Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS Solutions Architect Professional > Networking > Flashcards

Networking Flashcards

1
Q

Route53 Record Types

A
  • A - maps a hostname to IPv4
  • AAAA - maps hostname to IPv6
  • CNAME - maps a hostname to another hostname
  • NS - Name Servers for the Hosted Zone (indicates which DNS server is authoritative for that domain)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Route53

CNAME vs Alias

A
  • CNAME: Points a hostname to any other hostname (can’t be use with root domain)
  • Alias: Points a hostname to an AWS resource (works with root domain) and is free of charge.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Route53

Alias Records Targets

A
  • ELB
  • CloudFront Distributions
  • API Gateway
  • Elastic Beanstalk
  • S3 websites
  • VPC Interface endpoints
  • Global Accelerator
  • Route53 record in the same hosted zone
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Routing Policies

Simple

A

Route traffic to a single resource, can’t be associated with Health Checks. If a record has multiple values, a random one is chosen by the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Routing Policies

Weighted

A

Control de % of the requests that go to each resource. Can be associated with Health Checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Route Policy

Latency based

A

Redirect to the resource that has the least latency, based on traffic between users and AWS regions. Can be associated with Health Checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Routing Policies

Failover (Active-Passive)

A

You have a primary and secondary record for disaster recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Routing Policies

Geolocation

A

Based on user location by continent, country or US state Can be associated with Health Checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Routing Policies

Geoproximity

A

Based on the geographical location of users and resources. Ability to shift more traffic to resources based on the defined bias.

Must use Route53 Traffic Flow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Route53 Traffic Flow

A

Visual editor to
* Manage complex routing trees
* Create and mantain records in complex configurations.
* Configurations can be saved as Traffic Flow Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Routing Policies

Multi-Value

A

Can be associated with Health Checks, returns up to 8 healthy records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Routing Policies

IP-based Routing

A

You provide a list of CIDRs for your clients and the corresponding endpoints. Optimizes performance and reduces network costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Route 53

Hosted Zones

A

Container for records that define how to route traffic.

  • Public: specify how to route traffic on the Internet
  • Private: specify how to route traffic within one or more VPCs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DNS Security Extensions (DNSSEC)

A

Verifies DNS data integrity and origin. Works only with Public Hosted Zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Route53 Health Checks

A
  • Health checks that monitor a public endpoint
  • Health checks that monitor up to 256 other health checks (calculated health checks)
  • Health checks that monitor CloudWatch alarms (efective for private resources)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Route53 Resolver

A

Answers DNS queries for:
1. Local domain names for EC2 instances
2. Records in Private Hosted Zones
3. Records in public Name Servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Route 53

Resolver Endpoints for Hybrid DNS

A

Can be associated with one or move VPCs in the same region
* Inbound Endpoint forward external DNS queries of domain names, for AWS resources and records in Private Hosted Zones to Route 53 resolver.
* Outbound Endpoint Conditionally forwards DNS queries to other DNS resolvers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

AWS Global Accelerator

A

Provides static IP addresses that serve as single fixed entry points for your clients. You associate them to regional endpoints. Accept incoming traffic onto the AWS global network from the edge location that is closest to your users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

With which resources does standard Global Accelerator works?

A
  • Elastic IP
  • EC2 instances
  • ALB
  • NLB

Continuously monitors the health of all endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

CloudFront vs Global Accelerator

A

CloudFront
* Improves performance for both cacheable content
* Dynamic content served at the edge

Global Accelerator
* Improves performance for a wide range of apps
* Proxying packets at the edge to apps in one or more Regions.

21
Q

Network ACLs

A

Stateless firewall at the subnet level. Supports allow and deny rules

22
Q

Security Groups

A

Stateful rules at the instance level. Only supports allow rules

23
Q

VPC Peering

A
  • Connect to VPC privately using AWS network.
  • Is not transitive.
  • Must update route tables in subnets, uses the longest prefix match.
24
Q

VPC Peering

Edge to edge routing

A

Invalid configuration of VPC Peering. Not transitive with VPN, Direct Connect, IGW, NAT and VPC Endpoints.

25
Q

Transit Gateway

A

Transitive peering between thousands of VPCs and on-premise. Is a hub-and-spoke connection.

26
Q

How to configure Transit Gateway Cross Account

A

Share Transit Gateway using Resource Access Manager (RAM)

27
Q

IP Multicast in AWS

A

Only Transit Gateway allows to send IP datagrams to a group of interested receivers in a single transmission.

28
Q

A single internet exit point

A
  • Create a central NAT Gateway in a public subnet
  • Create an ENI in a private subnet to which Transit Gateway redirects traffic
  • Connect all VPCs to a Transit Gateway
  • Create Routing Tables to direct traffic to the NAT Gateway
29
Q

Direct Connect Gateway and Transit Gateway

A

Is possible to connect one direct connect gateway to multiple transit gateways in different regions

30
Q

Transit Gateway Peering Attachments

A

You can do an intra-region or inter-region peering mesh. If data go cross-region it has standard charges.

31
Q

VPC Endpoints

A

Allow you to connect to AWS services using a private network

32
Q

VPC Endpoint Gateway

A

For S3 and DynamoDB
* One gateway per VPC
* Must update route tables entries
* DNS resolution must be enabled in VPC

33
Q

VPC Endpoint Interface

A

For all services,
* Provision an ENI that will have a private endpoint interface hostname
* Must be in a subnet
* Enable private DNS so public hostname of a service will resolve to de private endpoint interface hostname
* Can be accessed from Direct Connect and VPN

34
Q

VPC Endpoint Gateway troubleshooting

A
  • Check SGs outbound rules
  • Check VPC endpoint policy
  • Check route tables
  • Check DNS resolution is enabled
  • Check S3/Dynamo policy
35
Q

Private Link

A

Secure way to expose a service to other VPCs without peering, internate gateway or NAT.
* Requires a NLB on the service side and an ENI on the consumer side

36
Q

Connect to S3 with Direct Connect

A

In a VPC create a PrivateLink to which DirectConnect sends traffic. From there direct it to a Interface VPC Endpoint and to S3.

37
Q

Site to Site VPN configuración

A
  1. On-premise setup a VPN appliance accessible using a public IP
  2. On AWS setup a Virtual Private Gateway and attach it to a VPC
  3. On AWS setup a Customer Gateway pointing to the VPN appliance
38
Q

Site to Site VPN and Direct Connect Internet Access

A

It is not possible to connect a S2S VPN and Direct Connect to an Internet Gateway through a NAT Gateway. Must use a NAT Instance

39
Q

AWS VPN CloudHub

A

Connect up to 10 Customer Gateways to a Virtual Private Gateway

40
Q

AWS Client VPN

A

Connect from a computer using OpenVPN to a private network on AWS

41
Q

Direct Connect Gateway

A

Setup a Direct Connect to one or more VPCs in different regions. Can also be used to connect to a Transit Gateway.

42
Q

Border Gateway Protocol

A

Set of rules that determine the best network routes for data transmission on the internet

43
Q

Direct Connect

Virtual Interfaces (VIF)

A

Enable access to AWS services public VIF or private VIF. A transit VIF is used to access one or more Transit Gateways associated with Direct Connect gateways

44
Q

IPv4 for existing VPCs and subnets

A
  1. Associate an IPv6 CIDR block with your VPC and subnet
  2. For a public subnet, create a route that routes all IPv6 traffic from the subnet to the internet gateway. For a private subnet, create a route that routes all internet-bound IPv6 traffic from the subnet to an egress-only internet gateway.
  3. Update your security groups rules
  4. Assign IPv6 addresses to your instances
45
Q

Egress-only internet gateway

A

Allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection.

46
Q

Egress-only internet gateway vs NAT gateway

A

An egress-only internet gateway is for use with IPv6 traffic only. To enable outbound-only internet communication over IPv4, use a NAT gateway instead.

47
Q

Keep a static MAC Address in an EC2 instance

A

If a static MAC address is assigned to an Elastic Network Interface it remains unchanged

48
Q

VPC Routing Enhancement

A

Any traffic from within a VPC destined to a target within the VPC is covered by the local route and therefore directly routed. The enhancement allows you to configure specific routes at a subnet route table level or replace target for the “local” destination with a middlebox such as firewall.

49
Q

Virtual appliances to handle traffic filtering and provide security inspection capabilities

A
  1. Gateway Load Balancer is deployed in a separate security VPC along with the virtual appliances. Because GLB endpoints are a routable target.
  2. To ensure flow symmetry, appliance mode is enabled on the Transit Gateway

AWS Solutions Architect Professional (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions