Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect > Module 3 - Networking > Flashcards

Module 3 - Networking Flashcards

1
Q

What is a CIDR block?

A

This is how you tell the network how many IP addresses to allocate. Go for more so you don’t run out of addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Amazon VPC?

A

Amazon Virtual Private Cloud (VPC) is a service that lets you launch AWS resources in a logically isolated virtual network. You deploy into ONE of the Regions and can host resources from any Availability Zone within its Region. It’s like your own personal data center.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a subnet?

A

A range of IP addresses in your VPC. It lives in one AZ. It must be associated with only ONE route table but subnets can share a route table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is CIDR?

A

Classless Inter-Domain Routing. It’s a method of allocating IP addresses and IP routing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does an Internet Gateway do?

A

Allows instances in your VPC to talk to the internet. It has 2 jobs:

  • Provides a target in your VPC route tables for internet-routable traffic
  • Performs network address translation (NAT) for instances that have been assigned public IPv4 addresses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How does a subnet get on a route table?

A

Every subnet in your network must be on a route table. (and only one route table). It will be on the main one if you don’t specify.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How would you set up multiple environments, like dev, qa, prod?

A

Create multiple VPCs. For extra security, use multiple accounts also.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How do you make an instance publicly accessible within a VPC?

A

1) Attach an internet gateway to the VPC (this creates a public subnet)
2) Update the public route table pointing to the gateway.
3) Assign the instance a public IP address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is an Elastic IP address?

A

An IP address that you can move around to any instance. You access it through the Internet Gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What’s the point of an Elastic IP?

A

You can mask the failure of an instance by rapidly remapping the address to another instance in your VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the limitations of an Elastic IP?

A

Does not work on VPN (because there is no Internet Gateway), limited to 5 addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is an Elastic Network Interface?

A

An interface you can attach to an instance, then detach and attach to a different instance, all the while keeping its Elastic IP, private IP, elastic address and MAC address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the purpose of NAT?

A

Network Address Translation is for conserving IP addresses. This lets your private IP networks connect to the internet. Not needed for IPv6.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a NAT gateway?

A

A one-way (outbound) connection between private subnet instances and the internet. The NAT gateway uses its Elastic IP address as the source IP for traffic from the private subnet. Not needed for IPv6.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a network ACL?

A

Network Access Control List. It’s an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more SUBNETS. It contains a list of rules evaluated in order to determine if traffic is allowed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the setting of the default network ACL?

A

VPCs automatically get a default NACL. It allows all inbound and outbound IPv4 traffic. CUSTOM ACLs deny all traffic by default.

17
Q

What are the components of an ACL rule?

A

• Rule number – As soon as a rule matches traffic, it is applied regardless of any higher-numbered rule that might contradict it.
• Type – e.g., Secure Shell (SSH). You can also specify all traffic or a custom range.
• Protocol – You can specify any protocol that has a standard protocol number.
• Port range – e.g., 80 for HTTP traffic.
• Source – For inbound rules only, the source of the traffic (CIDR range).
• Destination – For outbound rules only, the destination for the traffic (CIDR range).
• Allow or Deny – Whether to allow or deny the specified traffic
STATELESS

18
Q

What is a security group?

A

A virtual firewall for your EC2 instance to control inbound and outbound traffic. Works at the instance level. Supports only allow rules. STATEFUL (response to a request will be allowed).

19
Q

What is the default setting for a security group?

A

Allow all outbound traffic. Block all inbound traffic.

20
Q

What is security group chaining?

A

The inbound and outbound rules are set up in a way that traffic can only flow from the top tier to the bottom tier and back up again. Prevents security breaches in one tier from compromising other tiers.

21
Q

Describe a multilayer defense

A
  • Run in VPC (control which instances are exposed to internet)
  • Network ACL at the subnet level
  • Security groups (most common)
22
Q

How many VPCs can you have per region? How many subnets per VPC?

A

5 VPCs per region.

200 Subnets per VPC.

23
Q

What parts of a VPC cost you money?

A

NAT gateway, VPC endpoints, VPN gateway, customer gateway

24
Q

I created an EC2 instance in my VPC but I don’t see its public DNS.

A

You have to enable DNS hostnames. They are off by default.

25
Q

There is a default VPC in every region. What are its features/configurations?

A
  • CIDR block size /16. (172.31.0.0/16)
  • Size /20 default subnet in each AZ in the region.
  • Internet Gateway connected to default VPC
  • Default security group (associated with default VPC)
  • Default Network Access Control List (NACL) associated with default VPC
  • Default DHCP options
  • Main route table
26
Q

0.0.0.0/0

A

DEFAULT, represents all possible IP addresses.

27
Q

What is AWS Direct Connect? Why would you use it?

A

A dedicated network connection from on-prem to AWS. Super fast, in low or high bandwidth.

Reduces network costs; increases bandwidth throughput.
More consistent network (reliable, secure)

28
Q

Where does the NAT gateway live?

A

The PUBLIC subnet

29
Q

What is a NAT instance and what’s the one thing you need to remember about it?

A

It’s just an EC2 instance configured a certain way. Not used much anymore. Managed by YOU, not AWS.

** You must disable source/destination checks ** so that it can work as a NA translator.

30
Q

A company plans to launch an Amazon EC2 instance in a private subnet for its internal corporate web portal. For security purposes, the EC2 instance must send data to Amazon DynamoDB and Amazon S3 via private endpoints that don’t pass through the public Internet.

Which of the following can meet the above requirements?

A

Use VPC endpoints to route all access to S3 and DynamoDB through private endpoints.

31
Q

A Solutions Architect needs to make sure that the On-Demand EC2 instance can only be accessed from this IP address (110.238.98.71) via an SSH connection. Which configuration below will satisfy this requirement? What goes in the ??

Security Group Inbound Rule: Protocol -??? Port Range -?? Source 110.238.98.71/??

A

TCP (because that’s for SSH)
22 (ditto)
32 (denotes one IP address. /0 would be the entire network.)

32
Q

Which components are required to build a site-to-site VPN connection on AWS? (Select TWO.)

A

A customer gateway is required for the VPN connection to be established. A customer gateway device is set up and configured in the customer’s data center.

A virtual private gateway is attached to a VPC to create a site-to-site VPN connection on AWS. You can accept private encrypted network traffic from an on-premises data center into your VPC without the need to traverse the open public internet.

33
Q

A company has multiple VPCs with IPv6 enabled for its suite of web applications. The Solutions Architect tried to deploy a new Amazon EC2 instance but she received an error saying that there is no IP address available on the subnet.

How should the Solutions Architect resolve this problem?

A

Set up a new IPv4 subnet with a larger CIDR range. Associate the new subnet with the VPC and then launch the instance.

Not IPv6 only because you need to add an IPv4 subnet first before you can create an IPv6 subnet.

34
Q

Your EC2 instance cannot be accessed from the Internet (or vice versa). What could be the problem?

A
  • Does it have an EIP or public IP address?

- Is the route table properly configured?

AWS Solutions Architect (20 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions