VPC

Question 1

IP Address Planning

Answer 1

Making sure that most stakeholders’ vpc’s are avoided. This can be done by simply asking and confirming ranges

Question 2

Recommended VPC CIDR Ranges

Answer 2

10.x.y.z where n>16

ie 10.16.0.0/16

Remember google uses 10.128.0.0

Therefore best range would be from

10.16.0.0-10.127.0.0

i.e, 10.16.0.0/20,
10.16.32.0/20,
10.16.48.0/20,
10.16.64.0/20

Question 3

VPC services run from within subnets and not from the VPC

Answer 3

True

Question 4

Recommended CIDR Ranges II

Answer 4

Aim for atleast one reserved subnet for growth. Therefore up to about four Subnets.

VPC = /16
Subnets=AZ
16/4 = 4 per subnets

and then each Subnets, 4 Tiers
i.e 4*4 = 16 ranges = /20

Question 5

Other CidR considerations

Answer 5

target for 4 Tiers in each AZ

Question 6

VPC Colors

Answer 6

Blue - Private Subnet
Green - Public Subnet

Question 7

Inter-subnet communication

Answer 7

Inside a VPC, there’s free communication of subnets by default

Question 8

Recommended Subnet Model

Answer 8

AZ-a
- App Subnet (10.16.16.0/20)
- Web Subnet (10.16.32.0/20)
- Db Subnet (10.16.48.0/20)
Ipv6 01

AZ-b
- App Subnet (10.16.64.0/20)
- Web Subnet (10.16.80.0/20)
- Db Subnet (10.16.96.0/20)
Ipv6 02

AZ-c
- App Subnet (10.16.112.0/20)
- Web Subnet (10.16.128.0/20)
- Db Subnet (10.16.144.0/20)
Ipv6 03

AZ-d
- App Subnet (10.16.160.0/20)
- Web Subnet (10.16.176.0/20)
- Db Subnet (10.16.192.0/20)
Ipv6 04

• Note that there’s a reserved /20 in every AZ

Question 9

IP Masquerading vs NAT

Answer 9

NAT: one IP to One Public IP

IP Masquerading: One Public IP address to an entire CIDR Block

Question 10

NAT Gateway Best practice

Answer 10

Natgateway in every AZ (HA), It’s allowed to have more than one NAT Gateway in an AZ, but be noteful of the charges.

NAT is not required in ipv6, ipv6 can be publicly routable directly through the igw

Question 11

NAT Instance Advantages

Answer 11

1. Port Forwarding
2. Can be used as Bastion Host
3. NAT Instance is cheaper and better for small workloads.

Question 12

Gateway Endpoint

Answer 12

Can only be accessed from a Single VPC

Question 13

Gateway Endpoint deployment

Answer 13

Gateway Endpoint is a regional Non-VLC service service. It is not cross-Regional. And cannot be deployed into AZ or subnet. You just configure(in the Endpoint Policy) the subnets and resources that needs to access it. It is by default HA to all Azs

Question 14

Gateway Endpoint Prefix List

Answer 14

Gateway endpoints add ‘prefix lists’ to route table, allowing the VPC router to direct traffic flow to the public services via the gateway endpoint.

Question 15

Private Instance and Gateway Endpoint

Answer 15

Gateway endpoint is best with Private Instances, since public Instances can already access S3 and DynamoDB if configured to

Question 16

Gateway Endpoint Policy

Answer 16

A policy to control resources that can access a particular gate way service, eg DynamoDB or S3