Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solution Architect Associate > VPC > Flashcards

VPC Flashcards

This deck aims to help retain concepts related to the AWS VPC service.

1
Q

What AWS service creates a logically isolated virtual network similar to a traditional network, but with the scalability of the cloud?

A

Virtual Private Cloud (VPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you enable DNS resolution within a VPC?

A

Use the “Enable DNS resolution” configuration component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you provide public DNS names for public instances within a VPC?

A

Use the “Enable DNS hostnames” configuration component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which minimum and maximum IPv4 CIDR blocks are allowed when creating a VPC?

A

Minimum /28, Maximum /16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which IPv6 CIDR block is assigned when creating a VPC?

A

/56

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What VPC configuration component controls DNS servers, domain names, NTP servers, and the DNS resolution state for devices within a VPC?
Hint: This component cannot be edited, only recreated

A

DHCP Options Set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How the logical subdivision of a VPC residing within a specific Availability Zone (AZ) and representing a network segment with a range of IP addresses is named?

A

Subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can subnets within the same VPC communicate with each other?

A

Yes, by default, services running in different subnets within the same VPC can communicate with each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How many IP addresses are reserved within a subnet, and why?

A

Five IP addresses are reserved:
Network address
Network + 1 (for router)
Network + 2 (for DNS)
Network + 3 (for future AWS use)
Network broadcast address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does VPC support broadcast communication?

A

No, VPC does not support broadcast communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do you automatically assign a public IP address to new instances within a subnet?

A

Use the Auto-assign public IPv4 address or Auto-assign IPv6 address configuration component for the subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are some important considerations for designing a VPC?

A
  • VPC size
  • Network (overlapping CIDR ranges within VPC, Cloud, On-premises, Partners, etc.)
  • Structure (tiers, resiliency, and availability)
  • Avoid common IP ranges (e.g., 10.0.0.0/16, 10.1.0.0/16)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What component implicitly manages traffic flow within a VPC?

A

The VPC Router (uses the network + 1 IP address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What VPC component defines how network traffic from your subnet or gateway is directed?

A

Route table, each subnet must be associated with a route table containing a set of rules called routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How many route tables can a VPC subnet be associated with?

A

One, and only one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many VPC subnets can be associated with a single route table?

A

A route table can be shared with multiple subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which route table is used by default for subnets that aren’t associated with a custom one?

A

The VPC main route table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In a route table, which prefix has higher priority: /16 (VPC) or /32 (single IP)?

A

In a route table, the more specific prefix (higher number) takes priority, so the answer is /32

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which routes are always present and uneditable in a route table and ALWAYS take priority?

A

Local routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What VPC component acts as a bridge between two networks (public internet and VPC), enabling inbound and outbound connections from resources within a VPC?

A

Internet Gateway (IGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How many VPCs can an Internet Gateway be attached to?

A

One VPC only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the resiliency scope of an Internet Gateway?

A

Internet Gateway is a region-resilient service that runs within the AWS Public Zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which type of firewalls do not track the state of connections, where each request and response is treated individually and requires its own rules

A

Stateless firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can the IPv4 public address be configured on the EC2 instance OS?

A

No, the OS is unaware of public addressing, Internet Gateway maintains private IPv4 to public IPv4 mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which type of firewalls track the state of connections by maintaining state tables, where requests and responses are identified as two components of the same connection, so a rule configured to accept incoming traffic will allow outgoing by default?

A

Stateful firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How could you identify the requester and responder knowing only ports?

A
  • Requests are always made to well-known ports (80, 443, etc.)
  • Requester may use an ephemeral port (1024/49152–65535) to initiate requests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which optional layer of security within a VPC acts as a stateless firewall for controlling traffic in and out of one or more subnets?

A

Network Access Control List (NACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the difference between default and custom VPC NACLs?

A
  • Default NACL allows inbound and outbound traffic by default
  • Custom NACL implicitly denies inbound and outbound traffic by default
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

If you configure the VPC NACL Inbound rule to allow HTTP connections on port 80, will the outbound traffic be allowed by default?

A

No, both rules for inbound and outbound connections should be configured in stateless firewalls, as they are treated separately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How do VPC NACLs process rules?

A

NACL rules are processed in order, the lowest rule number is processed first, and once a match occurs, processing stops

The rule with the “*” number is an implicit DENY rule, so if no other rule matches, traffic is denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Describe the content of a VPC NACL rule and the configurations present.

A
  • Rule number
  • Protocol/port
  • IP/CIDR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Can you use VPC NACLs to restrict traffic from one instance to another within the same subnet?

A

No, NACLs only impact data crossing subnet boundaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the relationship between subnets and NACLs within a VPC?

A
  • ONE Subnet can be associated with only ONE NACL
  • ONE NACL can be associated with MANY Subnets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which VPC security component could restrict traffic from a certain IP or IP range?

A

Network Access Control List (NACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which VPC security component represents a virtual stateful firewall for the network interface to control incoming and outgoing traffic?

A

Security Group (SG)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

If you configure the VPC Security Group Inbound rule to allow HTTP connections on port 80, will the outbound traffic be allowed by default?

A

Yes, in stateful firewalls, inbound and outbound traffic are treated as the same request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Can you explicitly DENY traffic using a VPC Security Group?

A

No, security groups do not have an explicit DENY rule, so if traffic is not explicitly allowed, then it is implicitly denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Describe the content of a VPC Security Group rule and the configurations present

A

A VPC Security Group rule includes a rule number, protocol/port, IP/CIDR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What’s the best practice for using NACLs and SGs within a VPC?

A
  • Use Security Groups to allow traffic (explicitly allow, and reference logical resources)
  • Use NACLs to deny traffic (explicit deny on specific IP or network)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the benefits of referencing logical resources within VPC Security Group rules?

A
  • Reference another security group to allow traffic from certain application tiers
  • Reference the current group itself to manage communication between components within the security group
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Which VPC architectural component enables outbound connections for services running in private subnets?

A

Network Address Translator (NAT) Gateway

39
Q

What is the resiliency scope of a NAT Gateway?

A

It’s an AZ-resilient service, for high availability, deploy one NAT Gateway in each AZ

40
Q

What is the maximum bandwidth a NAT Gateway can scale up to?

A

45 Gbps

40
Q

What components are required when creating a NAT Gateway?

A
  • Elastic IP (static public IPv4 address)
  • Public Subnet within the VPC
41
Q

What’s the primary function of a NAT Gateway within a VPC?

A

It performs IP masquerading, hiding private IP addresses behind a single public IP address and maintaining a translation table for communication

42
Q

Does NAT Gateway support IPv6 addresses?

A

No, however, an IGW with a route to ::/0 can be used for IPv6 addresses, and for private IPv6 outbound connections, Egress-only IGW can be used (instead of NAT Gateway)

43
Q

What feature of the deprecated NAT Instance needs to be disabled for NAT functionality?

A

Source/Destination Checks feature has to be disabled

44
Q

How do deprecated NAT Instances differ from NAT Gateways?

A

NAT Instance: Customer-managed, single instance (less resilient), cheaper, predictable costs (can be free-tier eligible), can be multi-purpose, can have both NACL on the subnet and SG on the instance

NAT Gateway: AWS-managed, AZ-resilient (auto-scales and recovers within AZ), more expensive, less predictable costs due to auto-scaling, no free-tier eligibility, can have NACL on the subnet, but NO SG

45
Q

Can logical resources be configured in the VPC NACL rule?

A

No

46
Q

Can logical resources be configured in the VPC Security Group rule?

A

Yes

47
Q

How many default VPCs can be defined per region?

A

One, it can be deleted and recreated

48
Q

What is the default VPC CIDR range?

A

172.31.0.0/16

49
Q

How many subnets are in the default VPC, and what is their CIDR?

A

The subnet is present in each AZ of the region with /20 CIDR

50
Q

Which network components does the default VPC have pre-created?

A
  • Internet Gateway (IGW)
  • Security Group (SG)
  • Network Access Control List (NACL)
51
Q

Do subnets in the default VPC assign public IPv4 addresses to the resources?

A

Yes

52
Q

What feature enables capturing packet metadata for network traffic in a VPC?

A

VPC Flow Logs

53
Q

Can VPC Flow Logs track both accepted and rejected traffic?

A

Yes, it can capture ACCEPTED, REJECTED, or ALL traffic types

54
Q

Do VPC Flow Logs capture packet content?

A

No, they capture only packet metadata, to analyze packet content, a packet sniffer is required

55
Q

At what scope can VPC Flow Logs be configured to capture data?

A
  • VPC level (captures logs for all interfaces in a VPC)
  • Subnet level (captures logs for all interfaces within a subnet)
  • Individual network interface level (captures logs for a specific interface)
55
Q

Is VPC Flow Logs a real-time solution?

A

No, they is not real-time, logs are delivered with a delay

55
Q

What kind of metadata is captured by VPC Flow Logs?
Hint: provide an example of its fields.

A
  • version: 2
  • account-id: 493062997015
  • interface-id: eni-014b6c6b372721dOb
  • srcaddr: 79.33.7.58
  • dstaddr: 172.31.8.238
  • srcport: 54517
  • dstport: 23
  • protocol: 6
  • packets: 3
  • bytes: 180
  • start: 1433807174
  • end: 1433807218
  • action: REJECT
  • log-status: OK
56
Q

Where can VPC Flow Logs store captured packet metadata?

A

In Amazon S3 or CloudWatch Logs

57
Q

Does VPC Flow Logs capture all types of traffic within a VPC?

A

No, it excludes:

  • Metadata service requests (169.254.169.254)
  • Time server requests
  • DHCP traffic
  • Amazon DNS server requests
  • Amazon Windows license server requests
58
Q

What is the protocol number for Internet Control Message Protocol (ICMP)?

A

1

58
Q

What is the protocol number for Transmission Control Protocol (TCP)?

A

6

59
Q

What is the protocol number for User Datagram Protocol (UDP)?

A

17

60
Q

Which VPC component provides IPv6-enabled instances with outbound-only access to public AWS services and the internet?

A

Egress-only Internet Gateway

61
Q

Why can’t a regular VPC Internet Gateway provide outbound-only access for IPv6-enabled instances?

A

All IPv6 addresses are publicly routable by default, so an Internet Gateway allows both inbound and outbound traffic, which is not suitable for outbound-only requirements

62
Q

What is the primary purpose of an Egress-only Internet Gateway in AWS VPC?

A

It enables outbound-only access to the public internet for IPv6-enabled instances

63
Q

What configuration is required to use an Egress-only Internet Gateway in AWS VPC?

A

Add a default IPv6 route (::/0) to the route table, with the Egress-only Internet Gateway (eigw-id) as the target

64
Q

Which AWS VPC feature creates a private and encrypted network link between two VPCs, enabling communication using private IP addresses as if within the same network?

A

VPC Peering

65
Q

Can VPC Peering connections resolve public hostnames to private IPs?

A

Yes, but this must be explicitly enabled

66
Q

Can an AWS VPC Peering connection be established between two VPCs with overlapping CIDR ranges?

A

No, peering connections cannot be created if the VPCs have overlapping CIDR ranges

67
Q

Can a single AWS VPC Peering connection link more than two VPCs?

A

No, each VPC Peering connection links only two VPCs

68
Q

Is cross-account AWS VPC Peering supported?

A

Yes, VPC Peering supports connections within the same account, across accounts, in the same region, and across regions

69
Q

Can VPC A communicate with VPC C through VPC B if A is peered with B and B is peered with C?

A

No, transitive peering is not supported, consider using Transit Gateway for such scenarios

70
Q

What configurations are required for an AWS VPC Peering connection?

A
  • The peering connection must be accepted upon creation
  • Route tables on both sides must be updated to direct traffic to the remote CIDR range using the peer gateway object
71
Q

Can Security Groups in same-region peered VPCs reference each other?

A

Yes, Security Groups in same-region peered VPCs can reference each other as if they belong to the same VPC

72
Q

How can the number of VPC peering connections required for a mesh topology be calculated?

A

Use the formula: n × (n−1) / 2 where n is the number of VPCs

This approach becomes unmanageable as the number of VPCs grows:
- For 5 VPCs: 10 peering connections
- For 10 VPCs: 45 peering connections

73
Q

Which AWS VPC component allows private connections to supported AWS services?

A

VPC Endpoint ensures that traffic between a VPC and supported service stays within the AWS network

74
Q

What are the two types of AWS VPC Endpoints?

A
  • Gateway Endpoint
  • Interface Endpoint
75
Q

Which VPC Endpoint type is created per service, per region, and must be associated with one or more subnets?

A

Gateway Endpoint

76
Q

Which AWS VPC Endpoint type enables private access to S3 and DynamoDB without public addressing?

A

Gateway Endpoint

77
Q

Which VPC Endpoint type is designed to be highly available across all AZs in a region?

A

Gateway Endpoint

78
Q

Can Gateway Endpoints be used to access services in a different AWS region?

A

No, Gateway Endpoints cannot access cross-region services

79
Q

Is it possible to access a Gateway Endpoint from outside its VPC?

A

No, Gateway Endpoints cannot be accessed from outside the VPC

80
Q

What are some ideal use cases for a AWS VPC Gateway Endpoint?

A
  • Enabling private access to public AWS services from within a VPC
  • Securing S3 buckets by restricting access to the Gateway Endpoint, ensuring buckets are private
81
Q

How is access controlled for AWS VPC Gateway Endpoints?

A

Through an Endpoint Policy, which specifies the resources (e.g., specific S3 buckets) the endpoint can access

82
Q

Which AWS VPC Endpoint type relies on routing to direct traffic?

A

Gateway Endpoint

83
Q

What must be added to an AWS VPC Route Table to direct traffic to public services through a Gateway Endpoint?

A

Prefix lists associated with the Gateway Endpoint

84
Q

Which AWS VPC Endpoint type enables private access to public AWS services using Elastic Network Interfaces (ENIs) within a VPC?

A

Interface Endpoint

85
Q

Which AWS VPC Endpoint type is not highly available by default?

A

Interface Endpoint

86
Q

Which AWS VPC Endpoint type must be deployed in each Availability Zone (AZ) for high availability?

A

Interface Endpoint

87
Q

Which AWS VPC Endpoint type supports only the TCP protocol and IPv4?

A

Interface Endpoint

88
Q

Which AWS VPC Endpoint type leverages PrivateLink to inject AWS or third-party services into a VPC?

A

Interface Endpoint

89
Q

How is access to AWS VPC Interface Endpoints managed?

A

Through both Endpoint Policies and Security Groups

90
Q

Which AWS VPC Endpoint type relies on DNS for connectivity instead of routing?

A

Interface Endpoint

91
Q

What DNS names are created when an AWS VPC Interface Endpoint is set up for a service in a specific region?

A
  • Regional DNS name (high availability)
  • Zonal DNS name
  • Service DNS name
92
Q

How are the created DNS names used in AWS VPC Interface Endpoints?

A

These DNS names provide private access to the service within the VPC

93
Q

What does the Private DNS feature of AWS VPC Interface Endpoints do?

A

It overrides default service DNS names, allowing clients to connect privately via interface endpoints instead of using public access

AWS Certified Solution Architect Associate (37 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions