Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

my aws study > Networking > Flashcards

Networking Flashcards

1
Q

Classful vs classless

A

A /8, B /16, C /24

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

CIDR

A

Classless inter domain routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

second VPC range cannot be bigger than the original range

A

Block size has to be between /16 and /28

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CIDR cannot overlap

A

with VPC, VPC peers, or on direct connect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

dual stacking

A

using both IPV4 and V6 on a host.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Two types of end points

A

Interface end point and gateway end point

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Interface end points

A

Are a virtual ethernet interface to connect AWS private link

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Gateway endpoints

A

are a target for a specific route in your route table. S3 and dynamoDB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

elastic network interface is different from elastic network adapters.

A

ENA is a custom interface used to optimize network performance on some interface types.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

3 types of placemnet groups

A 
cluster(low latency, high netk throughput)same AZ, 
Partition PG(workload not placed on different hw)
spread PG( small number of critical instances that needs to be kept away from each other high availability )
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

spread PG can have upto how many instances

A

7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Types of VPN connectivity

A

Site-to-Site
AWS Client VPN
AWS VPN CloudHub

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Site to site

A

IPSec VPN connection between a VPC and customer network. The AWS side of the network uses a virtual private gateway(VGW).. The VGW provides two different end points running of two different AZ for auotmatic failover.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AWS client VPN

A

Client managed. client based VPN service used to securely access AWS resources from your on premise network. Sessions are connected using a secure TLS VPN session and an open VPN based client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

AWS VPN CloudHub

A

If you have multiple remote customer offices the VGW can act as a hub for site-to-site communication between the networks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

VPN can be used in two ways

A

connect VPC to on-premise data center

Connect two different VPC’s in same or different regioun

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Site to site

A

IPSec VPN connection between a VPC and customer network. The AWS side of the network uses a virtual private gateway(VGW).. The VGW provides two different end points running of two different AZ for automatic failover. Note customer GW is a SPOF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

AWS client VPN

A

Client managed. client based VPN service used to securely access AWS resources from your on premise network. Sessions are connected using a secure TLS VPN session and an open VPN based client.
AWS Managed VPN or AWS client managed VPN. Connects over Internet gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

VPN can be used in two ways

A

connect VPC to on-premise data center

Connect two different VPC’s in same or different regioun

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

IKE

A

Internet Key exchange is a protocol used to manage keys used by IPSec hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

IKE vs IPSec

A

IKE UDP port 500

IPSec IP protocol 50

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

AWS client to site VPN

A

Client managed. client based VPN service used to securely access AWS resources from your on premise network. Sessions are connected using a secure TLS VPN session and an open VPN based client.
AWS Managed VPN or AWS client managed VPN. Connects over Internet gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Client-to-Site VPN connectivity gives clients the ability to connect to a variety of resources including the VPC

A

On-Premises site-to-site VPN, and Peer VPCs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Client to site VPN

A

user needs to install OpenVPN based client on their PC.

Establish a client VPN endpoint in AWS one in each AZ in a target within a VPC. The target is essentially a subnet within a VPC. In this case 2 subnets one in each AZ.
User gets access to VPC and peered VPC and onpremise networks across VGW, user gets access to the internet through IGW and public aws services like S3

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

site-to-site VPN routing options

A

static vs dynamic(BGP)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

VGW supports BGP configuration options

A

Autonomous systems prepends AND multi exit discriminator

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

VGW uses BGP over TCP port

A

179( the standard BGP port)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

The configuration of CGW

A

is provided by AWS and a list of pretested devices are available. The config requires 4 components

1) IKE security association
2) IPSec security association
3) Tunnel interface ( a /30 CIDR block)
4) BGP peering is optional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

AWS VPN CloudHub

A

provides a means of peer-to-peer communication between Customer Gateways.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

AWS VPN CloudHub

A

provides a means of peer-to-peer communication between Customer Gateways. You don’t need a VPC for CloudHub to function. It is a hub and spoke model. VGW functions as a passthrough. IP ranges however cannot overlap. to configure VPN HUB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Transitive routing is not supported in AWS between VPC Peers. Additionally, edge-to-edge routing is not supported. So how do we give on-premises users access to VPC Peer resources, without creating a VPN connection to each VPC

A

That’s where Tansit VPC are useful

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Transit VPC’s

A

run EC2 instances which enable software based VPN. This allows CGW can do edge to edge routing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

The VPN connection is not active until the traffic is generated from the customer side of the VPN connection

A

To keep the tunnel active initiate regular traffic, ICMP pinging. The tunnel will close if it idle for more than 10 seconds.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

health checks defaults

A

Response timeout 2-60 default 5
health check interval 5-300 default 30
unhealthy threshold 2-10 default 2
healthy threshold 2-10 default 10

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Benefits of ALB vs classic LB

A

1) Path based routing
2) Hos tbased routing
3) custom http response
4) Supports targets outside your VPC
5) Redirecting requests from one URL to another
6) Users may optinally be authenticated before rourting
7) Health checks are at target level. which allows auto scaling based on cloud wathc metrics
8) ALB supports AWS WAF
9) sticky sessions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Network load balancer is able to handle

A

millions of requests per second

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

NLB by default work with a single AZ.

A

DNS failover with Route53 is possible. The NLB will redirect to another AZ if all instances are unhealthy in a particular AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

NLB flows logs are sent to cloudwatch

A

access logs can be enabled to capture information about TLS connections that listener recieves. This provides visibility into successful and failed handshakes so that they may be reviewed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

with Classic Load Balancer you can specify your own application cookie

A

https://cloudacademy.com/blog/application-load-balancer-vs-classic-load-balancer/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

From edge location to S3 https is not supported

A

If your Amazon S3 bucket is configured as a website endpoint, you can’t configure CloudFront to use HTTPS to communicate with your origin because Amazon S3 doesn’t support HTTPS connections in that configuration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Cloud front access logs

A

logs requests and RTMP. An s3 bucket is required to store the logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

CF secrurity

A

custom headers can he used to make sure requests is originating only from CF. Origin can be configured to allow only requests which contain the custom origin

43
Q

CF can intgrated with

A

WAS, AWS Shield and Route53 to create security peremiter to protect against attacks and distributed to edge locations.

44
Q

Route53 supports 2types of zones

A

public and private

45
Q

BGP operates over

A

TCP 179 ensures reliable inter route communications

46
Q

Manual peering

A

no auto discovery by design. automatically shares routers between peers

47
Q

BGP is a path vector

A

not link state of distance victor

48
Q

BGP shares

A

best path to a destination with peers not every path

49
Q

BGP AS

A

Autonomous system a set of routers under a single technical administration

50
Q

two types of BGP

A

external BGP, internal BGP routers within a AS

51
Q

two types of BGP

A

external BGP, internal BGP routers within a AS

52
Q

NACL contains two implicit deny rule which denies all traffic one for inbound and another for outbound

A

But when you create a VPC a default NACL is created and that NACL has both inbound and outbound allow for all traffic. This is different when NACL is explicitly created.

53
Q

Ephemeral port range

A

Linux 32768-61000

FreeBSD 10000-65535

54
Q

SG’s have inbound and outbound rules

A

outbound rule by default allows all traffic which can be deleted

55
Q

Controlling access to VPCE via NACL is problematic use Security Groups instead

A

NACL focus on ip and CIDR ranges.

56
Q

Multiple VPCE’s within a VPC is fine even for the same service

A

If you want to control access by policies you can created different VPCE’s. All instances within a subnet has to use the same VPC. if you have to give different access to instances they should be in differenet subnets routing to different vpce.

57
Q

To create VPC you need to specify two things

A

THe VPC, the service to which it will be attached to and the policy(optional and unrestricted if nothing is specified).
By associating the vpce to a subnet the vpce end point is added to the subnet

58
Q

To create VPC you need to specify two things

A

THe VPC, the service to which it will be attached to and the policy(optional and unrestricted if nothing is specified).
By associating the vpce to a subnet the vpce end point is added to the subnet

59
Q

Why hybrid?

A

technical, business justification,
Reactive vs Proactive justification
Data center extension is mostly reactive in nature

60
Q

Three types of connections for hybrid

A

software VPN EC2 instances, Hardward VPN managed by AWS, Direct connect

61
Q

Direct connect location has

A

DX Router links to VGW in AWS via AWS backbone, Customer router

62
Q

direct connect

A

physical setup slow to setup,
No ongoing managemnet required
expensive than hw or sw VPN
Reduces bandwidth costs
Consistent netk latency and bandwidhth(1 & 10)
IPSec can be used to secure. sw or hw VPN

63
Q

one to one relationship between VPC and VGW

A

one VPC can have only one VGW and one VGW can have only one VPC

64
Q

Inputs for creating VPN

A

VGW, CGW, Routing options static vs dynamic, CIDR range for customer premises

65
Q

when you create a VPN, AWS creates two VPN end points for resiliency

A

CGW establishes connection with both the end points

66
Q

HW VPN

A

initiated frpm CPE, uses IKE pre shared keys. alternative to pre-shared is RSA certificate. However HW VPN does not support it,
AES 128 bit and sha1 hashing
Make sure device supports dead peer detection

67
Q

Route propogation preference

A

Most specific IP
direct connect learned routes
routes learned via static VPN
everything else BGP - shortest AS-PATH

68
Q

VPN end points and CGW uses ip range

A

169.254.59

69
Q

The port of the DX router is configured as 802.1q trunk which can carry multiple VLAN

A

AWS will then give you a LOA document

70
Q

LOA

A

Letter of Authority allows your network provided to connect a physical port on DX router to the physical port of the customer/partnet router
Over this connection you can create either a public or private connection

71
Q

DX connect relationship

A

AWS account( DX is owned by the account which created it)
It gets a DXconn ID
Speed(1G or 10Gig)
it gives a port of DX router.which is 802.1q trunk. Connect this port to the customer router. single mode fibre 1000Base-lx or 10Gig base lr

72
Q

LOA contains

A 
Issue date, Issued by, requested by, issued to, 
facility cage number
AWS DX ID
Rack, patch panel, port number
Cable Type
73
Q

LOA contains

A 
Issue date, Issued by, requested by, issued to, 
facility cage number
AWS DX ID
Rack, patch panel, port number
Cable Type
74
Q

When you use a partner for direct connect

A

the partner owns the cross connect between DX router and partner router

75
Q

When you order with a partner instead of a direct connect

A

You get a hosted connection which is created by the partner and shared with your account.. Only one VLAN is allowed with hosted connection. You have no control over VLAN assignment since it is preselected by your partner

76
Q

what is private VIF

A

A private virtual interface allows you to connect to your VPC resources (for example, EC2 instances, load balancers, RDS DB instances, etc.) on your private IP address or endpoint.

77
Q

public VIF

A

To connect to AWS public endpoints, such as an EC2 or S3, with dedicated network performance, use a public virtual interface

78
Q

Inputs required for private VIF

A

vgw, auto generate peer IP’s router peer IP , amazon router peer IP, BGP ASN( BGP key auto generate to configure customer router)

79
Q

public VIF

A

to avoid the disadvantages of accessing the public services via internet. Latency, inconsistent bandwidth and mainly internet data charges from AWS

80
Q

Inputs required to create public VIF

A

vgw is not required, router peer IP, amazon router peer IP cannot be auto generated since it needs publicly routable IP, vlan ID, BGP ASN

81
Q

QinQ 802.1ad VLAN stacking

A

Access port isn’t VLAN aware. traffic entering and leaving access port uses standard 802.3 which is standard ethernet

82
Q

802.3 Ethernet type2 frame

A

64-1518 bytes

83
Q

802.1Q add 4 bytes to header

A

64-1522bytes

84
Q

QinQ add ability to have multiple VLAN’s to a frame

A

64-1526bytes Supplier Tag and customer tag. Push and pop works on supplier tag

85
Q

root of the domain is aka

A

naked domain, apex of the domain
Standard says it has to be a A record. It cannot be a CNAME. This presents a problem. You can use CNAME on www.xyz.com But not a xyz.com. xyz.com should be a A record.

86
Q

Record sets have been introduced as A records

A

which names for an IP

87
Q

Alias recordsSets reference an Alias target

A

rather than a traditional DNS record

S3, loadbalancer, CloudFront

88
Q

split horizon DNS or split view DNS hosted zone

A

internal clients resolve the same DNS to internal IPs and external clients resolve to public IP’s

89
Q

+2 address used by the DNS server is not accessible outside the VPC

A

It can be solved by using a forwarder directory service

90
Q

conditional forwarders

A

use specific servers for

91
Q

DHCP

A

automatic dynamic configuration of machines.

Not just IP, subnet mask, local gw, DNS severs, wins servers, Time servers,

92
Q

DHCP. 4 phases, connectionless, UDP port 67 and 68

A

P1: discovery( client with its mask asking for a DHCP lease)
P2: Offer phase( DHCP servers checks MAC ), Offers a lease( starttime and endtime).
P3: DHCP request phase. picks an offer to lease
P4: Ackowledge phase

93
Q

Placement group limitations

A

Cannot span AZ, AZ is picked based on the AZ the first instance was created in the PG
Name is unique within your accout across all regions
Not all instance types are supported
Try and stick to same instance type
You can miove existing instances in PG
Transfer to and from PG is 5Gbps
Ideally launch all instances at the start
PG can work over VPC peers

94
Q

Can VPC Endpoints be combined to improve performance OR resiliency OR control

A

Yes. and use route table to control

95
Q

What is the minimum subnet size required to create an ELB

A

/27

96
Q

Can a public VIF be utilized to reach public services in regions OTHER than the one its connected to

A

Yes, but only in North American regions.. Only in North America are NON-local public ranges advertised over BGP.

97
Q

You have 3 VPCs: VPC-A (10.0.0.0/16), VPC-B (10.1.0.0/16) and VPC-C (10.1.0.0/16). You need to make sure that VPC-A can communicate with both. What options do you have.

A

2 Subnets in VPC-A are required, 1 RT per subnet, pointing at 2 different VPC peer objects.

98
Q

What information is required to setup a Direct Connect VIF/Peering Session

A

VLAN, Peer IP Addresses, BGP Config

99
Q

Are BGP Advertised routes learned by VPC Route Tables

A

Yes, if Route Propagation is enabled.

100
Q

A placement group can span AZ’s if the option is selected on creation. A placement group can span VPCs.

A

A Spread Placement group can span AZs to achieve the desired spread. While there will be a performance reduction, A Cluster Placement groups CAN span VPCs.

101
Q

When configuring a public VIF over a Direct Connect, which of the following statements is true

A

Public ASNs can be used, public peer IP addressing must be used.

102
Q

Jumbo frames are partially supported, a MTU of 1500 is required over DX links.

A

Outside the VPC, only 1500 L3 MTU and 1522 Layer 2 MTU are supported.

103
Q

NACL is not scoped to an ENI. But rather subnet

A

ENI can include

  • primary private ipv4 from the ip range in VPC
  • one or more secondary ipv4 …
  • one elastic ip address per private ipv4 address
  • one public ipv4 address
  • one or more ipv6 addresses
  • one ore more security groups
  • a MAC address
  • A source and destination check flag
  • a description

my aws study (23 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions