Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS CSA-A and CSOA-A > VPC > Flashcards

VPC Flashcards

1
Q

What are the 6 important parts of a VPC? What is the role of each?

A
  1. Subnet (s) - allows you to place resources within specific networks
  2. Security Group (s) - default way to allow traffic into a subnet
  3. Network ACL (s) - Optional extra security for your subnet
  4. Route Tables - Provides path from your subnet to other subnets or the internet
  5. Internet Gateway - Provides a path to the internet from a subnet.
  6. NAT Gateway - allows access to the internet from a private subnet.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Can a subnet span an availability zone?

A

no. A subnet must always be on one AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What important thing must you do with a custom create public and private subnets in a VPC?

A

Set autoassign IPV4 to True for the public subnet and False for the private subnet (s)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which 2 entities in VPCs allow Internet access?

A

Internet Gateways
- Allow access to the internet. They are associated with VPCs, and from within a public subnet, you create a route table to the internet gateway.

NAT Gateways
- Used by private subnets to access the internet. You add them to the route table associated with the private subnet, and they point to the internet gateway and allow access out to the internet, but not into the private subnet. Note that NAT gateways are created in a public subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Describe this diagram and talk about its parts.

A

Items in the network diagram

  • A VPC (Virtual Private Cloud)
  • Two Subnets, one private and one public.
  • One Security Group per subnet
  • One Network ACL per subnet
  • One route Table Per subnet
  • Private subnet route table has a route table entry pointing to the NAT gateway which is connected to the Internet gateway to allow access to the internet
  • Public subnet route table has a route out to 0.0.0.0/0 mapped to the internet gateway allowing access out to the internet
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Match up the terms and explain.

Security Group
Network ACLs

match to

Stateful
Stateless

A
  • Security Groups are stateful. If you open up a port into a security group its open both ways
  • Network ACLs are stateless. You’d need to open access in each direction, inbound and outbound
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Is access blocked or open by default with Security Groups? What about Network ACLs? What about when you add a security group or NACL?

A
  • Default
    • Security Groups are Closed by default. You must open the ports you want open.
    • Network ACLs are Open by default. You can block the ports you want blocked, both directions
  • Custom Created
    • Security Groups are Open
    • NACLs are Closed
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How many subnets can a Network ACL be associated with?

A

One or many. This is an optional layer of security for your VPC, set up by port.

Every subnet must be associated with a Network ACL.. If you don’t its associated with your DEFAULT network ACLs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How are the rules in NACLs evaluated?

A

They are evaluated from smallest to largest. the first rule is the wildcard which denies everything

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What can you do with a Network ACL that you cant do with a Security group?

A

You can block IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Whats the weird thing you have to do about outbound ports in NACLs with web servers

A

You can open up “ephemeral ports” for 1024-65535. This covers responses on random ports that web servers might make.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What happens in an NACL when you create a rule number 300 that is a DENY on port 80 when you also have a rule number 200 which is an ALLOW for port 80?

A

The higher number does NOT override the earlier rule. We’ve allowed traffic on port 80 at rule 200, so anything after rule 200 won’t override that.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When blocking an IP address, how would you do it?

A

Use NACL’s. Create an inbound rule BEFORE any ALLOW rules for that port, and enter a deny on that IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are VPC endpoints for?

A

Allows you to connect from your VPC into other AWS resources without leaving the AWS network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are the two types of VPC Endpoints?

A

Interface: Support many more services, It’s an ENI
Gateways: Dynamo and S3 only - Creates a gateway machine similar to a NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What would the steps be to grant access to an EC2 instance in a private subnet to a DynamoDB database using VPC Endpoints?

A

Create the VPC Endpoint (Gateway)
Ensure the route table is updated to include a route to this VPC endpoint

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is VPC Peering?

A

Allows you to connect VPCs together. lets them act as if they were in the same network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is transitive peering?

A

Its not supported. Its allowing a VPC to indirectly connect to another one. VPCs that are peered must be directly connected.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Can you VPC Peer across regions? Across Accounts?

A

Yes and yes!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Are there caveats with VPC peering?

A

CIDR ranges cannot overlap.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is AWS Privatelink used for?

A

Allows you to connect a VPC to other VPCs at scale. You can connect to many customer VPCs

Officially: AWS PrivateLink provides private connectivity between VPCs, AWS services, and your on-premises networks, without exposing your traffic to the public internet.

AWS PrivateLink makes it easy to connect services across different accounts and VPCs to significantly simplify your network architecture and make it less vulnerable to attack vectors

Think AWS CloudHub but not over the internet.

VPC Endpoints are powered by AWS Privatelink

22
Q

What is AWS Cloudhub used for?

A

Allows you connect multiple sites together if they all use VPNs. Think “hub and spoke”

think of this related to “aggregating customer VPN connections” or “connecting from AWS to multiple different customer networks” using

Virtual Private Gateway –> VPN/ipSec –> Customer Gateway

23
Q

What is AWS Direct Connect for?

A

Allows you to connect your data center to AWS.

Does not use the public internet.

You can use AWS Direct Connect to create a dedicated private connection from a remote network to your VPC. You can combine this connection with an AWS-managed VPN connection to create an IPsec-encrypted connection.

24
Q

What are the two types of connections for AWS Direct Connect

A
  1. Dedicated Connection - physical ethernet connection
  2. Hosted connection - physical ethernet also, but thru an AWS direct connect partner
25
Q

What is AWS Transit Gateway for?

A
  • Allows you to simplify your network topology.
  • No more complex peering relationships among VPCs and data centers
  • Think hub and spoke
  • Does allow transitive peering
  • support IP Muticast
26
Q

What AWS service allows you to simplify your network topography?

A

AWS Transit Gateway

27
Q

How would you make a high availability NAT Gateway?

A

Create one NAT Gateway per availability zone. Ensure that the resources use the NAT gateway in the same AZ the resource is in.

28
Q

What is it called when you attach an ENI to a running instance?

A

Hot attach

29
Q

What is it called when you attach an ENI to an instance as it is starting up?

A

Cold attach

Mneumonic

Hot–> Warm –> Cold

Running –> Stopped –> Launching

30
Q

What is it called when you attach an ENI to an instance when its stopped?

A

Warm attach

Mneumonic

  • R → S → L
  • H → W → C
31
Q

Does the default NACL allow or deny traffic by default?

A

Allow

32
Q

Does a newly created NACL allow or deny all traffic by default?

A

Custom ACLs DENY all traffic until you add rules.

33
Q

Can you remove or edit the asterisk rule in an NACL?

A

No. you cant edit or remove it.

34
Q

At what level to Security Groups operate?

A

At the EC2 Instance level.

35
Q

Can you delete the default security group?

A

no.

36
Q

In a PUBLIC subnet what steps need to be taken to make sure an EC2 instance deployed to that subnet has internet access?

A
  1. You must create an internet gateway and associate it with the VPC
  2. Must set the subnet to “Auto-Assign Public IPv4 addresses”
  3. Must add a route in the routing table to the Internet Gateway for 0.0.0.0/0
  4. Must ensure the subnet is associated with the Route table with the internet gateway
  5. EC2 instance must have a public IP address
37
Q

In a PRIVATE subnet what steps need to be taken to make sure an EC2 instance deployed to that subnet has internet access?

A
  1. You must have an internet gateway that is associated with the VPC
  2. Create a NAT gateway and associate it with the VPC (in the public subnet)
  3. Add a Route to the NAT gateway in the Route Table associated with the private subnet from 0.0.0.0/0.
  4. Note: The Route Table associated with the Private subnet can be the Main RT because there is no route into this Subnet.
38
Q

What 3 components get created when you create a custom VPC? What 3 components do NOT automatically get created?

A

Automatic

  1. Route Table (main)
  2. Default Security Group (Closed)
  3. Main Network NACL (Open)

Not Automatic

  1. Subnets
  2. Internet Gateway
  3. NAT Gateway
39
Q

How many addresses are reserved by AWS when you create a subnet?

A
  1. The first 4 and the last IP Address
40
Q

What is the valid largest and smallest range for IP Addresses?

A

/16 is the largest

/28 is the smallest usable

/32 would specify a single IP Address

41
Q

How many Internet Gateways can you have per VPC?

A

1

42
Q

What makes a subnet a “public” subnet?

A

A subnet is public if its traffic is routed to an internet gateway

43
Q

What is the difference between 110.238.98.7/32 and 110.238.98.71/0

A

/32 indicates one IP address and /0 indicates the whole network.

44
Q

What 3 AWS and remote assets could you use, generally, to connect a remote network to a VPC in AWS?

A
  • VPC would have an attached Virtual Private Gateway
  • Remote network has a customer gateway with VPN connection enabled (Customer Gateway)
  • Set up the routing that VPC bound traffic is routed to the VPG
45
Q

How many security groups can you assign to an EC2 instance?

A

up to 5

46
Q

How can you reuse your existing VPN equipment to connect to AWS over the internet

A

AWS Managed VPN

47
Q

Does AWS Direct Connect operate over the internet?

A

No. It uses a private connection.

48
Q

Describe how you’d configure your private network to connect to a VPC in AWS. What are the Crucial parts?

A
  • Virtual Private Gateway in the VPC
  • Customer Gateway in the private network
  • VPN traffic from the customer gateway is routed to the VPG
48
Q

Describe how you’d configure your private network to connect to a VPC in AWS. What are the Crucial parts?

A
  • Virtual Private Gateway in the VPC
  • Customer Gateway in the private network
  • VPN traffic from the customer gateway is routed to the VPG
49
Q

Using VPC endpoints how can you control access to a large number of S3 buckets

A

Apply an “endpoint policy” to the VPC Endpoint

50
Q

What state should an instance be in to perform a Hot, Warm, and Cold ENI Attach?

A

ENI can be attached to an instance when it’s running (hot attach), when it’s stopped (warm attach), or when the instance is being launched (cold attach)

Mneumonic

Hot–> Warm–> Cold

R–> S –> L

(Running) –> Stopped –> Launching

51
Q

What is traffic mirroring in a VPC?

A

A feature that lets you copy traffic from an elastic network interface to do things like

  • content inspection
  • threat monitoring
  • troubleshooting

AWS CSA-A and CSOA-A (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions