Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cert > Virtual Private Cloud (VPC) > Flashcards

Virtual Private Cloud (VPC) Flashcards

1
Q

What does CIDR stand for?

A

Classless Inter-Domain Routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

a method for allocating IP addresses

A

CIDR - Classless Inter-Domain Routing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

A CIDR consists of two components

A

Base IP
Subnet Mask

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q
  • Represents an IP contained in the range (XX.XX.XX.XX)
  • Example:10.0.0.0,192.168.0.0,…
A

Base IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q
  • Defines how many bits can change in the IP
  • Example:/0,/24,/32
  • Can take two forms:
    • /8ó255.0.0.0
    • /16ó255.255.0.0
    • /24ó255.255.255.0
    • /32ó255.255.255.255
A

Subnet Mask

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

basically allows part of the underlying IP to get additional next values from the base IP

A

CIDR - The Subnet Mask

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

New EC2 instances are launched into the default VPC if no ______ is specified

A

subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Default VPC has Internet connectivity and all EC2 instances inside it have public ________ addresses

A

IPv4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Default VPC in new EC2 instances, we also get a public and a private ____________ names

A

IPv4 DNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can you have multiple VPCs in an AWS region?

A

YES (max. 5 per region – soft limit)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Max. CIDR per VPC is ______ , for each CIDR:
* Min. size is
* Max. size is

A

5
/28 (16 IP addresses)
/16 (65536 IP addresses)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Because VPC is private, only the ________ ranges are allowed:
* 10.0.0.0 – 10.255.255.255 (10.0.0.0/8)
* 172.16.0.0 – 172.31.255.255 (172.16.0.0/12)
* 192.168.0.0 – 192.168.255.255 (192.168.0.0/16)

A

Private IPv4

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Your VPC CIDR should ________ overlap with your other networks

A

NOT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

AWS reserves ______ IP addresses (first 4 & last 1) in each subnet

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

These 5 IP addresses are __________ for use and can’t be assigned to an EC2 instance

A

not available

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What does IGW stand for??

A

Internet Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
  • Allows resources (e.g., EC2 instances) in a VPC connect to the Internet
  • It scales horizontally and is highly available and redundant
  • Must be created separately from a VPC
  • OneVPC can only be attached to one IGW and vice versa
A

Internet Gateway (IGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Internet Gateways on their own __________ allow Internet access

A

do not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

We can use a ________ to SSH into our private EC2 instances

A

Bastion Host

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

The bastion is in the _______ which is then connected to all other ___________

A

public subnet
private subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Bastion Host security group must allow inbound from the internet on _________ from restricted CIDR, for example the public CIDR of your corporation

A

port 22

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Security Group of the EC2 Instances must allow the Security Group of the Bastion Host, or the __________ of the Bastion host

A

private IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What does NAT stand for?

A

Network Address Translation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q
  • Allows EC2 instances in private subnets to
    connect to the Internet
  • Must be launched in a public subnet
  • Must disable EC2 setting: Source / destination Check
  • Must have Elastic IP attached to it
  • RouteTables must be configured to route traffic from private subnets to the NAT Instance
A

NAT Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q
  • AWS-managed NAT, higher bandwidth, high availability, no administration
  • Pay per hour for usage and bandwidth
  • NATGW is created in a specific Availability Zone, uses an Elastic IP
  • Can’t be used by EC2 instance in the same subnet (only from other subnets)
  • Requires an IGW (Private Subnet => NATGW => IGW)
  • 5 Gbps of bandwidth with automatic scaling up to 45 Gbps
  • No Security Groups to manage / required
A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

NAT Gateway is resilient within a ___________

A

single Availability Zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

NAT Gateway with High Availability - Must create __________ in multiple AZs for fault-tolerance

A

multiple NAT Gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

There is no cross-AZ failover needed because if an AZ goes down it _______

A

doesn’t need NAT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Availability
Highly available within AZ (create in another AZ)

A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Bandwidth
Up to 45 Gbps

A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Maintenance
Managed by AWS

A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Cost
Per hour & amount of data transferred

A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Availability
Use a script to manage failover between instances

A

NAT Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Bandwidth
Depends on EC2 instance type

A

NAT Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Maintenance
Managed by you (e.g., software, OS patches, …)

A

NAT Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Cost
Per hour, EC2 instance type and size, + network $

A

NAT Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Public IPv4 - Yes

A

NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Public IPv4 - Yes

A

NAT Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Private IPv4 - Yes

A

Nat Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Private IPv4 - Yes

A

Nat Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

Security Group - No

A

Nat Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Security Group - Yes

A

Nat Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Use as Bastion Host - No

A

Nat Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Use as Bastion Host - Yes

A

Nat Instance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What does NACL stand for?

A

Network Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

are like a firewall which control traffic from and to subnets

A

Network Access Control List (NACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

One NACL per ________, new subnets are assigned the ________

A

subnet
Default NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q
  • Rules have a number (1-32766), higher precedence with a lower number
  • First rule match will drive the decision
  • Example: if you define #100 ALLOW 10.0.0.10/32 and #200 DENY 10.0.0.10/32, the IP address will be allowed because 100 has a higher precedence over 200
  • The last rule is an asterisk (*) and denies a request in case of no rule match
  • AWS recommends adding rules by increment of 100
A

NACL Rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Newly created NACLs will ________ everything

A

deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

NACL are a great way of __________?

A

blocking a specific IP address at the subnet level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Accepts everything inbound/outbound with the subnets it’s associated with

A

Default NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Instead of modifying the default NACL, instead you want to _______?

A

create custom NACLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q
  • For any two endpoints to establish a connection, they must use ports
  • Clients connect to a defined port, and expect a response on ________
  • Different Operating Systems use different port ranges, examples:
    • IANA&MSWindows10è49152–65535
    • Many Linux Kernelsè32768 – 60999
A

Ephemeral Ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Security Group vs. NACLs
Operates at the instance level

A

Security Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Security Group vs. NACLs
Supports allow rules only

A

Security Group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Security Group vs. NACLs
Stateful: return traffic is automatically allowed, regardless of any rules

A

Security Group

57
Q

Security Group vs. NACLs
All rules are evaluated before deciding whether to allow traffic

A

Security Group

58
Q

Security Group vs. NACLs
Applies to an EC2 instance when specified by someone

A

Security Group

59
Q

Security Group vs. NACLs
Operates at the subnet level

A

NACL

60
Q

Security Group vs. NACLs
Supports allow rules and deny rules

A

NACL

61
Q

Security Group vs. NACLs
Stateless: return traffic must be explicitly allowed by rules (think of ephemeral ports)

A

NACL

62
Q

Security Group vs. NACLs
Rules are evaluated in order (lowest to highest) when deciding whether to allow traffic, first match wins

A

NACL

63
Q

Security Group vs. NACLs
Automatically applies to all EC2 instances in the subnet that it’s associated with

A

NACL

64
Q

Privately connect two VPCs using AWS’ network

A

VPC Peering

65
Q

Make them behave as if they were in the same network

A

VPC Peering

66
Q

Must not have overlapping CIDRs

A

VPC Peering

67
Q

connection is NOT transitive
(must be established for each VPC that need to communicate with one another)

A

VPC Peering

68
Q

You must update route tables in each VPC’s subnets to ensure EC2 instances can communicate with each other

A

VPC Peering

69
Q

You can create VPC Peering connection between VPCs in different _____?

A

AWS accounts/regions

70
Q

You can reference a security group in a peered VPC _______

A

(works cross accounts – same region)

71
Q

Every AWS service is publicly exposed (public URL)

A

VPC Endpoints (AWS PrivateLink)

72
Q

allows you to connect to AWS services using a private network instead of using the public Internet

A

VPC Endpoints (AWS PrivateLink)

73
Q

They’re redundant and scale horizontally

A

VPC Endpoints (AWS PrivateLink)

74
Q

They remove the need of IGW, NATGW, …
to access AWS Services

A

VPC Endpoints (AWS PrivateLink)

75
Q

In case of issues:
* Check DNS Setting Resolution in your VPC
* CheckRouteTables

A

VPC Endpoints (AWS PrivateLink)

76
Q

2 types of VPC Endpoints (AWS PrivateLink)

A

Interface Endpoints (powered by PrivateLink)
Gateway Endpoints

77
Q
  • Provisions an ENI (private IP address) as an entry
    point (must attach a Security Group)
  • Supports most AWS services
  • $ per hour + $ per GB of data processed
A

Interface Endpoints (powered by PrivateLink)

78
Q
  • Provisions a gateway and must be used as a target in a route table (does not use security groups)
  • Supports both S3 and DynamoDB
  • Free
A

Gateway Endpoints

79
Q

VPC Endpoints - ___________ is most likely going to be preferred all the time at the exam

A

Gateway

80
Q

is preferred access is required from on- premises (Site to Site VPN or Direct Connect), a different VPC or a different region

A

Interface Endpoint

81
Q

2 ways for Lambda in VPC accessing DynamoDB

A

Option1: Access from the public internet
Option 2 (better & free): Access from the private VPC network

82
Q

Because Lambda is in a VPC, it needs a NAT Gateway in a public subnet and an internet gateway

A

Option1: Access from the public internet

83
Q
  • Deploy a VPC Gateway endpoint for DynamoDB
  • Change the Route Tables
A

Option 2 (better & free): Access from the private VPC network

84
Q
  • Capture information about IP traffic going into your interfaces:
    • VPC Flow Logs
    • Subnet Flow Logs
    • Elastic Network Interface (ENI) Flow Logs
  • Helps to monitor & troubleshoot connectivity issues
  • Flow logs data can go to S3, CloudWatch Logs, and Kinesis Data Firehose
  • Captures network information from AWS managed interfaces too: ELB, RDS, ElastiCache, Redshift,WorkSpaces, NATGW,Transit Gateway…
A

VPC Flow Logs

85
Q
  • VPN concentrator on the AWS side of the VPN connection
  • VGW is created and attached to the VPC from which you want to create the Site-to-Site VPN connection
  • Possibility to customize the ASN (Autonomous System Number)
A

Virtual Private Gateway (VGW)

85
Q

2 types of AWS Site-to-Site VPN

A

Virtual Private Gateway (VGW)
Customer Gateway (CGW)

86
Q

Software application or physical device on customer side of the VPN connection

A

Customer Gateway (CGW)

87
Q

Provide secure communication between multiple sites, if you have multiple VPN connections

A

AWS VPN CloudHub

88
Q

Low-cost hub-and-spoke model for primary or secondary network connectivity between different locations (VPN only)

A

AWS VPN CloudHub

89
Q

It’s a VPN connection so it goes over the public Internet

A

AWS VPN CloudHub

90
Q

To set it up, connect multiple VPN connections on the same VGW, setup dynamic routing and configure route tables

A

AWS VPN CloudHub

91
Q

Provides a dedicated private connection from a remote network to your VPC

A

Direct Connect (DX)

92
Q

Dedicated connection must be setup between your ________ and AWS Direct Connect locations

A

DC

93
Q

You need to setup aVirtual Private Gateway on yourVPC

A

Direct Connect (DX)

94
Q

Access public resources (S3) and private (EC2) on same connection

A

Direct Connect (DX)

95
Q

Use Cases:
* Increase bandwidth throughput - working with large data sets – lower cost
* More consistent network experience - applications using real-time data feeds * Hybrid Environments (on prem + cloud)

A

Direct Connect (DX)

96
Q

Does Direct Connect (DX) Supports both IPv4 and IPv6

A

YES

97
Q

If you want to setup a Direct Connect to one or more VPC in many different regions (same account), you must use a __________?

A

Direct Connect Gateway

98
Q

2 Direct Connect – Connection Types

A

Dedicated Connections
Hosted Connections

99
Q
  • 1Gbps,10 Gbps and 100 Gbps capacity
  • Physical ethernet port dedicated to a customer
  • Request made to AWS first, then completed by AWS Direct Connect Partners
A

Dedicated Connections

100
Q
  • 50Mbps, 500 Mbps, to 10 Gbps
  • Connection requests are made via AWS Direct Connect Partners
  • Capacity can be added or removed on demand
  • 1, 2, 5, 10 Gbps available at select AWS Direct Connect Partners
A

Hosted Connections

101
Q

For Direct Connect – Connection, Lead times are often longer than __________ to establish a new connection

A

1 month

102
Q

Direct Connect, Data in transit is _________ but is private

A

not encrypted

103
Q

AWS Direct Connect + VPN provides an ________

A

IPsec-encrypted private connection

104
Q
  • For having transitive peering between thousands of VPC and on-premises, hub-and-spoke (star) connection
  • Regional resource, can work cross-region
  • Share cross-account using Resource Access Manager (RAM)
  • You can peer this across regions
  • RouteTables: limit which VPC can talk with othe rVPC
  • Works with Direct Connect Gateway,VPN connections
  • Supports IP Multicast (not supported by any other AWS ser vice)
A

Transit Gateway

105
Q

Used for IPv6 only

A

Egress-only Internet Gateway

106
Q

similar to a NAT Gateway but for IPv6

A

Egress-only Internet Gateway

107
Q

Allows instances in your VPC outbound connections over IPv6 while preventing the internet to initiate an IPv6 connection to your instances

A

Egress-only Internet Gateway

108
Q

IP Range

A

CIDR

109
Q

Virtual Private Cloud => we define a list of IPv4 & IPv6 CIDR

A

VPC

110
Q

tied to an AZ, we define a CIDR

A

Subnets

111
Q

at the VPC level, provide IPv4 & IPv6 Internet Access

A

Internet Gateway

112
Q

must be edited to add routes from subnets to the IGW,VPC Peering Connections,VPC Endpoints, …

A

RouteTables

113
Q

public EC2 instance to SSH into, that has SSH connectivity to EC2 instances in private subnets

A

Bastion Host

114
Q

gives Internet access to EC2 instances in private subnets. Old, must be setup in a public subnet, disable Source / Destination check flag

A

NAT Instances

115
Q

managed by AWS, provides scalable Internet access to private EC2 instances, IPv4 only

A

NAT Gateway

116
Q

stateless, subnet rules for inbound and outbound, don’t forget Ephemeral Ports

A

NACL

117
Q

stateful, operate at the EC2 instance level

A

Security Groups

118
Q

connect two VPCs with non overlapping CIDR, non-transitive

A

VPC Peering

119
Q

provide private access to AWS Services (S3, DynamoDB, CloudFormation, SSM) within a VPC

A

VPC Endpoints

120
Q

can be setup at the VPC / Subnet / ENI Level, for ACCEPT and REJECT traffic, helps identifying attacks, analyze using Athena or CloudWatch Logs Insights

A

VPC Flow Logs

121
Q

setup a Customer Gateway on DC,aVirtual Private Gateway on VPC, and site-to-site VPN over public Internet

A

Site-to-SiteVPN

122
Q

hub-and-spoke VPN model to connect your sites

A

AWS VPN CloudHub

123
Q

setup a Virtual Private Gateway on VPC, and establish a direct private connection to an AWS Direct Connect Location

A

Direct Connect

124
Q

setup a Direct Connect to many VPCs in different AWS regions

A

Direct Connect Gateway

125
Q
  • Connect services privately from your service VPC to customers VPC
  • Doesn’t need VPC Peering, public Internet, NAT Gateway, Route Tables
  • Must be used with Network Load Balancer & ENI
A

AWS PrivateLink / VPC Endpoint Services

126
Q

connect EC2-Classic EC2 instances privately to your VPC

A

ClassicLink

127
Q

transitive peering connections forVPC,VPN & DX

A

Transit Gateway

128
Q

copy network traffic from ENIs for further analysis

A

Traffic Mirroring

129
Q

like a NAT Gateway, but for IPv6

A

Egress-only Internet Gateway

130
Q

Protect your entire Amazon VPC

A

AWS Network Firewall

131
Q

From Layer 3 to Layer 7 protection

A

AWS Network Firewall

132
Q

Any direction, you can inspect
* VPCtoVPCtraffic
* Outbound to internet
* Inbound from internet
* To/fromDirectConnect&Site-to-SiteVPN

A

AWS Network Firewall

133
Q

Uses the AWS Gateway Load Balancer

A

AWS Network Firewall

134
Q

Rules can be centrally managed cross- account by AWS Firewall Manager to apply to many ________?

A

VPCs

135
Q

Supports 1000s of rules
* IP & port - example: 10,000s of IPs filtering
* Protocol – example: block the SMB protocol for outbound communications
* Stateful domain list rule groups: only allow outbound traffic to*.mycorp.com or third-party software repo
* General pattern matching using regex

A

AWS Network Firewall

136
Q

Traffic filtering: Allow, drop, or alert for the traffic that matches the rules

A

AWS Network Firewall

137
Q

Active flow inspection to protect against network threats with intrusion-prevention capabilities (like Gateway Load Balancer, but all managed by AWS)

A

AWS Network Firewall

138
Q

AWS Network Firewall send logs of rule matches to ___________? (3)

A

Amazon S3
CloudWatch Logs
Kinesis Data Firehose

AWS Cert (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions