Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Associate Solution Architect > Networking - VPC > Flashcards

Networking - VPC Flashcards

1
Q

What are the 3 common private IP ranges?

A

10.0.0.0
172.16.0.0
192.168.0.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the maximum number of VPCs allowed per region?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How many different CIDRs can you have per VPC?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How many addresses does Amazon reserve in each subnet’s range?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the suffix for the IP address that is the broadcast address in a subnet?

A

.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does an internet gateway do?

A

Allows resources in a VPC to connect to the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a bastion host?

A

An EC2 instance in a public subnet that allows users to connect to private instances with SSH from a public place.
Normally allows connection access from the public CIDR of your organisation (NOT everyone)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a NAT instance?

A

A routing server that sends traffic from private EC2 instances onwards to the internet from a public subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the downsides of a NAT instance?

A

It is not highly available and resilient out of the box
Have to manage the associated security groups and rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What other service does a NAT gateway require to perform its function?

A

An internet gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a NAT gateway?

A

An AWS managed NAT service that has high availability, bandwidth and no requirement for an admin management out of the box

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

At what level do NACLs exist?

A

The subnet level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

At what level do security groups exist?

A

The specific instance level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Which of NACLs and security groups have both allow and deny rules?

A

NACLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Which of NACLs and security groups have rules that are evaluated in order?

A

NACLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is VPC peering?

A

When two VPCs are connected privately through the AWS network, making them behave as if they were part of the same single VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Is VPC peering transitive? What does this mean?

A

No. This means that if A and B are peered, and B and C are peered, A cannot connect to C ‘through’ B.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What capability do VPC endpoints enable?

A

Allow your instances to go through the private AWS network to connect to resources as opposed to using the public internet

19
Q

What is an interface endpoint?

A

A type of VPC endpoint that provisions an ENI as an entry point to the network.
Supports most AWS services
Pay per hour and GB of data processed

20
Q

What is a gateway endpoint?

A

A type of VPC endpoint that provisions a gateway that supports only DynamoDB and S3.
Free!

21
Q

What services would you use to capture information about IP traffic going into your interfaces for different levels within your infrastructure?

A

VPC flow logs - VPC level
Subnet flow logs - Subnet level
Elastic Network Interface flow logs - Instance level

22
Q

What are the two gateways on either side of a site to site VPN connection?

A

Customer gateway on the customer side (software or hardware that enables the connection)
Virtual private gateway on the AWS side

23
Q

What is the name of the service that enables a low cost hub-and-spoke model for multiple customer gateways?

A

VPN CloudHub

24
Q

Do site-to-site VPNs go over the internet?

A

Yes, but they are encrypted

25
Q

What is the name of the hardware-based VPC and on-premises connection service?

A

Direct Connect

26
Q

What are the two types of Direct Connect connections? What are the differences?

A

Dedicated and hosted connections.
Dedicated is much higher throughput max and is dedicated to one user, hosted is lower throughput max., but can be scaled up and down

27
Q

What is the throughput maximum of a dedicated DX connection?

A

100Gbps

28
Q

What is the throughput maximum of a hosted DX connection?

A

10Gbps

29
Q

What types of virtual interfaces are needed for a Direct Connect connection to enable access to public and private resources in your VPC?

A

Public virtual interface for public, private for private

30
Q

Is data in transit encrypted by default for Direct Connect connections?

A

No, but the connection itself is private

31
Q

What service would be suitable for transitive peering between 1000s of VPCs?

A

Transit Gateway

32
Q

At what geographical level do Transit Gateways operate?

A

Regional

33
Q

What is equal cost multi-path routing?

A

A routing strategy that allows you to forward a packet over multiple best paths

34
Q

How does equal cost multi-path routing relate to transit gateways?

A

Transit gateways enable ECMP routing over multiple site-to-site VPNs to increase the bandwidth used to connect with AWS at a higher cost

35
Q

What is VPC traffic mirroring and why might one use it?

A

Allows you to duplicate network traffic for storage or analysis in a non-intrusive way, e.g. to put the traffic through security applications running on EC2 instances that inspect it and make sure it is ok

36
Q

Can an internet gateway support both IPv4 and IPv6?

A

Yes

37
Q

Can an egress-only internet gateway support both IPv4 and IPv6?

A

No! Only supports IPv6

38
Q

What is an egress-only internet gateway?

A

An internet gateway that only allows data to flow out, but doesn’t allow data ingress

39
Q

Is data moving between instances in the same AZ paid?

A

No

40
Q

If you are moving data between two instances using their elastic IPs, would you pay data egress charges for the data moving over the internet?

A

Yes, because you are using the public addresses (elastic IPs) and therefore the traffic is technically leaving the VPC, going through the internet and then coming back in, using private IPs would literally halve the cost

41
Q

What is the rule of thumb in terms of the cost of data ingress and egress for AWS?

A

Ingressing data tends to be free, egress is paid

42
Q

Why can VPC endpoints be cheaper to use than NAT gateways?

A

Because they enable us to transfer data without having to egress from the AWS network

43
Q

What is the AWS network firewall used for?

A

To protect your entire Amazon VPC from layer 3 to layer 7 in a centralised manner with 1000s of rules available based on IPs, ports and protocols

AWS Associate Solution Architect (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions