Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

2019 - AWS CSOA > Networking > Flashcards

Networking Flashcards

1
Q

What configuration needs to be done on a NAT instance for it to be able to do NAT?

A

Disable Source/Destination check on the instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Where does the NAT instance need to be placed? In a private or public subnet?

A

NAT instances must be in a public subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What needs to be done on the private subnet for it to be able to use a NAT instance in the public subnet?

A

There must be a route out of the private subnet to the NAT instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What depends on the amount of traffic that NAT instances can support?

A

It depends on the NAT instance size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How can high availability for the NAT instance be achieved?

A

You can create high availability using Auto Scaling groups, multiple subnets in different AZs, and a script to automate failover.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What security consideration do I need to have with NAT instances?

A

The NAT instance must be behind a security group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the advantages of NAT Gateways over NAT instances?

A
  • Scale automatically up to 10Gbps - No need to patch - Not associated with Security Groups - Automatically assigned a public IP address - No need to disable Source/Destination checks (do need to update the route tables of course) - More secure than NAT instances
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is allowed/disallowed in the default network ACL of a VPC?

A

By default, it allows all outbound and inbound traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does a subnet need to be associated with an network ACL?

A

Yes. If you don’t explicitly associate a subnet with a network ACL, the subnet is automatically associated with the default network ACL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can a subnet be associated with multiple network ACLs?

A

No, only with one. When you associate a network ACL with a subnet, the previous association is removed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Can an ACL be associated with multiple subnets?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do the rules of a network ACL work?

A

Network ACLs contain a numbered list of rules that is evaluated in order, starting with the lowest numbered rule.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Are network ACLs stateful or stateless?

A

Stateless. Responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa). Network ACLs have separate inbound and outbound rules, and each rule can either allow or deny traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Can I block specific IP address with Security Groups or network ACLs?

A

Block IP addresses with network ACLs, not Security Groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many public subnets are needed to deploy an application load balancer?

A

At least 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Can I enable Flow Logs for VPCs peered with my VPC?

A

Only if the peered VPC is in my account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Can I tag Flow Logs?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Can I change a VPC Flow Log configuration after its creation?

A

No (example: can’t associate a different IAM role)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What traffic is not monitored in VPC Flow Logs?

A

The following traffic is not monitored. - Traffic from instances to Amazon DNS servers. - Traffic generated by a Windows instance for Windows license activation. - Traffic to and from 169.254.169.254 for instance metadata. - DHCP traffic. Traffic to reserved IP address for the default VPC router.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How many Internet Gateways can I attach to my custom VPC?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Are you permitted to conduct your own vulnerability scans on your VPC without contacting AWS first?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Are network ACLs a layer of security for instances or subnets?

A

Security Groups act like a firewall at the instance level, whereas network ACLs are an additional layer of security that act at the subnet level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

By default, how many VPCs am I allowed in each region?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Can a subnet span multiple AZs?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Which is a chief advantage of using VPC endpoints?

A

Traffic between your VPC and the other service foes not leave the Amazon network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is created automatically when a VPC is created?

A
  • Security Group - Network ACL - Route Table
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which suffix offers the largest range of internal IP addresses? (/16, /20, /24, /28)

A

/16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

When peering VPCs, can I peer with VPCs in another account?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

By default, can new subnets in a custom VPC communicate with each other across AZs?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How to allow an application in a custom VPC to communicate back to an on-premise data center?

A

Either: - Using a site-to-site VPN (requiring the VPC to have an Internet Gateway attached), or - Using Direct Connect The VPC in which the application sits, must be configured so that it does not have an IP address range that conflicts with that of the on-premise VLAN in which the back-end services sit.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is Customer Gateway?

A

An Amazon VPC VPN connection links your data center (or network) to your Amazon VPC virtual private cloud (VPC). A customer gateway is the anchor on your side of that connection. It can be a physical or software appliance. The anchor on the AWS side of the VPN connection is called a virtual private gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is a Virtual Private Gateway?

A

An Amazon VPC VPN connection links your data center (or network) to your Amazon VPC virtual private cloud (VPC). A virtual private gateway is the VPN concentrator on the Amazon side of the VPN connection. You create a virtual private gateway and attach it to the VPC from which you want to create the VPN connection. A customer gateway is the anchor on your side of that connection. It can be a physical or software appliance.

33
Q

Are these valid options to combine and configure to establish a successful site-to-site VPN connection from your on-premise network to an AWS VPC? - An on-premise Customer Gateway - A private subnet in your VPC - A Virtual Private Gateway - A VPC with hardware VPN access

A

Yes

34
Q

Which IPs in each subnet’s CIDR block are reserved by Amazon?

A

AWS reserve both the first four and the last IP addresses. First four: - 10.0.0.0: Network address. - 10.0.0.1: VPC router- - 10.0.0.2: DNS… - 10.0.0.3: Future use. Last: - 10.0.0.255: broadcast.

35
Q

Does the private IP address associated with an EC2 instance remains associated when the instance is stopped and restarted?

A

Yes. The private IP address remains associated with the network interface when the instance is stopped and restarted and is released when the instance is terminated.

36
Q

Does the public IP address associated with an EC2 instance remains associated when the instance is stopped and restarted?

A

No. We release the public IPv4 address and assign a new one when you restart it. The instance retains, however, its associated Elastic IP addresses (if any).

37
Q

At what levels can VPC Flow Logs be created?

A
  • Network interface levels - Subnet - VPC
38
Q

Which component allows me to SSH or RDP into an EC2 instance located in a private subnet?

A

Bastion Host

39
Q

Can a subnet span AZ’s ?

A

No

40
Q

NAT gw characteristics?

A

Redundant inside AZ preferred by enterprise No patching Not associated with security groups automatically assigned a public IP No need to disable source and destination checks

41
Q

Can a NACL be associated with multiple subnets?

A

Yes, but a subnet can only be associated with one ACL

42
Q

Can you enable VPC flow logs for peered VPC’s?

A

Only if the the peered VPC is in your account

43
Q

Can you tag a flow log?

A

No

44
Q

Can you change a flow log configuration after its created?

A

No. You can associate a different IAM role

45
Q

What is not logged in VPC flow logs?

A

DNS traffic, windows licensing, and 169.254.169.254, DHCP, traffic to default VPC router

46
Q

What is direct connect?

A

connect your DC to AWS Useful for high throughput and need stable secure connection

47
Q

What can you use to connect your VPC to some AWS service privately without a gateway, NAT, VPN connection or AWS direct connection, without traffic leaving the AWS network?

A

VPC endpoint

48
Q

What are the two types of VPC end points?

A

Interface and Gateway

49
Q

What services do gateway endpoints support?

A

Amazon S3 DynamoDB

50
Q

Does Route53 require region selection?

A

No

51
Q

What is an A record?

A

Is the fundamental type of DNS record (A stands for Address). Translates a domain name to an its IP address.

52
Q

What is a CNAME record?

A

Canonical Name. It’s a record that can be used to resolve one domain name to another.

53
Q

What is an Alias record?

A

Alias Record are a record type created by Amazon for AWS, similar to CNAMEs, but with the difference

54
Q

How do you find the IP address for an ELB?

A

ELB’s do not have pre-defined IPv4 addresses, you resolve to them using a DNS name.

55
Q

Which one will be preferred “always”? A CNAME or an Alias record?

A

Always choose an Alias record over a CNAME

56
Q

How can you map a naked domain name (zone apex) to an ELB?

A

Using an Alias Record, which allows to resolve a naked domain name (a zone apex record) to an ELB DNS address.

57
Q

Are there charge differences between CNAMES and Alias record?

A

Yes. CNAMEs are charged, Alias records are free.

58
Q

What is the first step of using Route53?

A

Create a Hosted Zone

59
Q

What are the available routing policies in Route53?

A

Simple Weighted Latency Failover Geolocation

60
Q

How does the Weighted routing policy work?

A

Weighted Routing Policies let you split your traffic between regions based on different weights (traffic percentages) assigned (ex: 30% to US-EAST-1, 70% to US-WEST-1)

61
Q

How does the Latency routing policy work?

A

Latency based routing allows you to route your traffic based on the lowest network latency for your end user (i.e. which region will give them the fastest response time)

62
Q

How does the Failover routing policy work?

A

Failover routing policy are used when you want to create an active/passive set up (Route53 will monitor the health of the primary site using a health check)

63
Q

How does the Geolocation routing policy work?

A

Geolocation routing lets you choose where your traffic will be sent based on the geographic location of your users.

64
Q

Does Route53 supports MX records?

A

Yes (A, CNAME, MX, NS, SOA,…, AAAA, NAPTR, PTR, SPF, SRV and TXT)

65
Q

Why is Route53 named so?

A

The DNS port is 53

66
Q

Does Route53 support zone apex records? (naked domain names)

A

Yes

67
Q

Is there a limit in the number of domain names that you can manage using Route53?

A

There is a soft limit of 50 domain names, however this limit can be raised by contacting AWS support.

68
Q

How long can it take to register a domain?

A

up to 3 days

69
Q

How does a simple routing policy work?

A

one record with multiple IP’s. R53 will randomly return values

70
Q

Can you resolve an ELB by IP address?

A

No, it will always be a DNS name

71
Q

What happens if a record fails a health check?

A

record will be removed until it passes

72
Q

What is the maximum size of a VPC subnet?

A

/16

73
Q

What is the minimum size of a VPC subnet?

A

/28

74
Q

How many IP addresses does AWS reserve?

A
75
Q

What version of direct connect is used to connect VPC 2 VPC?

A

Direct connect gateway

76
Q

When should yuo select direct connect gateway?

A

When you need the reliability and security of direct connect to connect to another VPC in another region

77
Q

What HTTP status code should be returned for R53 to indicate healthy resources

A

2XX, 3XX

78
Q
A

2019 - AWS CSOA (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions