Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Sysops > Networking > Flashcards

Networking Flashcards

1
Q

What IP ranges can be used?

A

/16 (65532) to /28 (16)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What IPs are reserved and for what purpose?

A 
.0 -> Networking
.1 -> VPC Router
.2 -> DNS Server
.3 -> Future use
.255 -> Broadcasting (reserved to not allow the user)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the parts of an ENI?

A 
One or more IPv4 address
One or more IPv6 address
Security Groups
MAC address
Source/Destination checks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is eth0?

A

The primary network interface

Cannot be detached from the instance. But there can be additional network interfaces. (up to a limit)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What needs to be considered using an Elastic IP?

A
  • IPv6 is not supported (atm)
  • When associating an EIP the currently attached IP will be send back to the IP pool
  • The DNS host name will be changed
  • Theres no charge for using an EIP but a charge when it is not used
  • It is regional
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are VPC Flow Logs?

A

Captures information of IP traffic in/out of the network.

Can be retrieved in the CloudWatch Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the advantages of Direct Connect?

A
  • Reduces bandwith costs
  • Consistent network performance
  • Private connectivity to AWS
  • Network scaling possibilities
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How to set up Direct Connect?

A
  1. Submit Connection Request
  2. Download and send Letter of Authorization and Connecting
  3. Create Virtual Interface
  4. Download Router Configuration
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Options for a VPN?

A
  • Virtual Private Gateway
  • VPN CloudHub
  • Software VPN
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Functions of Route53?

A
  • Register domain names
  • Route internet traffic to the resources to the domain
  • Check the health of the resources
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the three types of health checks?

A
  • Health of a specific resource, like web servers
  • Status of CloudWatch alarms
  • Status of other health checks
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Can you have a CF distribution with your own domain?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are Regional Edge Caches?

A

Between Origin and Edge Location.

Larger Cache with longer caching times

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What can be an Origin Server?

A

AWS resources such as S3, EC2, Elastic Load Balancing.

Or something outside of AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is Private Content in CloudFront?

A

Enables to set access rights for the users, like signed URLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is Device Detection

A

Detects the device and therefore can deliver different content based on that

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Geo Targeting?

A

Detects the country and can deliver content based on that

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How are Query String Parameters handled in CF?

A

Per default query parameters are not used for the origin - it can be configured to use those

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Object Versioning and Cache Invalidation?

A

Object Versioning: New Filename each time, so until deleted the old version is still online
Cache Invalidation: Old version is removed and replaced by the new version

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is Zone Apex Support?

A

You can use your own domain for the distribution

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the primary cause(s) of an EC2 network bottleneck?

A

Geographical proximity, EC2 instance size, and lack of enhanced network features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What AWS VPC feature would you choose to connect and improve network performance between two VPCs without transiting the public internet?

A

VPC Peering is a way to connect two VPCs and improve network performance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What information does a VPC Flow Log capture?

A

VPC Flow Logs capture IP traffic as metadata for a VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What connection speeds does AWS Direct Connect provide?

A

1 Gbps

10 Gbps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What step is used to assign an Elastic IP (EIP) to an instance?

A

Association is the step used to assign an EIP to an instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Which of the following does a dedicated connection require?

Single-mode fiber
Dual-mode fiber

A

Single-mode fiber

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Which of these is not a benefit of SSL Offloading?

Scalable HTTPS/SSL from a singular point
Improved networking
Ease of certificate management
Increased processing performance with SSL

A

SSL Offloading does not lead to improved networking.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Which of these is not a benefit of Amazon CloudFront?

Increased CPU performance
Increased network performance
High transfer speeds from the origin
Low latency

A

Amazon CloudFront is a CDN, and it does not increase the CPU performance of an instance. The instance workload may lessen due to the request of cached content from CloudFront, but this does not mean the CPU performance of an instance has been increased.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Which three make up the components of a load-balancer?

A

Load-balancer, Target Group, and Listener

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Which three are the components of an AWS VPN?

A

VPN Connection
Customer Gateway
Virtual Private Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What can the ALB do that the Network LB cannot?

A

Look at the content of a package (for example the header) and make decisions based on it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

When should you pre warm your LB and how?

A

When there’s a planned spike in Traffic you can contact AWS to increase the capacity of your LB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What should be done when a 460 client closed connection error occured?

A

The user should increase the timeout

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Describe the three placement group types and their advantages

A

Cluster: all Instances are in one AZ and have a 10GBs connection
Partition: Instances are created in segments, all located in separate racks (and can be in multiple AZs) - for distributes workloads
Spread: Each instance is in a separate rack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What is a Cache-Hit-Ratio?

A

Number of request served by the cache, compared to the origin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What can be done to have a better Cache-Hit Ratio?

A
  • Longer cache time
  • Query Parameter cache (beware: they are case sensitive)
  • Caching based on cookie values
  • Caching based on Request Header
  • Remove Accept-Encoding Header (when no need for compression)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the two types of VPC endpoints?

A

Interface endpoint: powered by AWS PrivateLink

Gateway endpoint: S3/Dynamo DB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

When connection two VPCs, how many Peering connections are needed?

A

Just one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is Dual-Stack mode?

A

It runs IPv4 and IPv6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What is Connection Draining?

A

A setup done in the console or CLI that causses the LB to stop sending request to unhealty instances, but makes sure that already existing connections are handled correctly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does “instance-monitoring Enabled=true” do on an auto scaling group

A

Enabling “detailed monitoring”, if “false” than normal monitoring is used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How can you connect on-prem servers with an ELB?

A

With direct connect or via a VPN

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What is content-based routing?

A

Giving traffic to Target Gorups based on header information, such as the route /images or /forum

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is a Slow Start

A

New instances behind an ELB do not get as much traffic as older instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

ELB: What is a listener?

A

Handles requests based on conditions, such as ports or protocols.

An ELB has at least one listener

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

ELB: What is a target group?

A

A set of resources the LB directs traffic to. Sits behind the listener

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

ELB: What is a rule?

A

Defines rules on which target group the LB should direct traffic to, such as HTTP method or incoming IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

ELB: What is an ELB node?

A

For every AZ an ELB directs traffic to a node has to be set (this is done by selecting the AZs traffic wil be directed to)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

ELB: What are the options to set a certificate to the LB?

A

1) Choose a certificate from ACM
2) Update a cert. from ACM
3) Choose a cert from IAM
4) Upload a cert from IAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

ELB: How is a request handles with HTTPS as the listener?

A

The encrypted request is terminated on the LB and then encrypted again using a different certificate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

ELB: What is a “step scaling policy”?

A

policy that dictates different levels of scaling based on different utilization levels of a metric you’ve selected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

VPN: What are the parts of an AWS managed VPN?

A

Cloud: Virtual Private Gateway
Connection: Tunnel via IPSec
On-Premise: Customer Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

VPN: What is the Transit Gateway?

A

Central hub to connect multiple VPCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

VPN: What is the AWS VPN CloudHub?

A

Uses an Amazon VPC virtual private gateway with multiple customer gateways, each using unique BGP autonomous system numbers (ASNs). Your gateways advertise the appropriate routes (BGP prefixes) over their VPN connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

What is AWS PrivateLink?

A

AWS PrivateLink provides private connectivity between VPCs and services hosted on AWS or on-premises, securely on the Amazon network. By providing a private endpoint to access your services, AWS PrivateLink ensures your traffic is not exposed to the public internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

VPC: What makes a subnet public?

A

1) Internet Gateway - Subnet has a route (0.0.0.0/0) to the IG (igw-1234)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

VPC: What allows the subnets to talk to each other?

A

The local route in the Routes Table.
Destination: CIDR Range of the VPC (10.0.0.0/16 e.g.)
Target: local

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

NACL: What are the configurable attributes of in/outbout rules?

A 
Rule# (10 e.g.)
Type (HTTP)
Port (80)
Source(in) /Destination(out) (0.0.0.0/0)
Allow/Deny
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

What does stateful/stateless means for NACL/SG?

A

stateful: if inbound traffic is allowed, then the request can leave again
stateless: traffic can go in, but not out if not specified

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

What are the characteristics of a NAT Gateway (in terms of IPs, Subnet etc.)

A

It is located in a public subnet and has a public IP.
The private subnets that will use the NAT have a 0.0.0.0/0 destination route to the NAT Gateway (nat-012345)
The private subnets can only receive traffic after sending the request - the internet cannot directly talk to private subnets.
The Gateway is only accessible from the same AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

How to connect from a Bastion Host to an instance in a private subnet?

A

SSH with your key to the Bastion.

Use SSH Agent Forwarding to ssh into the private instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

VPN: How is the route for a VPN connection to a Customer Gateway configured?

A

Destination: [CG] - 192.168.0.0/16 e.g.
Target: [VPG] - vgw-12345 e.g.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

VPN: How are security groups configured for on premise networks?

A

The souce must reflect the IP / IP Range of the on premise network.
for example: HTTPS - 443 - 192.168.0.0/16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

VPN-Direct Connect: What is the difference between Private and Public Virtual Interfaces?

A

Private: Goes directly to the customers VPC
Publice: Can connect to “open” services like S3

65
Q

How to establish/configure a VPC Peering connection?

A

Destination is the other VPC and the target is the VPC-Connection (pcx-1234)
Every subnet that wants to send or receive traffic needs to have a route

66
Q

VPC: Can a VPC peer with two VPCs that have the same IP range?

A

It depends:
There is no check of the origin, so there cannot be a complete overlap.
But it would be possible if the route is more specified, with a /24 instead of a /16

67
Q

VPC: Can you attach more than one route table to a subnet and can you attach one route table to multiple subnets?

68
Q

VPC: What happens to a subnet that does not have an explicit route table attached?

A

It receives the main route table

69
Q

Routing: What is the “Longest Prefix Match” and when are they exluded?

A

The Routing happens for the most specific match.

When the local route collides with Route Propergation the static/non-propergated route has precedence

70
Q

What are the typical 4xx error codes? (in ELB)

A

400 Bad Request - Invalid request header
401 Unauthorized - user access denied
403 Forbidden - blocked by the firewall
460 - Client closed connection before LB can answer
463 - Request with too many IP addresses in X-Forwarded-For Header

71
Q

What are the typical 5xx error codes? (in ELB)

A

500 Internal Server Error - Error within the LB
502 Bad Gateway - Error from the target Server (closed connection or malformed response)
503 Service Unavailable - No answering servers
504 Gateway Timeout - Targets do not repsonse

72
Q

You would like to receive an alert if more than 3 of your application servers fail to respond to a basic health check by the Elastic Load Balancer. Which metric could you use to configure this?

A

UnHealthyHostCount

73
Q

You need to configure a load balancer with a static IP address, which of the following would you recommend?

A

Network Load Balancer

74
Q

You are running an application on a load-balanced group of 10 EC2 instances. Which of the following metrics would use to check how many of your application servers are available?

A

HealthyHostCount

75
Q

What are Source/Destination checks?

A

AWS checks if the traffic to an instance corresponse being the source or destination with the traffic it sends or receives.

This check must be disabled for a NAT instance since the recipient of the traffic is not the NAT instance

76
Q

How are rules evaluated in the NACL?

A

In order - the first fitting rule that fits will be taken

77
Q

How many NACLs can be attached to a subnet?

A

Only one.

If another NACL is attached, the old one will be removed

78
Q

On which three levels can a VPC Flow Log be created?

A
  • VPC
  • Subnet
  • Network Interface level
79
Q

What two resources are necessary to create a VPC Flow Log?

A
  • Role

- Log Group (created in CloudWatch)

80
Q

VPC Flow Log: What are the restrictions regarding VPC Peering?

A

Only possible if the peered VPC is in the same account

81
Q

VPN: What is necessary to concect multipleregions with a Direct Connection connection?

A

A Direct Connect Gateway behind the Virtual Private Gateway

82
Q

DNS: What is SOA?

A

Start of Authority

Contains administrative information, as well als the TTL for the DNS record

83
Q

DNS: What is the Name Server (NS)?

A

Service based on the Top-Level Domain to give a DNS Server to a Domain

84
Q

DNS: What is an “A Record”

A

Address Record
Translates Domain to IP
Can be at domain or subdomain level

85
Q

DNS: What is a CNAME?

A

Canonical Name
Is an alias to an A-Record
www.xyz.de -> xyz.de
m.xyz.de -> mobile.xyz.de

86
Q

DNS: What is an Alias Record?

A

Specific to AWS

Maps a domain to another DNS entry, for example a Load Balancer

87
Q

Route53: What is Multivalue Answer?

A

You give a list of (max.) 12 IPs, AWS checks the health of those and returns (max.) 8 as targets

88
Q

Which protocol does AWS Direct Connect use to share routing information?

A

The Border Gateway Protocol (BGP) is the protocol used within the Direct Connect service for sharing routing information from the router in your Data Centre to AWS and vice versa.

89
Q

VPN: What is Direct Connect Multi-Account Support?

A

Possiblity to use direct connect with multiple accounts (Test, Dev, Prod) as long as they are under one payer account (in AWS Organisations)

90
Q

Using a NAT Gateway, how is the routing set up?

A

0.0.0.0/0 NAT-ID in the private subnet

91
Q

Using a NAT Gateway, what changes have to be made for the security group (if not 0.0.0.0/0 is allowed)?

A

Add the subnet range to the allowed sources

Source 10.0.1.0/24 on port 80/443

92
Q

By recommendation: What are the main/custom route tables used for?

A

main: private subnet
custom: public subnet

93
Q

VPC: What is the Egress-only Internet Gateway?

A

A stateful gateway to provide egress only access for IPv6 traffic from the VPC to the Internet.

94
Q

VPC: What is a VPC Endpoint?

A

Enables private connectivity to services hosted in AWS, from within your VPC without using an Internet Gateway, VPN, Network Address Translation (NAT) devices, or firewall proxies.

95
Q

VPC: What are the different types of VPC endpoints available on Amazon VPC?

A

Gateway type endpoints are available only for AWS services including S3 and DynamoDB. These endpoints will add an entry to your route table you selected and route the traffic to the supported services through Amazon’s private network.

Interface type endpoints provide private connectivity to services powered by PrivateLink, being AWS services, your own services or SaaS solutions, and supports connectivity over Direct Connect. More AWS and SaaS solutions will be supported by these endpoints in the future. Please refer to VPC Pricing for the price of interface type endpoints.

96
Q

VPC: How do instances without public IP addresses access the Internet?

A
  1. Through a NAT gateway or a NAT instance
  2. with a hardware VPN connection or Direct Connect connection, instances can route their Internet traffic down the virtual private gateway to your existing datacenter. From there, it can access the Internet via your existing egress points and network security/monitoring devices.
97
Q

ELB: What happens to running instances if an ALB gets deleted?

A

Deleting a load balancer does not affect its registered targets. For example, your EC2 instances continue to run and are still registered to their target groups.

98
Q

What is Traffic Mirroring?

A

Direct access to the network packets flowing through your VPC by allowing you to mirror and forward them to another network interface in the same or another VPC in the same or another account.
Can be used for further monitoring and security appliances.

99
Q

What are the four layers of networking security

A
  1. VPC Route Table
  2. Subnet ACLs (NACL)
  3. ENI Security Groups
  4. Third-party host security features
100
Q

VPN: What is the Virtual Private Gateway?

A

Enables connectivity between the VPC and another network.

101
Q

What are the private IPv6 addresses?

A

Per default all IPv6 addresses are public

102
Q

How is the internet connection for a private subnet set up in a route table?

A

0.0.0.0/0 - NAT-GW ID

103
Q

What are the two (public / private) connection options for a VPN Gateway?

A

1) IPSec VPN Tunnel over the internet

2) private Direct Connect connection

104
Q

There are two VPC (A/B), how are the route tables set up for a peering connection?
VPC-A 172.16.0.0/16
VPC-B 10.0.0.0/16
Peering connection pcx-11112222

A

VPC A 172.16.0.0/16 Local
10.0.0.0/16 pcx-11112222
VPC B 10.0.0.0/16 Local
172.16.0.0/16 pcx-11112222

105
Q

How is inter-regional peering set up?

A

The same as for one region.

The region must be selected in the “Create Peering Connection” dialog

106
Q

Can you move an ENI to another instance?

A

Yes, as long as it is not the primary (eth0) ENI

107
Q

Where are Flow Log files stores and can be viewed?

A

In Cloud Watch Logs

108
Q

Is Direct Connect per default Highly Available?

A

No, the VPN gateway it uses in the VPC is, but the connection is not.
There need to be more than one line, ideally in two (+) regions

109
Q

What is CloudHub?

A

A VPN (gateway) that connects to multiple Customer Gateways

110
Q

What are the (three) functions of Route53?

A
  • Register domain names
  • Route internet traffic to resources based on rules
  • Check the health of resources (instances or LBs)
111
Q

Route53: What is “failover routing”?

A

There is a primary and a secondary resource.

In case of a failure the traffic is directed to the secondary

112
Q

Route53: What is an alias in Route53?

A

Instead of pointing to an IP Route53 can also route to:

  • CloudFront
  • Elastic Beanstalk Application
  • Elastic Load Balancer
  • S3 Bucket (for static website hosting)
  • Another Route53 resource record
113
Q

Route53: What are the three types of health checks?

A
  • Health of a specific resource (EC2 instance e.g.)
  • Status of a CloudWatch Alarm
  • Other health checks (Example: there are health checks on 5 instances, the checks sets an alert if 3 of them are in alert)
114
Q

CloudFront: What is the Cache Behavior?

A

Set of rules how to cache the request based on the request URL

115
Q

CloudFront: How to enable regional edge caches?

A

It is done automatically at no additional costs

116
Q

CloudFront: What is the shortest possible caching time?

A

0 seconds - all requests go to the origin

117
Q

CloudFront: How to keep response items small?

A

Use GZIP (if accept-encoding: gzip is sent in the header)

118
Q

CloudFront: What is the Default Root Object?

A

File that is sent when there is a request to the “root” url

119
Q

CloudFront: What is Zone Apex Support?

A

Using your one domain

120
Q

What is a private VIF?

A

The logical interface between the customer location and the AWS services inside the VPC

121
Q

How to get the public /private IP address from the metadata?

A

169.254.169.254/latest/meta-data/public-ipv4
169.254.169.254/1.0/
meta-data/local-ipv4

122
Q

What CIDR Range will be assigned to a IPv6 VPN?

123
Q

Can you add a secondary CIDR IP Range to a VPC?

A

Yes, as long as it does not overlap

124
Q

Does a VPC support “multicast”?

125
Q

Is IPv6 supported for VPC peering?

126
Q

Which of the following is true of an interface VPC endpoint? (Choose two.)
A. It supports TCP traffic.
B. It supports IPv6 traffic.
C. It supports UDP traffic.
D. It exists in only one availability zone.

A

It supports TCP traffic.

It exists in only one availability zone

127
Q

How can you restrict EC2 access to an S3 Bucket with a S3 Gateway Endpoint?

A

Create and add a security group, which specifies the S3 prefix list ID

128
Q

If using a IPv6 VPC, do you need to add a IPv4 CIDR as well?

129
Q

Which are the two options for connecting a site to AWS using Direct Connect?

A
  • dedicated connection between your
    equipment and AWS at a Direct Connect location or
  • a hosted connection from an AWS
    Direct Connect Partner
130
Q

What is the difference between Public / Private and Transit virtual interface?

A
  • A public virtual interface allows you to use public AWS endpoints over a Direct
    Connect connection.
  • A private virtual interface is used for connecting to a VPC.
  • A transit
    virtual interface is only for use with an Amazon VPC Transit Gateway.
131
Q

How many VPN connections can you create to a single VPC?

A

You can have up to 10 VPN connections to a VPC.

132
Q

How can you decrease the network overhead of a Direct Connect connection?

A

Using jumbo frames can decrease network overhead by allowing more data to be
sent across the connection in a single frame.

133
Q

How many routes are you allowed to advertise in a BGP session over a Direct Connect
connection over a private virtual interface?

A

You can advertise up to 100 routes over each BGP session over a private virtual interface.

134
Q

What happens if you advertise more than 100 routes over a BGP session over a Direct
Connect private virtual interface?

A

The oldest routes will be discarded to bring the total number of routes to 100 or
fewer

135
Q

You have a VPN connection and a Direct Connect connection between your datacenter
and a VPC. BGP sessions on both connections have the exact same prefixes. Which
connection will be preferred?

A

Direct Connect

136
Q

What are two differences between CloudHub and Direct Connect Gateway?

A
  • CloudHub connects on-premises networks (via a VPN or Direct Connect link) and
    VPCs in only one region.
  • Direct Connect Gateway connects on-premises networks and
    VPCs in any region.
137
Q

What’s the maximum number of Direct Connect dedicated connections you can have per
link aggregation group?

138
Q

You have an EC2 instance with a global unicast IPv6 address assigned. How can you
ensure that hosts on the Internet are able to resolve the IPv6 address of the instance?

A

Create a publicly resolvable AAAA record that points to the instance’s IPv6 address

139
Q

Your EC2 instance in the us-east-1 region is assigned the public IP address 203.0.113.25.
Whichis the DNS hostname?

A

ec2-203-0-113-25.compute-1.amazonaws.com

140
Q

. You created a default VPC and made no other changes to it. Which of the following is true
of an EC2 instance launched into this default VPC? (Choose two.)
A. Its primary private IP address has a /16 CIDR.
B. It’s in a public subnet.
C. It has a public IP address.
D. It has no outbound access

A

B. It’s in a public subnet.

C. It has a public IP address.

141
Q

Using a virtual private gateway, you’ve created a site-to-site VPN connection between a
VPC subnet and a datacenter. When creating routes to datacenter subnets, what should you specify as the target in the route table?

A

Virtual private gateway

142
Q

What’s the maximum number of instance recovery attempts allowed per day?

143
Q

What does NODATA mean in a VPC Flow log?

A

NODATA is written to the end of a flow log record when there’s no traffic to log
during a 10-minute capture window.

If there were too much traffic to log, SKIPDATA
would appear instead.

144
Q

When trying to add an alternative domain name to a CloudFront distribution, you get an
“InvalidViewerCertificateException” error. What could be the reason?

A

The custom certificate you’ve provided isn’t signed by a trusted certificate
authority (CA)

145
Q

How to identify an RTMP distribution?

A

rtmp://s*.cloudfront.net

146
Q

When does a CloudFront edge location first fetch a file from an origin?

A

When the edge location receives a request for the file

147
Q

Which network protocol is supported by CloudFront?

148
Q

How can you enable Internet users to access a CloudFront distribution without allowing
public access to its origin S3 bucket?

A

Use an origin access identity.

149
Q

Can a non public S3 bucket be a origin?

150
Q

Can a public web server be an origin?

151
Q

Can you use publicly routable IP addresses in a Network Load Balancer?

A

no, only RFC 1918 or RFC 6598 addresses

152
Q

When browsing to the public URL of an application load balancer, users receive a “Bad
Gateway” error. The target group contains only EC2 instances. What could this indicate?

A

The target instance closed the connection from the load balancer e.g.
The error usually indicates that the load balancer received an unexpected response from
the target, such as a TCP reset or TCP FIN. The “Bad Gateway” error is generated by the
application load balancer, so receiving the error indicates users are able to connect to it.

153
Q

When browsing to the public URL of an application load balancer, users receive a
“Gateway Timeout” error. The target group contains only EC2 instances. What could this
indicate?

A

The “Gateway Timeout” error occurs when the target doesn’t respond.

154
Q

What services can you BYOIP?

A

NLB, EC2, NAT Gateway

155
Q 
Which of the following is the cheapest S3 encryption option?
A. SSE-KMS customer-managed CMK
B. SSE-KMS AWS-managed CMK
C. Client-side encryption using KMS
D. SSE-ACL
A

SSE-KMS with AWS-managed CMK

156
Q

What is “low jitter” and which service provides it?

A

Direct Connect provides consistent latency, also known as low jitter. I

157
Q

You have an EC2 instance with an elastic IP address associated with it.
IPv6 is enabled
in the instance’s public subnet.
How can you ensure that hosts on the Internet are able to
reach the instance via IPv6?

A

Assign a global unicast IPv6 address to the instance

158
Q

Which VPC attributes determines whether the Amazon DNS server is
enabled?

A

enableDnsSupport

Sysops (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions