Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solution Architect Associate > Hybrid Networking > Flashcards

Hybrid Networking Flashcards

the concepts of BGP and IPSec, and the hybrid networking AWS services such as Direct Connect and Site-to-Site VPN.

1
Q

What standardized exterior gateway protocol is designed to exchange routing and reachability information among autonomous systems on the Internet?

A

Border Gateway Protocol (BGP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the primary purpose of Border Gateway Protocol (BGP)?

A

BGP is a path-vector protocol designed to exchange the best path to a destination between peers, this path is referred to as the AS_PATH (Autonomous System Path)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which TCP port does Border Gateway Protocol (BGP) use?

A

TCP port 179

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Does Border Gateway Protocol (BGP) require manual configuration?

A

Yes, BGP peering must be configured manually, it is not automatic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What path does Border Gateway Protocol (BGP) prefer by default?

A

Shortest path to the destination

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Using Border Gateway Protocol (BGP) is it possible to artificially make certain paths appear longer, causing other paths to be preferred?

A

Yes, using AS_PATH Prepending:

  • Example 1 appears shorter to BGP:
    DES 10.18.0.0/16 | NEXT HOP 10.17.0.1 | AS_PATH 201, 202, i
  • Example 2 appears longer to BGP:
    DES 10.18.0.0/16 | NEXT HOP 10.18.0.1 | AS_PATH 202, 202, 202, i
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which AWS networking services utilize Border Gateway Protocol (BGP)?

A
  • AWS Direct Connect
  • AWS Site-to-Site VPN (Dynamic)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What term is used to describe routers controlled by a single network entity?

A

Autonomous System (AS), each AS is assigned an Autonomous System Number (ASN) by IANA.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the difference between Interior Border Gateway Protocol (iBGP) and Exterior Border Gateway Protocol (eBGP)?

A
  • iBGP: Propagates routes within a single Autonomous System (AS)
  • eBGP: Propagates routes between different Autonomous Systems (ASs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What AWS service enables a private, physical connection between customer facilities and AWS?

A

AWS Direct Connect

AWS Region ↔ DX Location ↔ Customer Premises

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does ordering AWS Direct Connect involve?

A

Ordering Direct Connect involves requesting a dedicated port at an AWS DX Location, enabling physical connectivity to AWS services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Can AWS Direct Connect be used to access only private resources within a VPC?

A

No, DX can be used to access both private resources within a VPC and public AWS services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Can AWS Direct Connect be used to access the public internet?

A

No, DX cannot be used to access the public internet, it is designed for private connections to AWS services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the cost components of AWS Direct Connect?

A
  • Hourly Port Allocation Fee: Charged for reserving the DX port
  • Outbound Data Transfer Charges: Data sent from AWS to your premises (inbound is free)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What types of connections does AWS Direct Connect offer?

A
  • Dedicated Connection: Provided directly by AWS, using an Ethernet port allocated exclusively for a single customer
  • Hosted Connection: Offered by an AWS Direct Connect Partner, utilizing their existing network link to AWS
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What network speed options are available for AWS Direct Connect?

A
  • Dedicated Connections: 1 Gbps, 10 Gbps, 100 Gbps, 400 Gbps
  • Hosted Connections: 50 Mbps to 25 Gbps in increments (e.g., 50 Mbps, 100 Mbps, 200 Mbps, 300 Mbps, 400 Mbps, 500 Mbps, 1 Gbps, 2 Gbps, 5 Gbps, 10 Gbps, and 25 Gbps)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What factors should be considered when using AWS Direct Connect?

A
  • Establishes a private network connection to AWS
  • Offers low latency and high-speed connectivity
  • Requires provisioning time (can take weeks or months)
  • Does not include built-in redundancy; resilience must be implemented with multiple connections
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What AWS Direct Connect component enables access to AWS public or private services?

A

Virtual Interface (VIF)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Which two types of Virtual Interfaces (VIFs) does AWS Direct Connect provide?

A
  • Public VIF: Provides access to AWS public services (e.g., S3, DynamoDB)
  • Private VIF: Provides access to private AWS services within a VPC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which AWS Direct Connect Virtual Interface (VIF) is used to access AWS Public services like S3?

A

Public VIF

Path: Customer Router → Customer DX Router → AWS DX Router → AWS Public Space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which AWS Direct Connect Virtual Interface (VIF) is used to access AWS Private services like an EC2 instance in a VPC?

A

Private VIF

Path: Customer Router → Customer DX Router → AWS DX Router → VGW → VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the components of an AWS Direct Connect (DX) connection, and is it inherently resilient?

A
  • DX Location
  • DX Router
  • Cross Connect
  • Customer DX Router
  • Extension Cables
  • Customer Premises
  • Customer Router

Resilience is not built-in and must be planned separately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How is resiliency achieved with AWS Direct Connect (DX)?

A
  • Option 1: Use multiple cross-connects from DX routers to multiple customer DX routers and extend these connections with multiple cables to multiple customer premises routers.
    (DX Location, cables, or premises can still fail)
  • Option 2: Achieve maximum resiliency by combining Option 1 with two geographically separated DX locations and connecting them to two separate customer premises data centers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How can the security of AWS Direct Connect (DX) be enhanced?

A
  • Using a VPN over Public VIF ensures performance and security by providing an encrypted and authenticated tunnel with low and consistent latency, using Public VIF and VGW/TGW public endpoints
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which AWS service provides a central hub to simplify complex peering relationships by connecting VPCs and on-premises networks?

A

AWS Transit Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Does AWS Transit Gateway support transitive connections?

A

Yes, it enables a hub-and-spoke topology for VPCs and on-premises networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the primary purpose of AWS Transit Gateway?

A

To serve as a network transit hub, simplifying network complexity by connecting various AWS and on-premises resources through attachments, resulting in a more streamlined network architecture

27
Q

What is the resiliency posture of AWS Transit Gateway?

A

Regionally resilient, highly available, and scalable by default

28
Q

What types of attachments are supported by AWS Transit Gateway?

A
  • VPC attachment
  • Site-to-Site VPN attachment
  • Direct Connect Gateway attachment
29
Q

Can AWS Transit Gateway connect multiple VPCs?

A

Yes, it allows traffic to flow transitively between connected VPCs

30
Q

How is AWS Transit Gateway integrated with AWS Site-to-Site VPN?

A

By connecting to Customer Gateway routers

31
Q

Which Virtual Interface (VIF) type is used to connect AWS Direct Connect with AWS Transit Gateway?

A

Transit VIF

32
Q

Can AWS Transit Gateway connect with other Transit Gateways?

A

Yes, Transit Gateways can be peered across accounts and regions to build a global network, typically using a mesh topology

33
Q

Is it possible to share AWS Transit Gateway across AWS accounts?

A

Yes, by using AWS Resource Access Manager (RAM)

34
Q

What secure protocol suite provides encrypted communication between two computers over an IP network?

A

Internet Protocol Security (IPSec), a collection of protocols that establishes secure tunnels over insecure networks

35
Q

What is the primary purpose of Internet Protocol Security (IPSec)?

A

To securely connect two networks (specifically their routers, or peers) over the public internet

36
Q

What are the two main phases of Internet Protocol Security (IPSec)?

A
  • Internet Key Exchange (IKE) Phase 1: Establishes a secure channel; it’s slow and resource-intensive
  • Internet Key Exchange (IKE) Phase 2: Manages quick and efficient data exchange
37
Q

Which Internet Protocol Security (IPSec) phase handles authentication (e.g., passwords or certificates)?

A

Internet Key Exchange (IKE) Phase 1

38
Q

Which Internet Protocol Security (IPSec) phase uses asymmetric encryption to establish a shared symmetric key?

A

Internet Key Exchange (IKE) Phase 1

39
Q

In which Internet Protocol Security (IPSec) phase is the IKE Security Association (SA) (Phase 1 tunnel) created?

A

Internet Key Exchange (IKE) Phase 1

40
Q

Which Internet Protocol Security (IPSec) phase builds on Phase 1 and utilizes the keys established in that phase?

A

Internet Key Exchange (IKE) Phase 2

41
Q

During which Internet Protocol Security (IPSec) phase are encryption methods and keys for bulk data transfer agreed upon?

A

Internet Key Exchange (IKE) Phase 2

42
Q

Which Internet Protocol Security (IPSec) phase establishes the IPSec Security Association (SA) (Phase 2 tunnel) over the Phase 1 tunnel?

A

Internet Key Exchange (IKE) Phase 2

43
Q

Why are Internet Protocol Security (IPSec) operations divided into two separate phases?

A

The separation allows the Phase 1 tunnel (slow and resource-intensive) to remain active while the Phase 2 tunnel (used for data transfer) can be created and torn down as needed, optimizing performance

44
Q

What are the steps involved in Internet Key Exchange (IKE) Phase 1?

A
  1. Authentication using a certificate or pre-shared key
  2. Each peer generates a Diffie-Hellman (DH) private key and derives its public key
  3. Public keys are exchanged securely over the internet
  4. Both peers use their private key and the other’s public key to generate the same shared Diffie-Hellman key
  5. Agreement on encryption and key exchange parameters using the DH key
  6. Symmetric keys are created using the shared DH key and the agreed material
45
Q

What are the steps involved in Internet Key Exchange (IKE) Phase 2?

A
  1. A symmetric key encrypts and decrypts agreements while exchanging additional key material
  2. Both peers communicate and agree on the best encryption and integrity methods
  3. The Diffie-Hellman (DH) key and exchanged material are used to generate a symmetric IPSec key
  4. The IPSec key is used for bulk encryption and decryption of interesting traffic
  5. Two security associations (SAs) are established: one for traffic from Peer A to Peer B and another for traffic from Peer B to Peer A
46
Q

What are the two main types of VPNs?

A
  • Policy-based VPN
  • Route-based VPN
47
Q

Which type of VPN uses traffic-matching rules to send traffic over specific Security Associations (SAs)?

A

Policy-based VPN

48
Q

Which type of VPN allows different rules for various traffic types, offering greater flexibility but being more complex to configure?

A

Policy-based VPN

49
Q

Which type of VPN matches traffic based on prefixes and uses a single pair of Security Associations (SAs) for each prefix?

A

Route-based VPN

50
Q

Which AWS service provides a fully managed, secure connection between on-premises networks and AWS resources using IPSec tunnels?

A

AWS Site-to-Site VPN

51
Q

What are the pricing components of AWS Site-to-Site VPN?

A
  • Hourly cost
  • Data transfer out cost (inbound data is free)
52
Q

What factors should be considered when using AWS Site-to-Site VPN?

A
  • Speed limit of 1.25 Gbps
  • Latency varies due to public internet routing
  • Costs include hourly charges, GB outbound charges, and on-premises data cap
  • Quick deployment, typically within hours
  • Supports dynamic routing via BGP
  • Serves as a backup for Direct Connect (DX), often paired with one DX for primary connectivity and VPN for secondary
  • Can overlay a DX Public VIF to add encryption for data in transit
53
Q

What are the two types of VPNs?

A
  • Static VPN
  • Dynamic VPN
54
Q

Which type of VPN uses static network configuration?

A

Static VPN
- Routes to the remote side are manually added to route tables
- Remote network details are pre-configured on the VPN connection

55
Q

Which type of VPN uses the BGP protocol, requiring the customer’s router to support it?

A

Dynamic VPN
- BGP is configured on both the customer side and AWS side using Autonomous System Numbers (ASN)
- Network routes are exchanged dynamically via BGP

56
Q

How can high availability and traffic distribution be improved with Dynamic VPN?

A

By establishing multiple VPN connections

57
Q

Which feature allows dynamically learned routes from the Virtual Private Gateway (VGW) to be automatically added to route tables in a Dynamic VPN setup?

A

Route propagation

58
Q
A
59
Q

What protocol encrypts the logical connection established by AWS Site-to-Site VPN between a VPC and an on-premises network?

A

Internet Protocol Security (IPSec) over the public internet

60
Q

Can AWS Site-to-Site VPN be a highly available solution?

A

Yes, when designed with redundancy - using two on-premises data centers, dual customer routers, and separate internet connections

61
Q

How long does it typically take to set up AWS Site-to-Site VPN?

A

Less than an hour for an experienced engineer

62
Q

Which AWS service enables the quickest way to create the connection between AWS and non-AWS environments, such as on-premises, other cloud platforms, or data centers?

A

AWS Site-to-Site VPN

63
Q

What are the primary components involved in implementing AWS Site-to-Site VPN?

A
  • VPC that we goign to connec twith, and VPC Router
  • Virtual Private Gateway (VGW)
  • Customer Gateway (CGW)
  • VPN Connection
64
Q

Which component of AWS Site-to-Site VPN acts as a logical gateway associated with a single VPC?

A

Virtual Private Gateway (VGW)

65
Q

What does the Customer Gateway (CGW) in AWS Site-to-Site VPN represent?

A

Logical configuration in AWS or the physical device associated with that configuration

66
Q

Which AWS Site-to-Site VPN component holds the configuration and connects one Virtual Private Gateway (VGW) to one Customer Gateway (CGW)?

A

VPN Connection

AWS Certified Solution Architect Associate (42 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions