Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Test > VPC > Flashcards

VPC Flashcards

1
Q

What are the elements of a VPC?

A
  1. IP Address Range (CIDR Block)
  2. Subnets
  3. Route Tables
  4. Internet Gateway
  5. NAT Gateway/NAT Instance
  6. Security Groups
  7. Network Access Control Lists (NACLs)
  8. Elastic IP Addresses
  9. VPC Peering
  10. VPC Endpoints
  11. Virtual Private Gateway (VPN/Direct Connect)
  12. Flow Logs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Virtual Private Gateway?

A

A virtual private gateway enables secure communication between your VPC and your on-premises network using either VPN connections or AWS Direct Connect.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is VPC CIDR Block?

A

IP Address Range (CIDR Block): When creating a VPC, you define an IP address range for the VPC using Classless Inter-Domain Routing (CIDR) notation. This range determines the available IP addresses for your VPC’s subnets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are VPC Subnets?

A

Subnets: Subnets are subdivisions of a VPC’s IP address range. Public subnets have direct access to the internet, while private subnets do not. 1 subnet is always in 1 Availability Zone.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are VPC Route Tables?

A

Route Tables: A route table defines the rules for routing traffic between subnets, as well as to the internet or other network destinations. Each subnet is associated with a route table that specifies where network traffic should be directed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is VPC Internet Gateway?

A

Internet Gateway: An internet gateway allows resources in public subnets to connect to the internet or AWS public zone. It serves as a gateway for traffic between the VPC and the public internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a NAT Gateway/NAT Instance?

A

NAT Gateway/NAT Instance: NAT (Network Address Translation) gateways or NAT instances allow resources in private subnets to initiate outbound traffic to the internet while still maintaining security. They act as intermediaries for sending traffic from private subnets to the internet.
- Not associated with security groups.
- Should be added in a public subnet.
- 5-45 Gbps.
- If you’re using NAT Gateways and your resources are spread across different Availability Zones, it’s important to make sure each Availability Zone has its own NAT Gateway. If one NAT Gateway goes down, resources in other Availability Zones won’t lose internet access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are Security groups?

A

Security Groups: Security groups are virtual firewalls that control inbound and outbound traffic to instances within a subnet. They are stateful and control traffic based on security group rules.
- In order to communicate to your EC2 instances via SSH, RDP, or HTTP, you will need to open up the correct ports.
- By default, all inbound traffic is blocked, and all outbound traffic is blocked.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are NACLs?

A

Network Access Control Lists (NACLs): NACLs are stateless network traffic filters that control traffic entering and leaving subnets. They are less granular than security groups but operate at the subnet level.
- Can block specific IP addresses.
- By default, all inbound/outbound traffic is allowed.
- A subnet can be associated with only 1 network ACL at a time. When you associate a network ACL with a subnet, the previous association is removed.
- Network ACLs contain a numbered list of rules that are evaluated in order, starting with the lowest-numbered rule.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are Elastic IP Addresses?

A

Elastic IP Addresses: Elastic IP addresses are static, public IP addresses that you can associate with instances or network interfaces in your VPC. They are useful for resources that need to have a consistent public IP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is VPC peering?

A

VPC peering allows you to connect 2 VPCs using private IP addresses, enabling resources in different VPCs to communicate as if they were in the same network.
- You can peer VPCs with other AWS accounts.
- You can peer between regions.
- In the same region, ASGs can reference each other directly. In different regions, ASGs reference each other with IP addresses or IP ranges.
- Peering is in a star configuration (e.g., 1 central VPC peers with 4 others).
No transitive peering! ( hub-and-spoke model)
- We create a VPC peering, create the routes, and if necessary the SGs and ACLS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are VPC endpoints?

A

VPC endpoints provide a private connection between your VPC and supported AWS services, avoiding the need to traverse the public internet.

2 Types of VPC Endpoints:
- Interface endpoints: an elastic network interface with a private IP address that serves as an entry point for traffic headed to a supported
service. They support a large number of AWS services.

  • Gateway endpoints: Similar to NAT gateways, a gateway endpoint is
    a virtual device you provision. It supports connection to S3 and DynamoDB.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are VPC Flow Logs?

A

VPC Flow Logs capture information about IP traffic flowing to and from network interfaces in your VPC, providing insight into network activity.

DON’T monitor packet contents … that requires a packet sniffer. Only packet metadata(source IP, destination IP, ports, packet size etc)

Can be stored on S3 or CloudWatch Logs.

Are NOT real time.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is AWS PrivateLink?

A

AWS PrivateLink is a private networking technology that allows you to securely connect your VPC (Virtual Private Cloud) to services as if they were in your VPC. This means that you can connect to AWS services, services hosted by other AWS accounts, and supported AWS Marketplace services without exposing your traffic to the public internet.

  • Doesn’t require VPC peering; no route tables, NAT gateways, internet gateways, etc.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is ENI?

A

ENI stands for Elastic Network Interface. It’s a virtual network interface that you can attach to an Amazon Elastic Compute Cloud (Amazon EC2) instance in an Amazon Virtual Private Cloud (Amazon VPC). An ENI acts as a network adapter, providing networking capabilities to an EC2 instance.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is AWS VPN CloudHub?

A
  • If you have multiple sites, each with its own VPN connection, you can use
    AWS VPN CloudHub to connect those sites together. It’s similar to VPC
    peering in that it works on a hub-and-spoke model.
  • AWS VPN CloudHub is low-cost and easy to manage. Though it operates over the public internet, all traffic between the customer gateway and the AWS VPN CloudHub is encrypted.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Direct Connect?

A

AWS Direct Connect links your internal network to an AWS Direct Connect location over a standard Ethernet fiber-optic cable. One end of the cable is connected to your router, the other to an AWS Direct Connect router.

With this connection, you can create virtual interfaces directly to public AWS services (for example, to Amazon S3) or to Amazon VPC, bypassing internet service providers in your network path.

Business Premises => DX Location => AWS Region. AWS regions have multiply Direct Connect Locations.

Speed: 1G or 10G or 100G

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the 2 types of Direct Connect connection?

A
  • Dedicated Connection(Customer DX router to AWS DX router): A physical Ethernet connection associated with a single customer. Customers can request a dedicated connection through the AWS Direct Connect console, the CLI, or the API.
  • Hosted Connection(Provider DX router to AWS DX router): A physical Ethernet connection that an AWS Direct Connect Partner provisions on behalf of a customer. Customers request a hosted connection by contacting a partner in the AWS Direct Connect Partner Program, who provisions the connection.

Direct Connect connections happen in AWS DX Locations. A connection is a port allocation to AWS DX router.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

VPNs vs. Direct Connect

A

VPNs allow private communication, but it still traverses the public internet to get the data delivered. While secure, it can be painfully slow.
DIRECT CONNECT IS:
- Fast
- Secure
- Reliable
- Able to take massive throughput

Can be used together because Direct Connect takes time to be implemented while VPNs can be up in hours.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is AWS Transit Gateway?

A

AWS Transit Gateway connects VPCs and on-premises networks through a central hub. This simplifies your network and puts an end to complex peering relationships. It acts as a cloud router — each new connection is only made once.
- Allows you to have transitive peering between thousands of VPCs and on-premises data centers.
- Works on a hub-and-spoke model.
- Works on a regional basis, but you can have it across multiple regions.
- You can use it across multiple AWS accounts using RAM (Resource Access Manager).
- You can use route tables to limit how VPCs talk to one another.
- Works with Direct Connect as well as VPN connections.
- Supports IP multicast (not supported by any other AWS service).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is AWS Wavelength?

A

AWS Wavelength embeds AWS compute and storage services within
5G networks, providing mobile edge computing infrastructure for developing, deploying, and scaling ultra-low-latency applications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How many default VPCs can exist in a Region?

A

1 default VPC but you can have many custom VPCs in a Region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the default VPC CIDR block in AWS?

A

172.31.0.0/16 It only gets one and it is always the same.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How many subnets does the default VPC have?

A

One subnet (/20) in each Availability Zone (AZ) of the AWS region where it’s created.

25
Q

Can the default VPC be removed?

A

Yes, can be removed and recreated.

26
Q

What are the elements of the default vpc?

A

Subnets (/20) in each AZ. Internet Gateway(IGW), Security Group(SG), NACL

27
Q

In the default VPC are subnets configured in such a way that instances launched within those subnets are assigned public IP addresses by default?

A

Yes.

28
Q

Where does the option “Enable DNS resolution” on a VPC help?

A

Is helpful for allowing your VPC resources to communicate with each other and with resources on the internet. For example, if you have an EC2 instance in your VPC that needs to access a database in your VPC, DNS resolution will allow the EC2 instance to find the database’s IP address.

29
Q

Where does the option “Enable DNS hostnames” on a VPC help?

A

Is helpful for making your VPC resources easier to identify and manage. For example, if you have two EC2 instances in your VPC, you can give them DNS hostnames of webserver1 and webserver2. This will make it easier for you to identify and manage these resources.

30
Q

Which are the reserved IPs in each subnet?

A

e.g 10.16.16.0/20
1. Network address (10.16.16.0) - the first address of any subnet(not specific to AWS).
2. Network + 1 (10.16.16.1) - VPC Router(in AWS)
3. Network + 2 (10.16.16.2) - DNS (in AWS)
4. Network + 3 (10.16.16.3) - For future use
5. Broadcast address (10.16.31.255) - (even though broadcast is not supported in AWS).

31
Q

Do you need an Internet Gateway per AZ to connect to the Internet?

A

No. Internet Gateway is region-resilient. One Internet Gateway will cover all AZs in the region.

32
Q

How many Internet Gateways a VPC can have?

A

0 (private VPC) or 1 (public VPC)

33
Q

“Public IPv4 address is not directly attached to the instance or any interfaces, it is associated with it”. What does this mean?

A

If the IPv4 is directly attached, the OS utilities would be aware of it (things like ifconfig, etc. in Linux).
If you connect to a Linux instance and display the IPv4 addresses, you will only see the private ones.
The public IP address is associated with the private IPv4 address in the internet gateway.

34
Q

Does the operating system of an EC2 instance have the Public IPv6 of the instance?

A

Yes.

35
Q

What is a Bastion Host/jumpbox?

A

It is an instance inside a public subnet in a VPC. It is generally the only way to access private resources inside a VPC.

36
Q

What are the steps to make a subnet public?

A
  1. Create an Internet Gateway.
  2. Associate the IG with the subnet’s VPC.
  3. Create a route table for the subnet.
  4. Associate the route table with the subnet.
  5. Add default routes onto the route table pointing at the IG.
  6. Enable the allocation of IPv4 addresses for the subnet.
37
Q

With how many subnets can an instance be associated?

A

An instance must be associated with a single(one and only) subnet in order to receive a network interface and an IP address.

38
Q

What are Security Group’s logical references?

A

Security group logical references allow you to reference security groups in other security groups. This can be useful for creating more complex and granular security policies.

39
Q

What are Security Groups self-references?

A

Security Groups in AWS can have “self-references,” which means you can configure a security group to allow traffic from instances associated with the same security group.
For example: You might want to allow instances in the same security group to communicate on certain ports (e.g., database ports) while restricting other ports.

40
Q

What kind of IP does a NAT Gateway use?

A

Uses Elastic IPs (Static IPv4 Public)

41
Q

What is the important step that needs an EC2 instance to function like a NAT instance?

A

Disable source/destination checks. This is essential because it allows the instance to forward traffic from private subnets to the internet and vice versa without dropping the packets due to source/destination checks.

42
Q

When a NAT instance should be preferred over a NAT Gateway?

A

Rarely. If cost is the primary choice or if you deploy services in a test VPC. You can use a very small EC2 instance, even in free-tier, and have predictable costs. A NAT GAteway is not free-tier eligible. You have also access to manage a NAT instance(e.g. use it also as a bastion host).

43
Q

Can you use SGs and NACLs with NAT Gateways?

A

Only NACLs, do not support SGs.

44
Q

How does NAT Gateways work with IPv6?

A

NAT Gateways aren’t required and do not work with IPv6. All IPv6 addresses are publicly routable. The internet Gateway works will all IPv6 addresses directly.

45
Q

What service would you use if you want IPv6 outbound access only?

A

Egress-only Internet Gateway.

46
Q

Is it true that some services could behave oddly if a default VPC does not exist?

A

Yes. For example, if you try to launch an EC2 instance without specifying a VPC, the instance will be launched into the default VPC. However, if there is no default VPC, the instance will fail to launch.

47
Q

How can an Internet Gateway (IGW) be configured to be highly available?

A

It is HA by default(when attached to a VPC).

48
Q

How many route tables can a subnet be associated with in Amazon Virtual Private Cloud (Amazon VPC)?

A

A subnet can be associated with only one route table at a time.

49
Q

At what levels can VPC flow logs be created?

A
  • VPC Level
  • Subnet Level
  • Network Interface Level (ENIs)
50
Q

What type of IP traffic might not be monitored by VPC Flow logs?

A
  • Traffic generatd by instances when they contact the Amazon DNS server
    • If you use your own DNS server, traffic to it <em>will</em> be logged
  • Traffic generated by Windows instances for Amazon Windows license activation
  • Traffic to and from 169.254.269.254 for instance metadata
  • DHCP Traffic
  • Traffic to the reserved IP address for the default VPC router
51
Q

What are the VPC Flow Log Protocol Numbers for ICMP, TCP, UDP?

A
  • ICMP (1): Used for network management and error reporting.
  • TCP (6): Reliable, connection-oriented protocol used for applications like web browsing and file transfers.
  • UDP (17): Unreliable, connectionless protocol used for applications that require low latency, such as streaming media and online gaming.
52
Q

What is an Egress-Only Internet Gateway (EOIG) and when is it used?

A

An Egress-Only Internet Gateway is used in Amazon VPCs with IPv6 connectivity. It enables outbound IPv6 traffic to the internet while blocking incoming unsolicited traffic. It’s used for secure outbound access and is ideal when you need to allow IPv6 traffic to reach the internet while maintaining strict control over inbound traffic.

53
Q

What are VPC Gateway endpoints?

A
  • Gateway endpoints are a type of VPC endpoint that allows access to S3 and DynamoDB without using public addressing.
  • Gateway endpoints add ‘prefix lists’ to the route table, allowing the VPC router to direct traffic flow to the public services via the gateway endpoint.
  • Endpoint policy is used to control what it can access.
  • Regional… cannot access cross-region services.
  • HA by default. across all AZs in a region.
54
Q

What are VPC Interface endpoints?

A
  • Provide private access to AWS services. Anything but DynamoDB, S3(recently is supported!)
  • Added to specific subnets - an ENI - not HA.
  • Security Groups and Endpoint Policies can be used.
  • TCP and IPv4 only. Subset of PrivateLink.
  • Endpoint provides a NEW service endpoint DNS(not prefix lists like Gateway endpoints)
55
Q

What are the different types of VPC interface endpoints in Amazon VPC?

A
  • Regional Endpoints: These endpoints are created in a specific AWS region and allow your VPC to access AWS services within that region over a private network connection. They are used for services that are regional in scope.
  • Zonal Endpoints: These endpoints are associated with specific Availability Zones within a region and allow your VPC to access AWS services that are localized to those Availability Zones. They are used for services with a zonal scope and provide high availability.
  • Private DNS Endpoints: (DEFAULT)These endpoints override the default DNS resolution for specific AWS services. They ensure that the DNS requests for these services are resolved to private IP addresses, allowing for secure and private communication with those services without public internet exposure.
56
Q

What is IPsec VPN?

A

IPsec VPN, or Internet Protocol Security Virtual Private Network, is a security protocol suite that ensures secure communication over untrusted networks, like the internet. It achieves this by encrypting and authenticating data packets, thus protecting their confidentiality and integrity. IPsec VPNs are used for various purposes, including secure remote access for users and site-to-site connections for linking multiple networks securely. These VPNs use authentication methods and encryption algorithms to provide robust security, making them essential for safeguarding data during transmission and enabling secure connections over public networks.

IPsec VPN negotiation occurs in two phases. In Phase 1, participants establish a secure channel in which to negotiate the IPsec security association (SA). In Phase 2, participants negotiate the IPsec SA for authenticating traffic that will flow through the tunnel.

57
Q

What is AWS Site-to-Site VPN?

A

AWS Site-to-Site VPN is a hardware VPN solution that creates a highly available IPSEC VPN between an AWS VPN and an external network such as on-premises traditional networks. VPNs are quick to set up(less than an hour) vs Direct Connect, don’t offer the same high performance, but do encrypt data in transit.

VPN connection between the Virtual Private Gateway(VGW) and the Customer Private Gateway (CGW). VGW creates 2 physical endpoints for each CGW. For HA more than 1 CGW is needed.

58
Q

What is the difference between static and dynamic VPN in AWS?

A
  • A static VPN uses static routes to define the paths that traffic should take between your on-premises network and your VPC. This means that you need to manually configure the routes on your on-premises network and your VPC. Static VPNs are a good choice for small deployments where the network topology is not expected to change frequently.

Static VPNs typically utilize the IPsec protocol to establish a secure tunnel between the on-premises network and the VPC. IPsec ensures that all traffic flowing through the tunnel is encrypted and authenticated, protecting it from unauthorized access.

  • A dynamic VPN uses Border Gateway Protocol (BGP) to exchange routing information between your on-premises network and your VPC. This means that the routes are automatically updated as the network topology changes. Dynamic VPNs are a good choice for larger deployments where the network topology is expected to change frequently.

Test (22 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions