Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

aws certified solution architect associate > VPC > Flashcards

VPC Flashcards

This deck aims to help retain concepts related to the AWS VPC service.

1
Q

What AWS service creates a logically isolated virtual network similar to a traditional network, but with the scalability of the cloud?

A

Virtual Private Cloud (VPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you enable DNS resolution within a VPC?

A

Use the Enable DNS resolution configuration component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you provide public DNS names for public instances within a VPC?

A

Use the Enable DNS hostnames configuration component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which minimum and maximum IPv4 CIDR blocks are allowed when creating a VPC?

A

Minimum /28, Maximum /16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which IPv6 CIDR block is assigned when creating a VPC?

A

/56

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What VPC configuration component controls DNS servers, domain names, NTP servers, and the DNS resolution state for devices within a VPC? (Note: This component cannot be edited, only recreated)

A

DHCP Options Set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Name the logical subdivision of a VPC residing within a specific Availability Zone (AZ), representing a network segment with a range of IP addresses.

A

Subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can subnets within the same VPC communicate with each other?

A

Yes, by default, services running in different subnets within the same VPC can communicate with each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How many IP addresses are reserved within a subnet, and why?

A

Five IP addresses are reserved:
Network address
Network + 1 (for router)
Network + 2 (for DNS)
Network + 3 (for future AWS use)
Network broadcast address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does VPC support broadcast communication?

A

No, VPC does not support broadcast communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do you automatically assign a public IP address to new instances within a subnet?

A

Use the Auto-assign public IPv4 address or Auto-assign IPv6 address configuration component for the subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are some important considerations for designing a VPC?

A

Consider the size, network (overlapping CIDR ranges within VPC, Cloud, On-premises, Partners, etc.), structure (tiers, resiliency, and availability), and avoid common IP ranges (e.g., 10.0.0.0/16, 10.1.0.0/16)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What component implicitly manages traffic flow within a VPC?

A

The VPC Router (uses the network + 1 IP address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What VPC component defines how network traffic from your subnet or gateway is directed?

A

Route table. Each subnet must be associated with a route table containing a set of rules called routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How many route tables can a VPC subnet be associated with?

A

One, and only one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many VPC subnets can be associated with a single route table?

A

A route table can be shared with multiple subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which route table is used by default for subnets that aren’t associated with a custom one?

A

The VPC main route table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In a route table, which prefix has higher priority: /16 (VPC) or /32 (single IP)?

A

/32. In a route table, the more specific prefix (higher number) takes priority

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which routes are always present and uneditable in a route table, and ALWAYS take priority?

A

Local routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What VPC component acts as a bridge between two networks (public internet and VPC) enabling inbound and outbound connections from resources within a VPC?

A

Internet Gateway (IGW)

20
Q

How many VPCs can an Internet Gateway be attached to?

A

One VPC only

20
Q

What is the resiliency scope of an Internet Gateway?

A

Internet Gateway is a region-resilient service that runs within the AWS Public Zone

21
Q

Which type of firewalls do not track the state of connections, where each request and response is treated individually and requires its own rules?

A

Stateless firewalls

21
Q

Can the IPv4 public address be configured on the instance OS?

A

No, the OS is unaware of public addressing. The Internet Gateway maintains private IPv4 to public IPv4 mapping

22
Q

Which type of firewalls track the state of connections by maintaining state tables, where requests and responses are identified as two components of the same connection, so a rule configured to accept incoming traffic will allow outgoing by default?

A

Stateful firewalls

23
Q

How could you identify the requester and responder knowing only ports?

A

Requests are always made to well-known ports (80, 443, etc.). The requester may use an ephemeral port (1024/49152–65535) to initiate requests

24
Q

Which optional layer of security within a VPC acts as a stateless firewall for controlling traffic in and out of one or more subnets?

A

Network Access Control List (NACL)

25
Q

What is the difference between default and custom VPC NACLs?

A

On a default NACL, traffic is allowed both in and out by default
On a custom NACL, traffic is implicitly denied both in and out by default

26
Q

If you configure the VPC NACL Inbound rule to allow HTTP connections on port 80, will the outbound traffic be allowed by default?

A

No, both rules for inbound and outbound connections should be configured in stateless firewalls as they are treated separately

27
Q

How do VPC NACLs process rules?

A

NACL rules are processed in order. The lowest rule number is processed first. Once a match occurs, processing stops. The rule with the “*” number is an implicit DENY rule, so if no other rule matches, traffic is denied

28
Q

Describe the content of a VPC NACL rule and the configurations present.

A

A VPC NACL rule includes a rule number, protocol/port, and IP/CIDR, but NO logical resources

29
Q

Can you use VPC NACLs to restrict traffic from one instance to another within the same subnet?

A

No, NACLs only impact data crossing subnet boundaries

30
Q

What is the relationship between subnets and NACLs within a VPC?

A

One subnet can be associated with only ONE NACL, but one NACL can be associated with MANY subnets

31
Q

Which VPC security component would you use if you wanted to restrict traffic from a certain IP or IP range?

A

Network Access Control List (NACL)

32
Q

Which VPC security component represents a virtual stateful firewall for the network interface to control incoming and outgoing traffic?

A

Security Group (SG)

33
Q

If you configure the VPC Security Group Inbound rule to allow HTTP connections on port 80, will the outbound traffic be allowed by default?

A

Yes, in stateful firewalls, inbound and outbound traffic are treated as the same request

34
Q

Can you explicitly DENY traffic using a VPC Security Group?

A

No, security groups do not have an explicit DENY rule. If traffic is not explicitly allowed, then it is implicitly denied

35
Q

Describe the content of a VPC Security Group rule and the configurations present

A

A VPC Security Group rule includes a rule number, protocol/port, IP/CIDR, and CAN have logical resources

36
Q

What’s the best practice for using NACLs and SGs within a VPC?

A

Generally, use security groups to allow traffic (explicitly allow, and reference logical resources), and use NACLs to deny traffic (explicit deny on specific IP or network)

37
Q

What are the benefits of referencing logical resources within VPC Security Group rules?

A

We can reference another security group to allow traffic from certain application tiers or reference the current group itself to manage communication between components within the security group

38
Q

Which VPC architectural component enables outbound connections for services running in private subnets?

A

Network Address Translator (NAT) Gateway

39
Q

What is the resiliency scope of a NAT Gateway?

A

It’s an AZ-resilient service. For high availability, deploy one NAT Gateway in each AZ

40
Q

What is the maximum bandwidth a NAT Gateway can scale up to?

A

45 Gbps

40
Q

What component is required when creating a NAT Gateway?

A

An Elastic IP (static public IPv4 address), NAT GW should be created in a public subnet within the VPC

41
Q

What’s the primary function of a NAT Gateway within a VPC?

A

It performs IP masquerading, hiding private IP addresses behind a single public IP address and maintaining a translation table for communication

42
Q

Does NAT Gateway support IPv6 addresses?

A

No. However, an IGW with a route to ::/0 can be used for IPv6 addresses. For private IPv6 outbound connections, use an Egress-Only IGW instead of a NAT Gateway

43
Q

What feature of the deprecated NAT Instance needs to be disabled for NAT functionality?

A

Source/Destination Checks feature has to be disabled

44
Q

How do deprecated NAT Instances differ from NAT Gateways?

A

NAT Instance: Customer-managed, single instance (less resilient), cheaper, predictable costs (can be free-tier eligible), can be multi-purpose, can have both NACL on the subnet and SG on the instance

NAT Gateway: AWS-managed, AZ-resilient (auto-scales and recovers within AZ), more expensive, less predictable costs due to auto-scaling, no free-tier eligibility, can have NACL on the subnet, but NO SG

aws certified solution architect associate (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions