Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS CCP Certification > AWS Networking Services > Flashcards

AWS Networking Services Flashcards

1
Q

A virtual network dedicated to your AWS account

A

Amazon Virtual Private Cloud (VPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Amazon Virtual Private Cloud (VPC) Features

A

Analogous to having your own Data Center (DC) inside AWS.

It is logically isolated from other virtual networks in the AWS Cloud.

Provides complete control over the virtual networking environment including selection of IP ranges, creation of subnets, and configuration of route tables and gateways.

You can launch your AWS resources, such as Amazon EC2 instances, into your VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

VPC IP Addresses

A

When you create a VPC, you must specify a range of IPv4 addresses for the VPC in the form of a Classless Inter-Domain Routing (CIDR) block; for example, 10.0.0.0/16.

This is the primary CIDR block for your VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Amazon VPC Facts

A

A VPC spans all the Availability Zones in the region.

You have full control over who has access to the AWS resources inside your VPC.

You can create your own IP address ranges, and create subnets, route tables and network gateways.

When you first create your AWS account a default VPC is created for you in each AWS region.

A default VPC is created in each region with a subnet in each AZ.

By default you can create up to 5 VPCs per region.

You can define dedicated tenancy for a VPC to ensure instances are launched on dedicated hardware (overrides the configuration specified at launch).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Default VPC

A

A default VPC is automatically created for each AWS account the first time Amazon EC2 resources are provisioned.

The default VPC has all-public subnets.

Instances in the default VPC always have both a public and private IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Public subnets

A

Public subnets are subnets that have:

“Auto-assign public IPv4 address” set to “Yes”.

The subnet route table has an attached Internet Gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Availability Zone Fact

A

AZs names are mapped to different zones for different users

(i.e. the AZ “ap-southeast-2a” may map to a different physical zone for a different user).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Components of a VPC

A

A Virtual Private Cloud

Subnet

Internet Gateway

NAT Gateway

Hardware VPN Connection

Virtual Private Gateway
Router.

Peering Connection

VPC Endpoints

Egress-only Internet Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A logically isolated virtual network in the AWS cloud. You define a VPC’s IP address space from ranges you select.

A

A Virtual Private Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

A segment of a VPC’s IP address range where you can place groups of isolated resources (maps to an AZ, 1:1).

A

Subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

The Amazon VPC side of a connection to the public Internet.

A

Internet Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

A highly available, managed Network Address Translation (NAT) service for your resources in a private subnet to access the Internet.

A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A hardware-based VPN connection between your Amazon VPC and your datacenter, home network, or co-location facility.

A

Hardware VPN Connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

The Amazon VPC side of a VPN connection.

A

Virtual Private Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Customer side of a VPN connection

A

Customer Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Used to interconnect subnets and direct traffic between Internet gateways, virtual private gateways, NAT gateways, and subnets.

A

Router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Enables you to route traffic via private IP addresses between two peered VPCs.

Can be created with VPCs in different regions (available in most regions now).

A

Peering Connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Enables private connectivity to services hosted in AWS, from within your VPC without using an Internet Gateway, VPN, Network Address Translation (NAT) devices, or firewall proxies.

A

VPC Endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A stateful gateway to provide egress only access for IPv6 traffic from the VPC to the Internet.

A

Egress-only Internet Gateway

20
Q

Options for securely connecting to a VPC are:

A

AWS managed VPN – fast to setup.

Direct Connect – high bandwidth, low-latency but takes weeks to months to setup.

VPN CloudHub – used for connecting multiple sites to AWS.

Software VPN – use 3rd party software.

21
Q

A logical networking component that represents a Network Interface Card (NIC).

A

Elastic Network Interface (ENI)

ENIs can be attached and detached from EC2 instances, and the configuration of the ENI will be maintained.

22
Q

Capture information about the IP traffic going to and from network interfaces in a VPC

A

Flow Logs

Flow log data is stored using Amazon CloudWatch Logs

23
Q

Flow logs can be created at the following levels:

A

VPC.
Subnet.
Network interface.

24
Q

Subnet Facts

A

After creating a VPC, you can add one or more subnets in each Availability Zone.

When you create a subnet, you specify the CIDR block for the subnet, which is a subset of the VPC CIDR block.

Each subnet must reside entirely within one Availability Zone and cannot span zones.

25
Q

Types of subnet:

A

If a subnet’s traffic is routed to an internet gateway, the subnet is known as a public subnet.

If a subnet doesn’t have a route to the internet gateway, the subnet is known as a private subnet.

If a subnet doesn’t have a route to the internet gateway, but has its traffic routed to a virtual private gateway for a VPN connection, the subnet is known as a VPN-only subnet.

26
Q

Internet Gateway Fact

A

An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet.

27
Q

Provides a firewall/security layer at the subnet level

A

Network Access Control Lists (ACLs)

28
Q

Provides a firewall/security layer at the instance level

A

Security Groups

29
Q

Security Group Facts

A

Operates at the instance (interface) level

Supports allow rules only

Stateful

Evaluates all rules

Applies to an instance only if associated with a group

30
Q

Network ACL Facts

A

Operates at the subnet level

Supports allow and deny rules

Stateless

Processes rules in order

Automatically applies to all instances in the subnets its associated with

31
Q

VPC Wizard

A

The VPC Wizard can be used to create the following four configurations:

VPC with a Single Public Subnet

VPC with Public and Private Subnets

VPC with Public and Private Subnets and Hardware VPN Access

VPC with a Private Subnet Only and Hardware VPN Access

32
Q

VPC with a Single Public Subnet:

A

Your instances run in a private, isolated section of the AWS cloud with direct access to the Internet.

Network access control lists and security groups can be used to provide strict control over inbound and outbound network traffic to your instances.

Creates a /16 network with a /24 subnet. Public subnet instances use Elastic IPs or Public IPs to access the Internet.

33
Q

VPC with Public and Private Subnets:

A

In addition to containing a public subnet, this configuration adds a private subnet whose instances are not addressable from the Internet.

Instances in the private subnet can establish outbound connections to the Internet via the public subnet using Network Address Translation (NAT).

Creates a /16 network with two /24 subnets.

Public subnet instances use Elastic IPs to access the Internet.

Private subnet instances access the Internet via Network Address Translation (NAT).

34
Q

VPC with Public and Private Subnets and Hardware VPN Access:

A

This configuration adds an IPsec Virtual Private Network (VPN) connection between your Amazon VPC and your data center – effectively extending your data center to the cloud while also providing direct access to the Internet for public subnet instances in your Amazon VPC.

Creates a /16 network with two /24 subnets.

One subnet is directly connected to the Internet while the other subnet is connected to your corporate network via an IPsec VPN tunnel.

35
Q

VPC with a Private Subnet Only and Hardware VPN Access:

A

Your instances run in a private, isolated section of the AWS cloud with a private subnet whose instances are not addressable from the Internet.

You can connect this private subnet to your corporate data center via an IPsec Virtual Private Network (VPN) tunnel.

Creates a /16 network with a /24 subnet and provisions an IPsec VPN tunnel between your Amazon VPC and your corporate network.

36
Q

NAT Instance Facts

A

NAT instances are managed by you. (e.g. software updates)

Used to enable private subnet instances to access the Internet.

When creating NAT instances always disable the source/destination check on the instance.

NAT instances must be in a single public subnet.

NAT instances need to be assigned to security groups.

Scale up (instance type) manually and use enhanced networking

No high availability – scripted/auto-scaled HA possible using multiple NATs in multiple subnets

Can use as a bastion host

37
Q

NAT Gateway Facts

A

NAT gateways are managed for you by AWS.

NAT gateways are highly available in each AZ into which they are deployed.

Can be placed in multiple AZs

They are preferred by enterprises.

Can scale automatically up to 45Gbps.

No need to patch.

Not associated with any security groups

Cannot access through SSH

38
Q

A network service that provides an alternative to using the Internet to connect a customer’s on-premises sites to AWS.

Data is transmitted through a private network connection between AWS and a customer’s data center or corporate network.

A

AWS Direct Connect (DX)

39
Q

Benefits of Direct Connect:

A

Reduce cost when using large volumes of traffic.

Increase reliability (predictable performance).

Increase bandwidth (predictable bandwidth).

Decrease latency.

40
Q

AWS Direct Connect Virtual Interface (VIF)

A

Each AWS Direct Connect connection can be configured with one or more virtual interfaces (VIFs)

Public VIFs allow access to public services such as S3, EC2, and DynamoDB.

Private VIFs allow access to your VPC.

41
Q

AWS Direct Connect Facts

A

From Direct Connect you can connect to all AZs within the Region.

You can establish IPSec connections over public VIFs to remote regions.

Direct Connect is charged by port hours and data transfer.

Available in 1Gbps and 10Gbps.

Speeds of 50Mbps, 100Mbps, 200Mbps, 300Mbps, 400Mbps, and 500Mbps can be purchased through AWS Direct Connect Partners.

Each connection consists of a single dedicated connection between ports on the customer router and an Amazon router.

for HA you must have 2 DX connections – can be active/active or active/standby.

Route tables need to be updated to point to a Direct Connect connection.

42
Q

A service that improves the availability and performance of applications with local or global users

A

AWS Global Accelerator

43
Q

AWS Global Accelerator Features and Benefits

A

Provides static IP addresses that act as a fixed entry point to application endpoints in a single or multiple AWS Regions, such as Application Load Balancers, Network Load Balancers or EC2 instances.

Uses the AWS global network to optimize the path from users to applications, improving the performance of TCP and UDP traffic.

AWS Global Accelerator continually monitors the health of application endpoints and will detect an unhealthy endpoint and redirect traffic to healthy endpoints in less than 1 minute.

44
Q

AWS Global Accelerator Facts

A

Uses redundant (two) static anycast IP addresses in different network zones (A and B).

The redundant pair are globally advertised.

Uses AWS Edge Locations – addresses are announced from multiple edge locations at the same time.

Addresses are associated to regional AWS resources or endpoints.

AWS Global Accelerator’s IP addresses serve as the frontend interface of applications.

Intelligent traffic distribution: Routes connections to the closest point of presence for applications.

Targets can be Amazon EC2 instances or Elastic Load Balancers (ALB and NLB).

By using the static IP addresses, you don’t need to make any client-facing changes or update DNS records as you modify or replace endpoints.

The addresses are assigned to your accelerator for as long as it exists, even if you disable the accelerator and it no longer accepts or routes traffic.

45
Q

A fully managed service that offers the same AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on-premises facility for a truly consistent hybrid experience

A

AWS Outposts

46
Q

AWS Outposts Benefits and Features

A

AWS Outposts is ideal for workloads that require low latency access to on-premises systems, local data processing, data residency, and migration of applications with local system interdependencies.

AWS compute, storage, database, and other services run locally on Outposts, and you can access the full range of AWS services available in the Region to build, manage, and scale your on-premises applications using familiar AWS services and tools.

Outposts is available as a 42U rack that can scale from 1 rack to 96 racks to create pools of compute and storage capacity.

47
Q

Services you can run on AWS Outposts include:

A

Amazon EC2.

Amazon EBS.

Amazon S3.

Amazon VPC.

Amazon ECS/EKS.

Amazon RDS.

Amazon EMR.

AWS CCP Certification (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions