Networking

Question 1

Amazon Virtual Private Cloud, or VPCs

Answer 1

Amazon Virtual Private Cloud, or VPCs, as they’re affectionately known. A VPC lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. These resources can be public facing so they have access to the internet, or private with no internet access, usually for backend services like databases or application servers.

Question 2

Subnets

Answer 2

The public and private grouping of resources are known as subnets and they are ranges of IP addresses in your VPC.

Question 3

Amazon Virtual Private Cloud (Amazon VPC)

Answer 3

A networking service that you can use to establish boundaries around your AWS resources is Amazon Virtual Private Cloud (Amazon VPC).

Amazon VPC enables you to provision an isolated section of the AWS Cloud. In this isolated section, you can launch resources in a virtual network that you define. Within a virtual private cloud (VPC), you can organize your resources into subnets. A subnet is a section of a VPC that can contain resources such as Amazon EC2 instances.

Question 4

Internet gateway

Answer 4

To allow public traffic from the internet to access your VPC, you attach an internet gateway to the VPC.

An internet gateway is a connection between a VPC and the internet. You can think of an internet gateway as being similar to a doorway that customers use to enter the coffee shop. Without an internet gateway, no one can access the resources within your VPC.

Question 5

Virtual private gateway

Answer 5

To access private resources in a VPC, you can use a virtual private gateway.

The virtual private gateway is the component that allows protected internet traffic to enter into the VPC.

A virtual private gateway enables you to establish a virtual private network (VPN) connection between your VPC and a private network, such as an on-premises data center or internal corporate network. A virtual private gateway allows traffic into the VPC only if it is coming from an approved network.

Question 6

AWS Direct Connect

Answer 6

AWS Direct Connect is a service that enables you to establish a dedicated private connection between your data center and a VPC.

The private connection that AWS Direct Connect provides helps you to reduce network costs and increase the amount of bandwidth that can travel through your network.

Question 7

AWS has a wide range of tools that cover every layer of security:

Answer 7

network hardening, application security, user identity, authentication and authorization, distributed denial-of-service or DDoS prevention, data integrity, encryption, much more.

Question 8

Subnets

Answer 8

A subnet is a section of a VPC in which you can group resources based on security or operational needs. Subnets can be public or private.

Question 9

Public subnets

Answer 9

contain resources that need to be accessible by the public, such as an online store’s website.

Question 10

Private subnets

Answer 10

contain resources that should be accessible only through your private network, such as a database that contains customers’ personal information and order histories.

Question 11

In a VPC, subnets can communicate with each other.

Answer 11

For example, you might have an application that involves Amazon EC2 instances in a public subnet communicating with databases that are located in a private subnet.

Question 12

A packet

Answer 12

is a unit of data sent over the internet or a network.

Question 13

access control list (ACL)

Answer 13

The VPC component that checks packet permissions for subnets is a network access control list (ACL).

Question 14

network access control list (ACL)

Answer 14

A network access control list (ACL) is a virtual firewall that controls inbound and outbound traffic at the subnet level.

Question 15

More ACL

Answer 15

Each AWS account includes a default network ACL. When configuring your VPC, you can use your account’s default network ACL or create custom network ACLs.

Question 16

ACL Rules

Answer 16

By default, your account’s default network ACL allows all inbound and outbound traffic, but you can modify it by adding your own rules. For custom network ACLs, all inbound and outbound traffic is denied until you add rules to specify which traffic to allow. Additionally, all network ACLs have an explicit deny rule. This rule ensures that if a packet doesn’t match any of the other rules on the list, the packet is denied.

Question 17

Stateless packet filtering

Answer 17

Network ACLs perform stateless packet filtering. They remember nothing and check packets that cross the subnet border each way: inbound and outbound.

Question 18

Security Group

Answer 18

The VPC component that checks packet permissions for an Amazon EC2 instance is a security group.

A security group is a virtual firewall that controls inbound and outbound traffic for an Amazon EC2 instance.

Architecture diagram of a security group in front of an Amazon EC2 instance

By default, a security group denies all inbound traffic and allows all outbound traffic. You can add custom rules to configure which traffic to allow or deny.

Question 19

Multiple EC2s

Answer 19

If you have multiple Amazon EC2 instances within a subnet, you can associate them with the same security group or use different security groups for each instance.

Question 20

Stateful packet filtering

Answer 20

Security groups perform stateful packet filtering. They remember previous decisions made for incoming packets.

Question 21

ACLs & Security Groups

Answer 21

Both network ACLs and security groups enable you to configure custom rules for the traffic in your VPC. As you continue to learn more about AWS security and networking, make sure to understand the differences between network ACLs and security groups.

Question 22

DNS

Answer 22

You can think of DNS as being the phone book of the internet. DNS resolution is the process of translating a domain name to an IP address.

Question 23

Amazon Route 53

Answer 23

Amazon Route 53 is a DNS web service. It gives developers and businesses a reliable way to route end users to internet applications hosted in AWS.

Amazon Route 53 connects user requests to infrastructure running in AWS (such as Amazon EC2 instances and load balancers). It can route users to infrastructure outside of AWS.

Another feature of Route 53 is the ability to manage the DNS records for domain names. You can register new domain names directly in Route 53. You can also transfer DNS records for existing domain names managed by other domain registrars. This enables you to manage all of your domain names within a single location.

Question 24

Amazon Route 53 and Cloudfront

Answer 24

A customer requests data from the application by going to AnyCompany’s website.

2
Amazon Route 53 uses DNS resolution to identify AnyCompany.com’s corresponding IP address, 192.0.2.0. This information is sent back to the customer.

3
The customer’s request is sent to the nearest edge location through Amazon CloudFront.

4
Amazon CloudFront connects to the Application Load Balancer, which sends the incoming packet to an Amazon EC2 instance.