VPC Flashcards
Wha is VPC?
Virtual Private Network
Page 315
What is SubNet
It’s a network in the VPC, which is the result of partitioning the VPC in several networks.
Page 315
What is a Public Subnet
A subnet that can be reached from internet
Page 315
What is a Private Subnet
A Subnet that is not accessible from the Internet but only VPC.
Page 315
Which entity information is used to define the access between subnets?
Route Tables that are used in Routers (Lyr 3)
Pge 315
What do you use to connect The internet to your VPC instance?
Internet Gateway?
Page 317
What are the function of NAT Gateways and NAT Instances?
Provides internet acces to your **Private Subnets^^.
Page 317
What is the diference between NAT Gateway and NAT Instance?
NAT Gateway is an AWS-Managed services and NAT Instances is a Self-managed service.
Page 317
Does a PublicSubnet requires some device to connect to The Internet (Outpt traffic)
No, Public Subnets have access to the internet by default.
Page 317
What is NACL?
Network ACL
It’s a Firewall forSubnets
What are the main features of ACL?
- Control the IN/Out Traffic of the Subnet.
- The rule can be ALLOW or DENY.
- Only works with the IP specified.
Page 318
What is a Security Group?
A Firewall only for ENI (Elastic Network Interface) and EC2 instances.
Page 318
What are the main features of Security Group?
- It works at Instances level (EC2 or ENI).
- it only can have ALLOW Rules.
- The rules have IP and another security Groups.
Page 318
What is VPC Flow Logs?
it’s a service to capture all the traffic that going into the next interfaces:
* VPC Flow Logs
* Subnets
* Elastic Network Interface
Page 320
Where Can the Log of VPC Flow Logger be stored?
- CloudWatch Logs
- S3
Page 320
What is VPC Peering?
A service to connect VPCs among them in a privately way making them working as they were in the same network.
Page 321
Can two VPCs that are connected by a VPC Peering have the same IP Address Segments?
NO, the must have differents CIDR (IP Address Range)
Page 321
Imagine havig three VPCs connected throght AWS Peerings with this topologic:
VPC B <-PEERING-> VPC A <-PEERING-> VPC C
Does VPC C can reach the VPC B and why?
NO, VPC Peering connections isn’t a Transitive Traffic
Using VPC Peerings only allows reach the other VPC connected. You need to create another VPC between VPC B and VPC C to have access each other.
Page 321
What is VPC End Point?
Allow to connect AWS Services throught a Private Subnet, there is no a Public Subnet.
Page 322
What are the two categories of VPC Endpoint:
- Endpoint Gateway, used for DynamoDB and S3.
- Endpoint Interface, for the remain services
Page 322
What is VPC Private Link?
Privately connect to a service in a 3rd party VPC
private link among a 3th Party VPC and VPC.
Page 323
What do you need to have a VPC Private Link?
You require connect a Load Balancer and an ENI as:
From 3rd PartyVPC:
+ AWS Load Balance
From AWS VPC:
+ Elastic Network Interface (ENI)
Page 323
What can you use to connect an On-Premis VPN and AWS VPC throung the Public Internet?
Site-To-Site VPN
Page 324
What can you use to connect an On-Premis VPN and to AWS VPC throung a Private Network?
Direct Connect
* It requieres a phisical connection between Your On-Premise and AWS.
* It requieres at last a month to stablish.
Page 324
What are the part that comform a Site-To-Site VPN?
- On-Premise: Customer Gateway (CGW)
- AWS: Virtual Private Gateway (VGW), from AWS
Page 325
What is AWS Client VPN?
OpenVPN Connection from your computer into your VPC
It’s a VPN Client over OpenVPN to connect to AWS or On-Premise Network.
Page 326
What do you use to connect an EC2 instance over a private Network, if it was in a Private VPC network?
AWS VPN Client
Page 326
What is the AWS VPN Client Topologic?
- Workstation with AWS VPN Client.
- AWS VPC
- OnPremise Network.
The AWS VPN Client must be used on the Public Internet.
Page 326
What is Transit Gateway?
It’s a Special Peering where can be connected:
+ VPC
+ OnPremises networks
+ Direct Connect Gateways
+ VPN Connections
..under a STAR TOPOLOGIC
Page 328
Can a Subnet be part of Multiple AZ?
NO, they belong to an unique AZ.
Page 329
What is of this leves works Internet Gateway?
a. VPC Level
b. EC2 Instance Level.
c. Load Balancer Leve,
A
Gives the VPC access to the Internet and applys for all the Instanes in the Subnet.
Page 329
What is of this leves works Security Group?
a. VPC Level
b. EC2 Instance Level.
c. Load Balancer Leve,
B
It control the traficthat IN, in a EC2 Instance.
Page 329
Is NACL stateless of stateful?
NACL (Firewall) is a stateless service that control the IN/Out traffic in a subnet.
Page 329
Is Security Group stateless of stateful?
Stateful, controll all the IN traffinc and allows all the Outbound traffic.
Page 329
