Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

AWS Certified Solutions Architect Associate > Section 27: Networking - VPC > Flashcards

Section 27: Networking - VPC Flashcards

1
Q

A virtual network dedicated to your AWS account

A

Virtual Private Cloud (VPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

A range of IP addresses within a VPC

A

Subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How many VPCs can you have within a single AWS region?

A

Up to 5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

A redundant, horizontally scaled, and also highly available VPC component that allows communication between instances in your VPC and the internet

A

Internet Gateway (IGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

An object that contains a set of rules that determine where network traffic from your subnet or gateway is directed

A

Route Table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What type of EC2 configuration can you use if you want to allow users to access private EC2 instances from outside of a VPC?

A

Bastion Hosts

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Bastion Host security groups must allow inbound traffic from the internet on port ___ from restricted CIDR

A

22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

If you want to reach a private EC2 via a Bastion Host, then the Security Group of the EC2 must allow the Security group of the Bastion host or this other attribute?

A

Private IP of the Bastion Host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Device launched in a public subnet to enable instances in the private subnet to initiate outbound IPv4 traffic to the internet or other AWS services, but prevent the instances from receiving inbound traffic initiated on the internet

A

NAT Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Service that can be configured to allow instances in a private subnet to connect to services outside your VPC but external services cannot initiate a connection with those instances

A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Networking feature that allows or denies specific inbound or outbound traffic at the subnet level; its like a firewall which controls traffic to/from subnets

A

Network Access Control Lists (NACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

True/False: Network Access Control Lists are stateful so traffic does not have to be explicitly allowed or denied

A

False - They are stateless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

True/False: Network Access Control Lists support allow and deny rules

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network

A

VPC Peering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True/False: To utilize VPC Peering, each VPC must have VPC Peering enabled

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

This virtual device, powered by AWS PrivateLink, allows you to connect to AWS services using a private network instead of using the public internet

A

VPC Endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the two available types of VPC Endpoints?

A

Interface Endpoints
Gateway Endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

This type of VPC endpoint provisions an ENI as an entry point between private and AWS services

A

Interface Endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

A VPC endpoint type that serves as a gateway that you specify as a target for a route in your route table for traffic destined to a supported AWS service

A

Gateway Endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Which AWS Services do Gateway Endpoints support?

A

S3 and DynamoDB

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Is a Gateway Endpoint or an Interface Endpoint a better choice when picking a VPC Endpoint to access S3?

A

Gateway - It only requires modification of a route table to implement and it is free

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

A feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC

A

VPC Flow Logs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Which two gateways are needed to establish a Site-to-Site VPN connection?

A

Virtual Private Gateway
Customer Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In a Site-to-Site VPN configuration, if your Customer Gateway is behind a NAT device that has NAT-T enabled, then your Customer Gateway should use the ______ IP for the ________ device

A

Public; NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

A Site-to-Site VPN connection will not work until this feature is enabled for your Virtual Private Gateway in the route table that is associated with your subnets

A

Route Propagation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

In a Site-to-Site VPN configuration, if you need to ping your EC2 instances from on-premise, make sure you add this protocol on the inbound of the EC2 security group

27
Q

A service that uses a hub-and-spoke model to create a secure connection between a Virtual Private Gateway and multiple Customer Gateways

A

AWS VPN CloudHub

28
Q

A service that provides a dedicated private connection from a remote network to your VPC

A

Direct Connect (DX)

29
Q

If you want to setup a Direct Connect to one more more VPC in many different regions (same account), you must use a _______________

A

Direct Connect Gateway

30
Q

Direct Connect connection type that dedicates a physical ethernet port for a customer and provides up to 100 GBPS capacity

A

Dedicated Connection

31
Q

Direct Connect connection type where capacity can be added or removed on demand

A

Hosted Connection

32
Q

How long does it take for a Direct Connect connection to be established?

A

More than 1 month

33
Q

True/False: Data-in-transit is encrypted in a Direct Connect

A

False - It is not encrypted but the connection is private

34
Q

Resiliency mode for Direct Connect that can be described as “one connection at multiple locations”

A

Non-Critical Production Workloads or Development Workloads

35
Q

Resiliency mode for Direct Connect that can be described as “separate connections terminating on separate devices in more than one location”

A

Maximum Resiliency for Critical Workloads

36
Q

Service that connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub using a hub-and-spoke connection

A

Transit Gateway

37
Q

What networking feature would you use to limit which VPCs can communicate within a Transit Gateway?

A

Route Table

38
Q

This networking service supports IP Multicast

A

Transit Gateway

39
Q

Feature that allows you to copy network traffic from an EC2 Elastic Network Interface and send it to a supported target

A

VPC Traffic Mirroring

40
Q

Gateway that allows instances in your VPC to initiate outbound connections over IPv6 while preventing the internet to initiate an IPv6 connection to your instances

A

Egress-only Internet Gateway

41
Q

What two settings do you need to enable in your VPC if you want to use a Private DNS in Route 53?

A

DNS Resolution
DNS Hostnames

42
Q

How many IPs exist in CIDR 10.0.4.0/28?

43
Q

How many IPs exist in CIDR 10.0.4.0/32?

44
Q

How many IPs exist in CIDR 10.0.4.0/23?

45
Q

What is the maximum CIDR size of an AWS VPC?

46
Q

If you have a /27 CIDR subnet in an AWS VPC, how many EC2 instances can you create on it?

A

27 -> 32 total IP addresses exist in the range, but the first 5 are reserved by AWS

47
Q

You would like to provide Internet access to your EC2 instances in private subnets with IPv4 while making sure this solution requires the least amount of administration and scales seamlessly. What should you use?

A

NAT Gateway

48
Q

True/False: You must update the route tables for both VPCs if you are connecting them using VPC Peering

49
Q

A ________ Gateway is used mainly when you have a Direct Connect connection between a corporate data center and a VPC, but you want to access a separate VPC in a different AWS region.

A

Direct Connect

50
Q

Direct Connect type that supports 50Mbps, 500Mbps, up to 10Gbps.

51
Q

True/False: While using a Direct Connect connection, you can access both public and private AWS resources

52
Q

You want to scale up an AWS Site-to-Site VPN connection throughput, established between your on-premises data and AWS Cloud, beyond a single IPsec tunnel’s maximum limit of 1.25 Gbps. What type of gateway should you use to increase the throughput?

A

Transit Gateway

53
Q

What service can you use to provide secure communication between sites if you have multiple AWS Site-to-Site VPN connections?

A

AWS VPN CloudHub

54
Q

Term that refers to the cumulative network traffic that is sent through AWS Direct Connect to destinations outside of AWS (charged per GB)

A

Data Transfer Out (DTO)

55
Q

What are the four configurations supported by the Amazon VPC console wizard?

A

VPC with a single public subnet
VPC with public and private subnets (NAT)
VPC with public and private subnets and AWS Site-to-Site VPN access
VPC with a private subnet only and AWS Site-to-Site VPN access

56
Q

When considering EC2 networking, ___________ are stateful, so allowing inbound traffic to the necessary ports enables the inbound and outbound connection

A

Security Groups

57
Q

When considering EC2 networking, ___________ are stateless, so you must explicitly allow both inbound and outbound traffic

A

Network ACLs

58
Q

When creating a NAT Gateway, should it be created in a public or private subnet?

59
Q

True/False: You must associate an Elastic IP address to a NAT Gateway

60
Q

True/False: NAT instances support port forwarding

61
Q

True/False: NAT gateways support port forwarding

62
Q

VPC component that provides a target in your VPC route tables for internet-routable traffic and performs network address translation (NAT) for instances that have been assigned public IPv4 addresses

A

Internet Gateway

63
Q

True/False: Data transfer pricing over Direct Connect is lower than data transfer pricing over the internet

A

False - Data transfer pricing over the internet is more expensive than over Direct Connect

64
Q

What two VPC settings must you set to true if you want to associate it with a Route 53 hosted zone?

A

enableVpcSupport
enableVpcHostnames

AWS Certified Solutions Architect Associate (19 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions