Network - VPC - Introduction and Overview Flashcards
Think of VPC as…
…a logical datacenter.
Where do you deploy a VPC?
Region
T/F: VPCs can span regions.
False
T/F: VPCs can span Availability Zones.
True; all availability zone within that region
According to the AWS definition, what does Amazon VPC allow you to provision?
Amazon VPC lets you provision a logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define.
According to the AWS definition, how much control do you have over your networking environment?
You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.
T/F: You can easily customize the network configuration for your Amazon VPC.
True
What is an example of how you can customize the network configuration for VPC?
Create a public-facing subnet for your webservers that has access to the Internet, and place your backend systems (e.g. databases, application servers) in a private-facing subnet with no internet access
You can leverage multiple layers of security, including…
…security groups and Network ACLs to help control access to EC2 instances in each subnet.
T/F: You can create a Hardware VPN connection between your corporate datacenter and your VPC and leverage the AWS cloud as an extension of your corporate datacenter.
True
Private IP address ranges
- 10.0.0.0-10.255.255.255 (10/8 prefix)
- 172.16.0.0-172.31.255.255 (172.16/12 prefix)
- 192.168.0.0-192.168.255.255 (192.168/16 prefix)
Maximum addressable size in AWS
/16
What are the two routes of entry into VPC?
Internet Gateway, Virtual Private Gateway
What is the purpose of the Internet Gateway?
Allows you to connect to the Internet
What is the purpose of the Virtual Private Gateway?
Allows you to terminate VPN connections
What is the purpose of the Router?
It routes traffic based on what is defined in the route tables
What is a Public subnet?
Internet-accessible subnet
What is a Private subnet?
Not Internet-accessible subnet
What do you normally put in public subnets?
Webservers, bastion host
What do you normally put in private subnets?
Database servers, application servers
Can security groups span subnets or availability zones?
Yes
Can network ACLs span subnets or availability zones?
Yes
How many subnets per availability zone?
One or more
Can route tables span subnets or availability zones?
Yes
Can a subnet span multiple availability zones?
No
What can you do with a VPC?
- Launch instances into a subnet of your choosing
- Assign custom IP address ranges in each subnet
- Configure route tables between subnets
- Create internet gateway and attach it to our VPC
- Much better security control over your AWS resources
- Instance security groups
- Subnet network access control lists (ACLs)
What does a route table define?
Whether a subnet is public or private
How many internet gateways can you have per VPC?
One
Example question: if Internet connection is running slow, how can you boost Internet speed?
If one of the answers is “attach another IGW to the VPC,” DON’T PICK THAT ONE!
T/F: Security groups are stateful.
True
What does “stateful” mean?
If you create a rule allowing traffic in, it automatically allows traffic out.
T/F: Network ACLs are stateless.
True
What does “stateless” mean?
If you create a rule allowing traffic in, you need to create a rule allowing the traffic back out.
Default VPC properties:
- User friendly, allowing you to immediately deploy instances
- All subnets in default VPC have a route out to the internet
- Each EC2 instance has both a public and private IP address
- Once deleted, you can create a new default VPC directly from the VPC Console or by using the CLI.
What does VPC Peering allow you to do?
Allows you to connect one VPC with another via a direct network route using private IP addresses
Example: VPC Peering Use Case
Connect: VPC for monitoring services, VPC for Active Directory, Administration VPC, Production VPC, Dev VPC, Test VPC
T/F: When VPC Peering, instances behave as if they were on the same private network
True
T/F: You can peer VPCs with other AWS accounts as well as with other VPCs in the same account.
True
Example: peer VPCs with other accounts use case
Peer VPCs with Dev account, Test account, Production account
What is the configuration of VPC Peering?
Star configuration (1 central VPC peers with 4 other VPCs)
T/F: Transitive peering is allowed.
False
What does a VPC consist of?
- IGWs (or Virtual Private Gateways)
- Route Tables
- Network Access Control Lists
- Subnets
- Security Groups
What does a non-default VPN consist of default?
- IGW
- Routing Table (IPV4)/not IPV6
- ?
Which 5 IP are reserved by default in a VPC?
- 0/24 Network address
- 1/24 Reserved by AWS for the VPC Router
- 2/24 Reserved by AWS for Amazon DNS
- 3/24 Reserved by AWS for future use
- 255/24 VPCs don’t support broadcast, so AWS reserves this address
