Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

aws saa-c03 > Virtual Private Cloud Basics > Flashcards

Virtual Private Cloud Basics Flashcards

1
Q

What is the minimum size of a VPC

A

/28 = 16 IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the maximum size of a VPC

A

/16 = 65356 IPs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What do services use with regards to VPCs

A

Subnets, not VPCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Should you use Bastion hosts

A

No, they are frowned upon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What type of service is VPC

A

Regional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Can data move in and out of VPC

A

Only with explicit config, otherwise no

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How many subnets does the default VPC have

A

One per AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a dedicated tenancy

A

Uses dedicated hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What happens if you pick dedicated at VPC level

A

All ressources in VPC must be on dedicated hardware

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What happens if you enabble DNS hostnames

A

Instances with public IPs have DNS names

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What happens if you enable DNS support

A

Enables DNS resolution in VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the address of the DNS in a VPC

A

Base + 2 (e.g. if VPC is 10.0.0.0, it would be 10.0.0.2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is the nuber-to-number relationship between subnets and AZs

A

Subnet only has one AZ
AZ has 0 or more subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Can subnets overlap

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many IPs in every subnet is reserved

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is the first address in a subnet

A

The network address, it cannot be used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the second address in a subnet

A

Network + 1 - VPC router, it moves data between subnets and in and out of VPC if configured to allow it

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the third address in a subnet

A

Network + 2 - Reserved for DNS. Technivally, it<s the 2nd adress ovf VPC and not subnet which is used, but this address is reserved in every subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the 4th address in a subnet

A

Network + 3 - Reserved for future use

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the last address in a subnet

A

It is the network broadcast address, it is reserved even if broadcast is not supported in VPCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What does DHCP stand for

A

Dynamic Host Configuration Protocol

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is DHCP

A

It is how computing devices receive IPs automatically

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What has a route table

A

Each subnet, and the VPC, the VPC route table is used as default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the number relationship between route tables and subnets

A

Each subnet has one route table, each route table can be associated with many subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the options for route tables of a subnet

A

Either the main VPC one, ort a custom one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

To what data does a route table apply

A

To the data leaving the subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Can local routes in a route tbale be edited

A

No, they are always there and uneditable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

How do you know if something is a local route

A

It matches the VPC IPv$ or 6 CIDR range

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How does a route table handle priorities

A

More specific (higher prefix value) = priority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

When is the default route used

A

When nothing else matches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What resiliency does an Internet Gateway have

A

Regional

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the number relationship between an internet gateway and a VPC

A

One to one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Where does an internet gateway run

A

From the AWS public zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What does an internet gateway do

A

It is a gateway for traffic between the vpc and the internet or aws public zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What type of service is an internet gateway

A

AWS-managed - AWS handles the performance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the steps to configure an internet gateway

A

1 : Create IG
2 : Attach IG to VPC (will make it available to route table)
3 : Create a custom route table
4 : Associate the route table to the dubnet
5 : Make the default route the IGW
6 : Configure the subnet to allocation public IPv4
Then the subnet is a public sbnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What kind of record does an internet gateway keep

A

A record linking a public and private IP (in IPv4 only)

38
Q

What IP does an EC2 instance see

A

Only its private IPv4 IP

39
Q

Is the OS on an EC2 instance ever aware of its public IPv4 address

A

No

40
Q

Is the OS on an EC2 instance ever aware of its public IPv6 address

A

Yes, since it is the same as the private one, all IPv6 address are publicly routable by default, the internet gateway does not need to do translation

41
Q

What is a Bastion Host / Jumpbox

A

An instance in a public subnet, to which incoming management connections are made, and can then access internal VPC ressources. Often the only way into a VPC (historically, now there are other ways)

42
Q

What does TCP stand for

A

Transport Control Protocol

43
Q

How many parts does a connection have

A

2 : request and response

44
Q

What is a stateless firewall

A

It is a firewall that sees a request and response as 2 individual parts

45
Q

What do you need to do about ephemeral ports when using a stateless firewall

A

Often have to open the full range, which is not great

46
Q

What is an advantage of stateful firewall

A

Less admin overhead, no need to allow ephemeral port range

47
Q

What does NACL stand for

A

Network Access Control List

48
Q

What is a NACL

A

A traditonnal firewall available for AWS VPCs

49
Q

What is a NACL associated with

A

A subnet

50
Q

What does a NACL filter

A

Traffic crossing subnet boundaries, in or out

51
Q

Are connections within a subnet impacted by NACLs

A

No

52
Q

Are NACL stateful or stateless

A

Stateless

53
Q

What do NACL rules match

A

IP/CIDR range, port, protocol

54
Q

What kinds of rules do NACL allow

A

Explicit allow and explicit deny

55
Q

In what order are NACL rules treated

A

Processed in order of rule number, lowest number treated first. Once a match occures, the processing stops.
There is an explicit deny for everything if no other rule matches

56
Q

Are rule numbers unique (for NACL)

A

They are unique per rule set

57
Q

Do you need inbound and outbound rules for NACL

A

Yes

58
Q

Do VPCs have NACL by default

A

Yes, it allows all

59
Q

What are custom NACLs

A

You create them, by default they are not associate dwith any VPC. They start off with only a deny all`

60
Q

What can only NACLs do

A

Explicit deny

61
Q

How would you usually divide security between a security group and NACL

A

Use security gorup to allow and NACL to deny

62
Q

What is the number to number relationship between NACL and subnet

A

One subnet can only have one NACL, but a NACL can be associate dto multiple subnets

63
Q

What is the difference between Security Groups and NACL

A

Security Gorups are stateful

64
Q

Do security groups have explicit deny

A

No, they only have allow and implicit deny

65
Q

What are Security Goups attached to

A

ENIs (Elastic Network Interfaces)

66
Q

Which ENIs are Security Groups attached to

A

The primary ENI of an instance

67
Q

What is the best practice to allow a web-tier server to connect to an app-tier server

A

Directly reference the web Security Group in the app instance security group

68
Q

What does a Security Group reference apply to

A

Anything that has the Security Group attached

69
Q

What can security group self-reference allow you to do

A

Makes it so any instance with the SG can communicate with any other instance with the same security group

70
Q

What is an advantage of Security Group self-reference with regards to IP changes

A

They are handled automatically since there is no dependency on them

71
Q

How do you generally use NACLs and Security groups^

A

Use NACL to explicitly block bad actors
Use SG to allow traffic to VPC-based resources

72
Q

What is NAT used for

A

To give a private resource outgoing only access to the internet

73
Q

What does NAT give to a private CIDR range

A

It gives outgoing internet access

74
Q

What is the IP mapping when using NAT

A

Many private IPs to onepublic IP

75
Q

What kind of NAT does and Internet Gateway do

A

Static NAT

76
Q

WWhat would yhou historically use to provide NAT

A

EC2 instance

77
Q

What is now available to handle NAT

A

Managed service: NAT Gateway

78
Q

How do you configure a NAT gateway

A

Put NAT gateway in public subnet
Configure route table in private subnet to point to NAT Gateway in public subnet

79
Q

Do NAT Gateways have their own public IP

A

No, they have to go through Internet Gateway

80
Q

What kind of IP is used by NAT gateways

A

Elastic Ips (Static public IPv4, allocated to your aws account for a region)

81
Q

What is the resilience of NAT Gateways

A

AZ-resilient, but HA in that AZ

82
Q

What do EC2 instances do by default to data on its network card for which it is neither the source or the destination

A

It drops it

83
Q

What do you need to do to source#destination checks on EC2 instances for NAT to work

A

Disable it

84
Q

What do you do for max availability of NAT

A

A NAT gateway in each AZ

85
Q

Do NAT gateways have free tier

A

No

86
Q

When can a NAT EC2 instance be cheaper than a manage NAT gateway

A

If only a test VPC with very low volume (can yuse the smallest instance size)
At high volumes

87
Q

What are 2 advantages, besides cost (potentially) of using a NAT EC2 instance instead of a managed NAT gateway

A

You can use it as a Bastion Host
You can filter traffic using NACLs or security groups

88
Q

What kind of security do managed NAT Gateways

A

Only NACL, not Security Groups

89
Q

Is NAT required for IPv6

A

No, IG works directly with all IPv6 IPs

90
Q

How do you do bidirectional connectivity for IPv6

A

::/0 and Internet Gateway

91
Q

How do you do egress only connectivity for IPv6

A

::/0 + Egress-only internet gateway (works only for IPv6)

aws saa-c03 (18 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions