Component: Customer Gateway

A

Customer Gateway: Your side of a VPN connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

VPC Component: Router

A

Router: Routers interconnect subnets and direct traffic between Internet gateways, virtual private gateways, NAT gateways, and subnets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

VPC Component: Peering Connection

A

Peering Connection: A peering connection enables you to route traffic via private IP addresses between two peered VPCs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

VPC Component: VPC Endpoints

A

VPC Endpoints: Enables private connectivity to services hosted in AWS, from within your VPC without using an Internet Gateway, VPN, Network Address Translation (NAT) devices, or firewall proxies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

VPC Egress-only Internet Gateway

A

Egress-only Internet Gateway: A stateful gateway to provide egress only access for IPv6 traffic from the VPC to the Internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the options to securely connect to VPN?

A

AWS managed VPN – fast to setup.

Direct Connect – high bandwidth, low-latency but takes weeks to months to setup.

VPN CloudHub – used for connecting multiple sites to AWS.

Software VPN – use 3rd party software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is an ENI in VPC?

A

An Elastic Network Interface (ENI) is a logical networking component that represents a NIC.

ENIs can be attached and detached from EC2 instances, and the configuration of the ENI will be maintained.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are Flow Logs in VPC?

A

Flow Logs capture information about the IP traffic going to and from network interfaces in a VPC.

Flow log data is stored using Amazon CloudWatch Logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Where can Flow Logs be created?

A

Flow logs can be created at the following levels:

  • VPC.
  • Subnet.
  • Network interface.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How can peering connections be created?

A

Peering connections can be created with VPCs in different regions (available in most regions now).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the process of adding subnet in a VPC?

A

After creating a VPC, you can add one or more subnets in each Availability Zone.

When you create a subnet, you specify the CIDR block for the subnet, which is a subset of the VPC CIDR block.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What geographical restrictions does subnets have in VPCs?

A

Each subnet must reside entirely within one Availability Zone and cannot span zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What different types of subnets are there in VPC?

A
  • public subnet
  • private subnet
  • VPN only subnet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a public subnet in VPC?

A

If a subnet’s traffic is routed to an internet gateway, the subnet is known as a public subnet.

36
Q

What is a private subnet in VPC?

A

If a subnet doesn’t have a route to the internet gateway, the subnet is known as a private subnet.

37
Q

What is a VPN only subnet in VPC?

A

If a subnet doesn’t have a route to the internet gateway, but has its traffic routed to a virtual private gateway for a VPN connection, the subnet is known as a VPN-only subnet.

38
Q

What is an Internet Gateway in VPC?

A

An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet.

39
Q

What level does Network Access Control List (ACL) operate in?

A

Network Access Control Lists (ACLs) provide a firewall/security layer at the subnet level.

40
Q

What level does Security Group operate in?

A

Security Groups provide a firewall/security layer at the instance level.

41
Q

Network ACL details

A

Operates at the subnet level

Supports allow and deny rules

Stateless

Processes rules in order

Automatically applies to all instances in the subnets its associated with

42
Q

Security Group Details

A

Operates at the instance (interface) level

Supports allow rules only

Stateful

Evaluates all rules

Applies to an instance only if associated with a group

43
Q

What four configurations can a VPC Wizard create?

A
  • VPC with a Single Public Subnet:
  • VPC with Public and Private Subnets:
  • VPC with Public and Private Subnets and Hardware VPN Access:
  • VPC with a Private Subnet Only and Hardware VPN Access:
44
Q

What is VPC with a Single Public Subnet?

A

Your instances run in a private, isolated section of the AWS cloud with direct access to the Internet.

Network access control lists and security groups can be used to provide strict control over inbound and outbound network traffic to your instances.

Creates a /16 network with a /24 subnet. Public subnet instances use Elastic IPs or Public IPs to access the Internet.

45
Q

What is VPC with Public and Private Subnets?

A

In addition to containing a public subnet, this configuration adds a private subnet whose instances are not addressable from the Internet.

Instances in the private subnet can establish outbound connections to the Internet via the public subnet using Network Address Translation (NAT).

Creates a /16 network with two /24 subnets.
Public subnet instances use Elastic IPs to access the Internet.

Private subnet instances access the Internet via Network Address Translation (NAT).

46
Q

What is VPC with Public and Private Subnets and Hardware VPN Access?

A

This configuration adds an IPsec Virtual Private Network (VPN) connection between your Amazon VPC and your data center – effectively extending your data center to the cloud while also providing direct access to the Internet for public subnet instances in your Amazon VPC.

Creates a /16 network with two /24 subnets.

One subnet is directly connected to the Internet while the other subnet is connected to your corporate network via an IPsec VPN tunnel.

47
Q

What is VPC with a Private Subnet Only and Hardware VPN Access?

A

Your instances run in a private, isolated section of the AWS cloud with a private subnet whose instances are not addressable from the Internet.

You can connect this private subnet to your corporate data center via an IPsec Virtual Private Network (VPN) tunnel.

Creates a /16 network with a /24 subnet and provisions an IPsec VPN tunnel between your Amazon VPC and your corporate network.

48
Q

Who is responsible for managing NAT instances?

A

NAT instances are managed by you.

49
Q

What are NAT instances used for?

A

Used to enable private subnet instances to access the Internet.

50
Q

What must you do when creating NAT instances?

A

When creating NAT instances always disable the source/destination check on the instance.

51
Q

What subnet must NAT instances be in?

A

NAT instances must be in a single public subnet.

52
Q

What security settings must NAT instances have?

A

NAT instances need to be assigned to security groups.

53
Q

Who is responsible for NAT Gateways?

A

NAT gateways are managed for you by AWS.

54
Q

Where are NAT gateways highly available?

A

NAT gateways are highly available in each AZ into which they are deployed.

55
Q

Who prefers NAT Gateways over NAT Instances?

A

NAT Gateways are preferred by enterprises.

56
Q

How much can NAT Gateways scale up to?

A

NAT Gateways an scale automatically up to 45Gbps.

57
Q

What security settings must NAT Gateways have?

A

NAT Gateways are not associated with any security groups.

No need to patch.

58
Q

NAT Instance Details

A

Managed by you (e.g. software updates)

Scale up (instance type) manually and use enhanced networking

No high availability – scripted/auto-scaled HA possible using multiple NATs in multiple subnets

Need to assign Security Group

Can use as a bastion host

59
Q

NAT Gateway Details

A

Managed by AWS

Elastic scalability up to 45 Gbps

Provides automatic high availability within an AZ and can be placed in multiple AZs

No Security Groups

Cannot access through SSH

60
Q

What is AWS Direct Connect (DX)?

A

AWS Direct Connect is a network service that provides an alternative to using the Internet to connect a customer’s on-premises sites to AWS.

61
Q

How does AWS Direct Connect work?

A

Data is transmitted through a private network connection between AWS and a customer’s data center or corporate network.

62
Q

What are the benefits of Direct Connect?

A

Reduce cost when using large volumes of traffic.

Increase reliability (predictable performance).

Increase bandwidth (predictable bandwidth).

Decrease latency.

63
Q

What can each AWS DX connection be configured with?

A

Each AWS Direct Connect connection can be configured with one or more virtual interfaces (VIFs).

64
Q

What does Public VIFs allow in AWS DX?

A

Public VIFs allow access to public services such as S3, EC2, and DynamoDB.

65
Q

What does Private VIFs allow in AWS DX?

A

Private VIFs allow access to your VPC.

66
Q

What AZs can you connect to with AWS DX?

A

From Direct Connect you can connect to all AZs within the Region.

67
Q

What connections can you establish over public VIFs in AWS DX?

A

You can establish IPSec connections over public VIFs to remote regions.

68
Q

What metrics are used to charge for using AWS DX?

A

Direct Connect is charged by port hours and data transfer.

69
Q

What speeds is AWS DX available in?

A

Available in 1Gbps and 10Gbps.

Speeds of 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, and 500Mbps can be purchased through AWS Direct Connect Partners.

70
Q

What connections are needed between ports in AWS DX?

A

Each connection consists of a single dedicated connection between ports on the customer router and an Amazon router.

71
Q

What is required to allow HA for AWS DX?

A

for HA you must have 2 DX connections – can be active/active or active/standby.

72
Q

What must be done to route tables to allow AWS DX?

A

Route tables need to be updated to point to a Direct Connect connection.

72
Q

What must be done to route tables to allow AWS DX?

A

Route tables need to be updated to point to a Direct Connect connection.

73
Q

What is AWS Global Accelerator?

A

AWS Global Accelerator is a service that improves the availability and performance of applications with local or global users.

74
Q

What does AWS Global Accelerator provide?

A

It provides static IP addresses that act as a fixed entry point to application endpoints in a single or multiple AWS Regions, such as Application Load Balancers, Network Load Balancers or EC2 instances.

75
Q

What is the use of AWS Global Accelerator?

A

Uses the AWS global network to optimize the path from users to applications, improving the performance of TCP and UDP traffic.

AWS Global Accelerator continually monitors the health of application endpoints and will detect an unhealthy endpoint and redirect traffic to healthy endpoints in less than 1 minute.

76
Q

Wbat does AWS Global Accelerator use?

A

Uses redundant (two) static anycast IP addresses in different network zones (A and B).

The redundant pair are globally advertised.

Uses AWS Edge Locations – addresses are announced from multiple edge locations at the same time.

77
Q

Where are the addresses associated in AWS Global Accelerator?

A

Addresses are associated to regional AWS resources or endpoints.

78
Q

What do IP addresses serve as in AWS Global Accelerator?

A

AWS Global Accelerator’s IP addresses serve as the frontend interface of applications.

79
Q

What is Intelligent Traffic Distribution in AWS Global Accelerator?

A

Intelligent traffic distribution: Routes connections to the closest point of presence for applications.

80
Q

What are the targets in AWS Global Accelerator?

A

Targets can be Amazon EC2 instances or Elastic Load Balancers (ALB and NLB).

81
Q

What does using static IP addresses help with when using AWS Global Accelerator?

A

By using the static IP addresses, you don’t need to make any client-facing changes or update DNS records as you modify or replace endpoints.

The addresses are assigned to your accelerator for as long as it exists, even if you disable the accelerator and it no longer accepts or routes traffic.

82
Q

What is AWS Outpost?

A

AWS Outposts is a fully managed service that offers the same AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on-premises facility for a truly consistent hybrid experience.

83
Q

What is AWS outpost ideal for?

A

AWS Outposts is ideal for workloads that require low latency access to on-premises systems, local data processing, data residency, and migration of applications with local system interdependencies.

84
Q

What services are available on AWS Outpost?

A

AWS compute, storage, database, and other services run locally on Outposts

You can access the full range of AWS services available in the Region to build, manage, and scale your on-premises applications using familiar AWS services and tools.

85
Q

What racks are available for AWS Outposts?

A

Outposts is available as a 42U rack that can scale from 1 rack to 96 racks to create pools of compute and storage capacity.

86
Q

What are some examples of services that can run on AWS Outpost?

A

Services you can run on AWS Outposts include:

Amazon EC2.
Amazon EBS.
Amazon S3.
Amazon VPC.
Amazon ECS/EKS.
Amazon RDS.
Amazon EMR

AWS Cloud Practitioner (Digital Cloud) (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions