VPC Flashcards
How many IP addresses does AWS reserve in a subnet
First 4 and last 1 IP address in each subnet’s CIDR block
How many IP addresses are available in /28 CIDR Block range?
16
How to allow instances in Private Subnet to be able to connect to the internet
Attach a NAT Gateway in Public Subnet
& add path in Route Table to internet to point to NAT Gateway
Scalability of NAT Gateway
5 Gbps - 45 Gbps
Outside traffice hits what items in VPC first
Internet Gateway or VPN
Router
Route Table
ACL
Security Group
Instances
Security Groups are Stateful or Stateless
Stateful (allows communication back and forth outbound open by default)
Max number of NACLs can a subnet be associated with at a time
1
NACLs are Stateful or Stateless
Stateless (have to set both inbound and outbound)
Here are my NACL rules
100 Port 80 Allow
200 Port 443 Allow
300 Port 80 Deny
* All. 0.0.0.0/0 Deny
What will happen with Port 80 access
Still will have access since Allow is lowest #
Lowest #s evaluated first
How to connect to AWS services without an internet gateway or NAT Gateway
VPC Endpoints
TRUE or FALSE VPC peering allows transitive peering
FALSE, hub and spoke model only
TRUE or FALSE VPC peering can be done across regions AND AWS accounts
TRUE
TRUE or FALSE VPC Peering must be done over overlapping CIDR ranges
FALSE, Cannot overlap CIDR ranges
3 options to share applications across VPCs
- Open VPC up to Internet
- big security no-no
- lots to manage - VPC Peering
- manage all the peering relationships
- whole network will be accessible, even if you have multiple apps on VPC - PrivateLink
- no internet tables or nat gateways
- only expose application to 100s or 1000 of customer VPCs
AWS resources needed for Private Link
Network Load Balancer in service VPC
ENI on customer VPC
How to connect sites together that each have their own VPN
AWS VPN CloudHub
TRUE or FALSE VPN CloudHub is used for customers that don’t have access to the internet
FALSE, internet is required for VPN CloudHub (all traffic is encrypted)
Service to connect On-Premise directly to AWS Cloud
AWS Direct Connect
True or False: Does AWS Direct Connect require a VPN or Internet
FALSE, Direct Connect even increase bandwith throughput because don’t have to go over internet
2 Types of AWS Direct Connections
Dedicated Connection:
physical ethernet requested through AWS console
Hosted Connection:
physical ethernet that an AWS Direct Connection Partner sets up. e.g Verizon
AWS Service to simplify VPN connections that are complicated
Transit Gateway
Allows AWS Devices/servers to connect to 5G network and mobile edge computing
AWS Wavelength
An EC2 instance is removed from an EC2 instance pool but the instance continues to direct the traffic to the instance. What can you do to fix this?
Disable Sticky Sessions.
Load Balancers - How to keep connections open to instances that become unhealthy
Enable Deregistration delays
