Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect > VPC > Flashcards

VPC Flashcards

1
Q

What does the CIDR consist of?

A

Base IP: Represents an IP contained in a range
Subnet Mask: Defines how many bits can change in the IP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What allows us to access our VPC over the internet?

A

An internet gateway that is attached to our VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do we know if a subnet is public or private?

A

If it has access to an internet gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How many IP addresses are reserved by your subnet for AWS usage?

A

5, the first 4 and the last one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many VPCs can be attached to an Internet Gateway

A

Only one, and vice versa

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

We have created an IG and attached it to our VPC, but resources cannot connect to the internet, why?

A

Route tables must be edited to allow public access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are NAT instances?

A

An EC2 instance that acts as an intermediary between a private subnet and the public internet. It allows EC2 instances in private subnets to access the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the difference between a NAT Gateway and an Internet Gateway

A

An Internet Gateway allows public facing resources to access the internet
A NAT Gateway allows for resources in a private subnet to reach the internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How many regions can a VPC span?

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

True or False: NAT Gateway spans multiple AZs by default

A

False. NAT GTW can only be in one zone. You must create multiple gateways in multiple AZs for fault-tolerance. Instances in multiple AZs can use one NAT Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

True or False: NAT Gateways allow traffic to the internet but not from the internet

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the purpose of the VPC’s Main Route Table?

A

It controls routing to/from a subnet or gateway. It is automatically applied for all un-associated subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

True or False: You cannot associate a subnet with more than one route table?

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Of NACL vs SG, which one is stateless and which one is stateful?

A

SG is stateful, NACL is stateless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does the NACL control access to?

A

Subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How many NACL’s are there per subnet?

A

One

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

You have two competing NACL rules, how is it decided which one “wins”?

A

All rules have numbers, the lower number wins

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the difference between a NACL and route table?

A

A NACL is a firewall, meant to accept or block traffic. A route table directs associated traffic to where it needs to go

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

True or False: The default NACL automatically denies all inbound/outbound traffic?

A

False. It accepts all traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is the difference between NACL and a Security Group?

A

SGs operate at the instance level, NACLs operate at the subnet level. NACL’s traffic rules apply to all instances in the subnet they are associated with

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the significance of the Security Group being stateful?

A

It will allow outbound traffic if the inbound traffic is accepted, whereas something like the NACL which is stateless, must have an explicit inbound/outbound ruling and must consider ephemeral ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

True or False: If VPC A is peered with VPC B and VPC B is peered with VPC C, than VPC A and VPC C are peered.

A

False. We must explicitly peer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

True or False: We cannot peer two VPCs in different accounts

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the purpose of VPC endpoints?

A

It allows AWS resources inside a VPC to communicate to AWS resources outside a VPC. It uses a private network instead of a public network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does VPC Endpoints use to communicate with external AWS resources?

A

AWS PrivateLink

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What are the types of endpoints for VPC Endpoint?

A

Interface Endpoint: Utilize AWS PrivateLink to link to external resources in AWS network
Gateway Endpoint: Utilizes a subnet route table to route calls through a gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What are the two services that support VPC Gateway Endpoints?

A

S3 and DynamoDB

27
Q

What is the preferred Endpoint for S3

A

Gateway Endpoint. Free and easy configuration

28
Q

What does the AWS Site-to-Site VPN connection need?

A

Virtual Private Gateway: Created on the AWS VPC side

Customer Gateway: Application or device on customer side

29
Q

What is the difference between AWS DX and AWS VPN?

A

Direct Connect is over a private provided network; VPN is over public but encrypted through the VPN

30
Q

What are the Direct Connect connection types?

A

Dedicated Connections and Hosted Connections; Dedicated Connections tend to have higher capacity

31
Q

True or False: Data over Direct Connect is encrypted?

A

False. We must set up a VPN to encrypt data

32
Q

How can we set up maximum resiliency in Direct Connect?

A

Set up multiple connections in each Direct Connect location

Check Notes

33
Q

What is the max number of CIDR per VPC?

A

5

34
Q

What is the min and max CIDR size in VPC?

A

/28 is the min and /16 is the max

35
Q

What is a Bastion Host?

A

Bastion Hosts allow internet access (SSH) to a private subnet through a public subnet.

36
Q

What must the Bastion Host security group allow to access private subnet?

A

Must allow inbound traffic from the internet on port 22 from restricted CIDR (addresses allowed through to private). The security group of the private subnet must allow the Bastion Host private IP

37
Q

What is the difference between a NAT Instance and a Bastion Host?

A

A bastion host allows us to SSH into a private instance from a public one. A NAT Instance allows us to access the internet without worrying about inbound traffic from the internet

38
Q

What are ephemeral ports in relation to NACLs?

A

When clients are making requests, they initiate a request on a specific port, but expect to receive a response on a specific port range, known as ephemeral ports; it’s important to configure these in the NACLs

39
Q

What is VPC peering?

A

VPC peering allows two VPCs to privately communicate over AWS’ network

40
Q

True or False: We must update the route tables in each VPC’s subnets to ensure EC2 instances can communicate with each other in VPC peering

A

True

41
Q

True or False: A VPC has one router and one route table

A

False. A VPC has one router but can have multiple route tables. The router is responsible for directing traffic according to the route tables

42
Q

How do we provision a VPC Gateway Endpoint?

A

We create one, choose which VPC and define which route table it will be directed through

43
Q

Are route tables inbound or outbound defining?

A

Route tables define both outbound and inbound traffic depending on the destination and target. Traffic from outside the VPC can be directed but are blocked by NACLs and Security Groups

44
Q

What are VPC flow logs?

A

VPC flow logs capture information about IP traffic going into your interfaces

45
Q

How can we query the VPC flow logs?

A

Athena on S3
CloudWatch Logs Insights

46
Q

What is AWS VPN CloudHub?

A

It allows one Virtual Private Gateway (VCW) to connect to multiple Cusotmer Gateways for site-to-site VPN

47
Q

What IP address do we use for the Customer Gateway Device in site-to-site VPN connections?

A

Either the public IP address of the Customer Gateway device OR if it’s behind a NAT device (the Customer Gateway has a private IP) use the public IP of the NAT device

48
Q

What is AWS Transit Gateway?

A

Transit Gateway is a network transit hub used to interconnect your VPCs and on-premise networks. It also allows us to share Direct Connect between multiple accounts

49
Q

We need to support IP Multicast. What service can we use?

A

AWS Transit Gateway

50
Q

What is ECMP?

A

ECMP is Equal-cost multi-path routing. It is a feature provided by Transit Gateway. It allows use to create multiple site-to-site VPN connections to increase the bandwidth of the connections to AWS

51
Q

What is VPC Traffic Mirroring

A

Traffic Mirroring captures traffic from an ENI to an ENI (or Network Load Balancer), filters it and can send it to a monitoring application

52
Q

True or False: IPv4 can be disabled for your VPC and subnets?

A

False

53
Q

True or False: Egress-only Internet Gateway is for both IPv4 and IPv6

A

False. Only for IPv6; Egress-only IG allows for outbound (egress) traffic only

54
Q

True or false: Instances in Private Subnets can access the Egress-only IGW without a NAT Gateway

A

True. But is must be defined in the Route Table

55
Q

Security Groups operate at the …………….. level while NACLs operate at the …………….. level

A

EC2 Instance, NACL

56
Q

You would like to provide Internet access to your EC2 instances in private subnets with IPv4 while making sure this solution requires the least amount of administration and scales seamlessly. What should you use?

A

NAT Gateway

57
Q

You have set up a Direct Connect connection between your corporate data center and your VPC A in your AWS account. You need to access VPC B in another AWS region from your corporate datacenter as well. What should you do?

A

AWS Direct Connect Gateway

58
Q

If you want a 500 Mbps Direct Connect connection between your corporate datacenter to AWS, you would choose a dedicated or hosted connection?

A

Hosted. Dedicated supports 1Gbps and 10 Gbps

59
Q

When you set up an AWS Site-to-Site VPN connection between your corporate on-premises datacenter and VPCs in AWS Cloud, what are the two major components you want to configure for this connection?

A

Virtual Private Gateway and Customer Gateway

60
Q

Your company has several on-premises sites across the USA. These sites are currently linked using private connections, but your private connections provider has been recently quite unstable, making your IT architecture partially offline. You would like to create a backup connection that will use the public Internet to link your on-premises sites, that you can failover in case of issues with your provider. What do you recommend?

A

AWS VPN CloudHub. Allows you to securely communicate with multiple sites using AWS VPN. It is a hub-and-spoke model

61
Q

You need to set up a dedicated connection between your on-premises corporate datacenter and AWS Cloud. This connection must be private, consistent, and traffic must not travel through the Internet. Which AWS service should you use?

A

AWS Direct Connect

62
Q

True or False: Using a Direct Connect connection, you can access both public and private AWS resources

A

True

63
Q

You want to scale up an AWS Site-to-Site VPN connection throughput, established between your on-premises data and AWS Cloud, beyond a single IPsec tunnel’s maximum limit of 1.25 Gbps. What should you do?

A

Transit Gateway

64
Q

You have a VPC in your AWS account that runs in a dual-stack mode. You are continuously trying to launch an EC2 instance, but it fails. After further investigation, you have found that you are no longer have IPv4 addresses available. What should you do?

A

Add an additional IPv4 CIDR to your VPC

65
Q

Which AWS service allows you to protect and control traffic in your VPC from layer 3 to layer 7?

A

AWS Network Firewall

AWS Solutions Architect (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions