Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solutions Architect - Associate > Virtual Private Cloud (VPC) > Flashcards

Virtual Private Cloud (VPC) Flashcards

1
Q

What is a VPC?

A

A virtual private data center in the cloud.

  1. A logically isolated part of the AWS cloud where you can define your own network
  2. Complete control of virtual network, including your own IP address range, subnets, route tables and network gateways
  3. You can leverage multiple layers of security (public subnet, private subnets), including security groups and network access control lists, to help control access to Amazon EC2 instances in each subnet
  4. You can create a hardware Virtual Private Network (VPN) connection between your corporate data center and your VPC and leverage the AWS cloud as an extension of your corporate data center

http://cidr.xyz

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the maximum addressable size of IPs you can have with a CIDR block in AWS?

A

/16 which gives 65,556 network addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What can we do with a VPC?

A
  1. Launch instances into a subnet of your choosing
  2. Assign custom IP addresses in each subnet
  3. Configure route tables between subnets
  4. Create an Internet Gateway and attach it to a VPC
  5. Gives much better control over your AWS resources
  6. Provision access control lists (you can use network access control lists to block specific IP addresses)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What tool in a VPC do you use to block specific IP addresses from gaining access to a VPC?

A

Network ACL (NACL), not security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the things you can expect with the default VPC?

A
  1. The default VPC is user friendly
  2. All subnets in the default VPC have a route out to the internet (all public)
  3. Each EC2 instance has both a public and a private IP address in the default VPC
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the main components of a VPC?

A
  1. Internet gateways (or virtual private gateways)
  2. Route tables
  3. Network access control lists (NACLs)
  4. Subnets
  5. Security groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When you create a subnet, where is it created?

A

In one availability zone, it cannot span multiple availability zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the steps to creating a custom VPC?

A
  1. Navigate to VPC service
  2. Click “Create VPC” button
  3. Optionally give it a name
  4. Select IPv4 CIDR block manual input of 10.0.0.0/16 (largest)
  5. Do not select IPv6 CIDR block
  6. Select the default tenancy (as opposed to dedicated, which is very expensive)
  7. Click “Create VPC” button
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

When you create a VPC, what three things are created by default?

A
  1. Main route table
  2. Main network ACL (NACL)
  3. Security group
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is a subnet in a VPC?

A

A virtual firewall

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are the two accessibility options when creating a subnet?

A
  1. Public (internet accessible)
  2. Private (not internet accessible)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the steps to creating a new subnet?

A
  1. Select a VPC
  2. Give the subnet a name (e.g. 10.0.1.0/24 - us-east-1a)
  3. Select the availability zone
  4. Enter the CIDR block range (10.0.1.0/24) - give 251 available IP addresses with 5 reserved for AWS (10.0.1.0, 10.0.1.1, 10.0.1.2, 10.0.1.3, and 10.0.1.255)
  5. Click “Create Subnet” button
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the steps to making a subnet public and internet accessible?

A
  1. Select the subnet and click “Edit”
  2. Check the box labeled “Enable auto-assign public IPv4 address”
  3. Click “Save”.
  4. Select the option to create a new Internet Gateway
  5. Give it a name
  6. Click “Create”
  7. Select the newly created Internet Gateway
  8. Click “Attach to VPC” button
  9. Select the VPC
  10. Click “Attach Internet Gateway”

Next, create a new route table with a route in from the internet. If we had used the main route table to create the public route, then any new subnet would be public facing by default.
1. Click “Create Route Table” button
2. Give it a name
3. Select the VPC
4. Click “Create Route Table” button

  1. Select the new Route Table
  2. Click “Edit Routes” button
  3. Click “Add Route”
  4. Enter the Destination 0.0.0.0/0
  5. Select the new Internet Gateway as the Target
  6. Click “Save Changes”
  7. Select the new Route Table
  8. Select “Subnet associations” tab
  9. Click “Edit subnet associations” button
  10. Select the public subnet
  11. Click “Save associations” button
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is a NAT Gateway?

A

You can use a network address translation (NAT) gateway to enable instances in a private subnet to connect to the internet or other AWS services while preventing the internet from initiating a connection to those instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How can an instance in a public subnet get access to the internet?

A

It sends traffic through the Network ACLs, Route Table, Router and Internet Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How can an instance in a private subnet get access to the internet (if the route table prevents it)?

A

Provision a NAT Gateway in the public subnet that acts as a means for internet traffic to go out through the NAT Gateway, through the public Network ACL, Route Table, Router and Internet Gateway.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What are the key features of a NAT Gateway?

A
  1. It is redundant within an AZ for high-availability
  2. Starts at 5 Gbps and scales to 45 Gbps
  3. No need to patch
  4. Not associated with security groups
  5. Automatically assigned a public IP address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the steps to making a NAT Gateway and creating a route out from a private subnet?

A
  1. Click “Create NAT Gateway”
  2. Give it a name
  3. Select the public subnet
  4. Click “Allocate Elastic IP” button
  5. Click “Create NAT Gateway” button
  6. Select the main route table (that doesn’t have a route out to the internet)
  7. Click “Edit Routes” button
  8. Click “Add Route” button
  9. Enter 0.0.0.0/0 as the Destination
  10. Select NAT Gateway as the Target
  11. Click “Save Routes” button
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are Security Groups in VPC?

A

Virtual firewalls for a VPC

They are the last line of defense of inbound traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

If you have a scenario where you have connectivity problems, what things should you look at (and in what order)?

A
  1. Look at Route Tables
  2. Look at Network ACLs
  3. Check the Security Groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

In Security Groups, by default is all traffic blocked or open?

A

By default, all traffic is blocked (to let everything in, use 0.0.0.0/0)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Are security groups stateless or stateful?

A

Security groups are stateful – if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules, and visa versa.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a Network ACL?

A

An optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets.

They are the first line of defense of inbound traffic.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In Network ACLs, by default, is all traffic blocked or open?

A

By default, all traffic is allowed, both outbound and inbound.

25
Q

When you create a custom Network ACL for a VPC, by default, is all traffic blocked or allowed?

A

By default, each custom network ACL denies all inbound and outbound traffic until you add rules.

26
Q

Does a subnet have to be associated with a Network ACL?

A

Yes, each subnet in your VPC must be associated with a Network ACL. If you don’t explicitly associate a subnet with a Network ACL, the subnet is automatically associated with the default Network ACL.

27
Q

Does a subnet have to be associated with a Network ACL?

A

Yes, each subnet in your VPC must be associated with a Network ACL. If you don’t explicitly associate a subnet with a Network ACL, the subnet is automatically associated with the default Network ACL.

28
Q

What is the relationship between a subnet and a Network ACL?

A

A Network ACL may be associated to multiple subnets but a subnet may be associated with only one Network ACL.

29
Q

How are Network ACLs evaluated?

A

Network ACLs contain a numbered list of rules that are evaluated in order, starting with the lowest numbered rule.

They have separate inbound and outbound rules, and each rule can either allow or deny traffic.

30
Q

Are Network ACLs stateless or stateful?

A

Network ACLs are stateless. Responses to allowed inbound traffic are subject to the rules for outbound traffic (and visa versa).

31
Q

What are VPC Endpoints?

A

Enable you to privately connect to your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an Internet Gateway, NAT device, VPN connection or AWS Direct Connection.

  1. They are virtual devices
    2, They are horizontally scaled, redundant and highly available VPC components that allow communication between instances in your VPC and AWS services (without imposing security risks or bandwidth constraints on your network traffic)
32
Q

Do instances in your VPC require a public IP address to communicate with resources in the Amazon network?

A

No, you only need to configure a VPC endpoint.

33
Q

When connecting to AWS services, do you want to use a NAT Gateway or VPC Endpoints to provide the connection?

A

You want to use VPC Endpoints because they are infinitely scalable and NAT Gateways have limitations.

34
Q

What are the two different options for VPC Endpoints?

A
  1. Interface Endpoints (elastic network interface with a private IP address that serves as an entry point for traffic headed to a supported service, and they support a large number of AWS services)
  2. Gateway Endpoints (similar to NAT gateways, in that it is a virtual device you provision; it supports connections to S3 and DynamoDB)
35
Q

What is the use case for a VPC Endpoint?

A

When you want to connect to AWS services without leaving the Amazon internal network.

36
Q

When you have multiple VPCs and you want to connect the VPCs together, what service would you use?

A

VPC peering

37
Q

What is VPC Peering?

A
  1. It allows you to connect one VPC to another via a direct network route using private IP addresses
  2. Instances behave as if they were on the same private network
  3. You can peer VPCs with other AWS accounts as well as with other VPCs in the same account
  4. You can peer between regions
  5. Peering is in a star configuration (e.g. one central VPC peers with four others, no transitive peering meaning that you cannot connect to a VPC through another VPC)
38
Q

What is the rule with CIDR addresses and VPC Peering?

A

You cannot have overlapping CIDR addresses when peering VPCs

39
Q

What are the two ways you can open up a VPC to connectivity to another VPC?

A
  1. Open the VPC up the the internet via an Internet Gateway
  2. Using VPC Peering
40
Q

What is the best way to expose a service VPC to tens, hundreds or thousands of customer VPCs?

A

Using VPC PrivateLink

41
Q

What is VPC PrivateLink?

A
  1. Does not require VPC Peering;
  2. No route tables, NAT Gateways, Internet Gateways, etc.
  3. Requires a Network Load Balancer on the service VPC and an ENI on the customer VPC
42
Q

What is AWS VPN CloudHub?

A

If you have multiple sites, each with its own VPN connection, you can use AWS VPN CloudHub to connect those sites together.

  1. It works on a hub-and-spoke model
  2. Low cost and easy to manage
  3. It operates over the public internet, but all traffic between the customer gateway and the AWS VPN CloudHub is encrypted
43
Q

If you have a scenario where you are asked how you can aggregate multiple VPN connections together from different customer sites or all over the world, what service would you recommend?

A

AWS VPN CloudHub

44
Q

What is AWS Direct Connect?

A

A cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS.

45
Q

How can you establish private connectivity between AWS and your data center or office?

A

Using AWS Direct Connect

In many cases you can reduce network costs, increase bandwidth throughput and provide a more consistent network experience than internet-based connections.

46
Q

What are the two types of AWS Direct Connect connections?

A
  1. Dedicated connection (a physical ethernet connection associated with a single customer; you can request a dedicated connection through the AWS Direct Connect console, the CLI or the API)
  2. Hosted connection (a physical ethernet connection that an AWS Direct Connect Partner, like Verizon or AT&T, who provisions on behalf of a customer; you can request by contacting a partner in the AWS Direct Connect Partner Program, who provisions the connection)
47
Q

How is AWS Direct Connect an improvement over VPC?

A

VPNs traverse the public internet to get the data delivered (although it is still secure) while AWS Direct Connect uses a dedicated connection making it:

  1. Fast
  2. Reliable
  3. Secure
  4. Able to take massive throughput
48
Q

What use cases would you consider using AWS Direct Connect?

A

When you have high throughput workloads or that require a stable, secure connection.

49
Q

If you have a scenario where the VPN connection to AWS keeps dropping out and you need to reduce costs and you need to increase your network throughput, what AWS service would you recommend?

A

AWS Direct Connect

50
Q

What is AWS Transit Gateway?

A

It connects VPCs and on-premises networks through a central hub. This simplifies your network and puts an end to complex peering relationships. It acts as a cloud router – each new connection is only made once.

51
Q

What are the features of AWS Transit Gateway?

A
  1. It allow you to have transitive peering between thousands of VPCs and on-premises data centers
  2. Works on a hub-and-spoke model
  3. Works on a regional basis but you can have it across multiple regions
  4. You can use it across multiple AWS accounts using RAM (Resource Access Manager)
52
Q

How can you limit how VPCs talk to one another when using AWS Transit Gateway

A

Using Route Tables

53
Q

Does AWS Transit Gateway work with both VPN and AWS Direct Connect or only one of them?

A

It works with both

54
Q

Does AWS Transit Gateway support IP multicast (which allows a host to send a single packet to thousands of hosts across a routed network)?

A

Yes (but it is not supported by any other AWS services)

55
Q

If you have a scenario where it mentions needing to simply the network topology, what service would you recommend?

A

AWS Transit Gateway

56
Q

What are 5G networks?

A

5G provides mobile devices with higher speed, lower latency and greater capacity than 4G LTE networks

57
Q

What is AWS Wavelength?

A

Embeds AWS compute and storage services within 5G networks, providing mobile edge computing infrastructure for developing, deploying and scaling ultra-low-latency applications.

58
Q

If you have a scenario about mobile edge computing, what service would you recommend?

A

AWS Wavelength

59
Q

If you have resources in multiple AZs and they share a NAT gateway, in the event that the NAT Gateways AZ is down, resources in the other AZs will lose internet access. How do you avoid this?

A

To create an AZ-independent architecture, create a NAT Gateway in each AZ and configure your routing to ensure resources use the NAT Gateway in the same AZ.

AWS Certified Solutions Architect - Associate (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions