aws_networking Flashcards
What is a Virtual Private Cloud (VPC)?
isolated network environment in AWS
launch and manage resources like EC2 instances
What is a subnet in a VPC?
A subnet is a range of IP addresses within a VPC, where resources like EC2 instances can be placed. Subnets can be designated as public or private based on their accessibility.
What is the difference between a public and a private subnet?
A public subnet has a route to the internet via an Internet Gateway, while a private subnet has no direct internet access and is typically used for backend resources.
What is an Internet Gateway in AWS?
An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between resources in a VPC and the internet.
What is a NAT Gateway, and why is it used?
A NAT Gateway enables resources in a private subnet to access the internet while blocking inbound traffic, enhancing security by not exposing these resources directly to the internet.
What is VPC Peering?
VPC Peering allows two VPCs to communicate directly using private IP addresses, enabling seamless communication across VPCs in the same or different AWS accounts.
What is a Transit Gateway, and how is it different from VPC Peering?
A Transit Gateway allows multiple VPCs and on-premises networks to connect through a single point, offering a hub-and-spoke model that scales better than VPC Peering for complex networks.
What are CIDR blocks in the context of VPCs?
CIDR blocks are IP address ranges assigned to VPCs, which determine the range of IP addresses available for resources within the VPC.
Why is CIDR planning important in VPC design?
Proper CIDR planning ensures efficient use of IP addresses, minimizes the risk of overlapping IP ranges, and allows for future expansion.
What factors should be considered when assigning CIDR blocks in VPC design?
number of expected resources
the need for private/public subnets
future growth when assigning CIDR blocks.
How do security groups differ from Network ACLs (NACLs)?
Security groups act as virtual firewalls for instances, controlling inbound and outbound traffic at the instance level, while NACLs control traffic at the subnet level.
What is a default security group?
A default security group is automatically created in each VPC and allows all inbound traffic from instances in the same security group, while outbound traffic is unrestricted by default.
What is the purpose of Network ACLs?
Network ACLs (NACLs) are stateless filters that allow or deny traffic at the subnet level, providing an additional layer of security beyond security groups.
Can NACLs be used to block specific IP addresses?
Yes, NACLs can be used to block or allow specific IP addresses, but they are stateless, meaning you need to add rules for both inbound and outbound traffic.
What is subnetting?
Subnetting is dividing a larger network (e.g., a VPC) into smaller, logical sub-networks, or subnets, to control and organize resources.
