VIRTUAL PRIVATE CLOUD (VPC) BASICS Flashcards by Rashell Smith

What are some considerations for VPC structure before creation ?

what size should the VPC be

Are there any networks we can’t use

VPC minimum /28(16 IPs) , maximum /16(65456 IPs)

Avoid common ranges

reserved 2+ networks per region being used per account

How well did you know this?

Not at all

Perfectly

your business Animals 4 Life has offices in 3 us regions regions, 1 Europe region, and 1 Australia region what would there total IP ranges be ?

40 IP Ranges

How well did you know this?

Not at all

Perfectly

custom VPC

regional service All AZ in the region

isolated network

Northing in or out without explicit configuration

Default or Dedicated Tenancy

How well did you know this?

Not at all

Perfectly

Default Tenancy

you can decide on a per resource level weather it goes on shared or dedicated hardware

How well did you know this?

Not at all

Perfectly

Dedicated Tenancy

on a VPC level any resource that you create has to be on dedicated hardware which is a cost premium

How well did you know this?

Not at all

Perfectly

AWS configuration Custom VPC

IPv4 Private CIDR block and Public IPS

! Primary Private IPv4 CIDR Block

Min/28(16IP) Max /16 (55,536 IP)

optional secondary IPv4 Block

optional single assigned IPv6/56 CIDR Block(IPv6 are only public)

How well did you know this?

Not at all

Perfectly

DNS in a AWS custom VPC

provided by R53

VPC Base IP +2 address

How well did you know this?

Not at all

Perfectly

enableDnsHostnames

gives instances DNS names

How well did you know this?

Not at all

Perfectly

enableDnsSupport

enables DNS resolution in VPC

How well did you know this?

Not at all

Perfectly

VPC Subnets

subnets are what services run from inside VPC’s and their are how you add structure, functionality and resilience to VPC’s

How well did you know this?

Not at all

Perfectly

VPC Subnet resiliency

AZ resilient

How well did you know this?

Not at all

Perfectly

Can a subnet be in Multiple AZ ?

No, one subnet is created in a specific AZ in a region and it can never be changed.

How well did you know this?

Not at all

Perfectly

Auto Assign public IPv4

decided if the subnet assigns public IPv4 in addition to their private subnet automatically

How well did you know this?

Not at all

Perfectly

auto assign IPv6

decides if the subnet assigns IPV6 addresses the subnet and the VPC has to have that allocated also for to work

How well did you know this?

Not at all

Perfectly

How many subnets can a AZ have ?

One AZ can have 0 to many Subnets

How well did you know this?

Not at all

Perfectly

How does a subnet handle networking ?

By default the subnet is allocated an IPv4 CIDR

How well did you know this?

Not at all

Perfectly

What are the constraints of a Subnet CIDR

has to be a subset of the VPC CIDR

How well did you know this?

Not at all

Perfectly

Can the CIDR range of two subnets in the same VPC overlap?

no, subnets can’t overlap with other subnets

How well did you know this?

Not at all

Perfectly

Can two subnets within a VPC communicate with each other ?

free communication between subnets by default

How well did you know this?

Not at all

Perfectly

What are the 5 unusable addresses in a subnet ?

Network Address (start of network)
Network +1 - VPC Router
Network +2 - Reserved(DNS*)
Network +3 - Reserved Future Use
Broadcast Address (Last IP in Subnet )

How well did you know this?

Not at all

Perfectly

DHCP option set

Dynamic Host Configuration Protocol how computing devices receive IP addresses Automatically.

How well did you know this?

Not at all

Perfectly

Where is DHCP options sets applied ?

At the VPC level flows down through subnets

How can you update the DHCP option set configurations?

you can create option sets but you can’t change them

if you want to change the option set you would have to make a new one and attach it to VPC

VPC Router

Routes traffic between subnets controls by route table attached to subnet

VPC Route Table

the default route table that is attached to a subnet if one is not specified

How many route tables can be attached to a subnet ?

one route table

Can two subnets within a VPC have the same route table attached ?

yes, a route table can be associated with many subnets

What does a route table to ?

it controls what happens to data as it leaves the subnet or subnets that the route table is associated with.

How is data routed in a route table

The more specific the route the higher the priority

Internet Gateway

manages traffic between the VPC and the internet or AWS public zones

How are IPv4 public addresses handled through IGW ?

Public IPv4 address are attached on the IGW it maintains a record of the associated Private IPv4 address attached on a instance.

Is it possible to configure a public IPv4 address on an EC2 instance running from within a subnet ?

No, at no point is an EC2 instance aware of it's public IPv4 address.

Bastion Host/Jump Box

An EC2 instance in a public subnet allows connectivity to internal VPC resources

Stateless FireWall

doesn't understand the state of connection weather it's request or response because of this there needs to be two security rules (IN, Out)

Stateful FireWalls

knows which components are the request and response firewall automatically picks up which port is being used and allows it. lower admin overhead

What are NACLS?

Network Access Control List is a traditional stateless firewall within AWS

What Kind of traffic are impacted by NACLS ?

Traffic crossing the subnet boundary inbound or outbound

How are rules processed in NCAL

Rules are processed in order, lowest rule number first

What happens when the traffic entering the NACL doesn't match any of the rules ?

explicate deny

What are the requirements for creating a NACL rule?

Each communication needs 1 request rule and 1 Response rule (application port and ephemeral port) for each communication type that occurs within a VPC, to a VPC and from a VPC.

How is the Default NACL configured for VPC

inbound and Outbound Rules have the implicit deny(\*) and an Allow All rule. The result- all traffic is allowed, the NACL has no effect.

Could a NACL be attached to AWS renounces

No, there only can be attached to subnets

How many NACLS can be associated to a Subnet

each subnet can have one NACL(default or custom)

How many subnets can be associated with a NACL

A NACL can be associated with many subnets

What are security Groups ?

Stateful firewall that detect response traffic automatically allowed(in or out)

What can security groups be attached to ?

anything that has a Elastic Network

What is one of the limitations for security Groups?

No explicitly deny only allow or implicit Deny It can't block specific bad actors for that NACL's are used

What are 2 benefits of using a Security group ?

it can refence other SG in rules as well itself can be attached to logical resources

What is Network Address Translation (NAT)

give private CIDR range outgoing internet access

Can connections be initiated from a private EC2 instance after NAT is enabled ? If Not why ?

connection can received response data but you can not imitate connections from the public internet

Where is an NAT gateway run from ?

Runs from a public subnet

What is the resiliency of a NAT Gateway by default ?

Is a NAT gateway region resilient ? and if not how would you make it region resilient ?

NATGW in each AZ

Why were NAT Gateway's created ?

public IPv4 addressed running out NAT is a set of proccesses reampaping src or dist ips IP masquerading hiding CIDR Block behind IP