Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solutions Architect - Associate > VPC > Flashcards

VPC Flashcards

This deck aims to help retain concepts related to the AWS VPC service.

1
Q

What AWS service creates a logically isolated virtual network similar to a traditional network, but with the scalability of the cloud?

A

Virtual Private Cloud (VPC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you enable DNS resolution within a VPC?

A

Use the “Enable DNS resolution” configuration component

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How do you provide public DNS names for public instances within a VPC?

A

Use the “Enable DNS hostnames” configuration option

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which minimum and maximum IPv4 CIDR blocks are allowed when creating a VPC?

A

Minimum /28, Maximum /16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which IPv6 CIDR block is assigned when creating a VPC?

A

/56

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What VPC configuration component controls DNS servers, domain names, NTP servers, and the DNS resolution state for devices within a VPC?
Hint: This component cannot be edited, only recreated

A

DHCP Options Set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

How the logical subdivision of a VPC residing within a specific Availability Zone (AZ) and representing a network segment with a range of IP addresses is named?

A

Subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can subnets within the same VPC communicate with each other?

A

Yes, by default, services running in different subnets within the same VPC can communicate with each other

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How many IP addresses are reserved within a subnet, and why?

A

Five IP addresses are reserved:
Network address
Network + 1 (for router)
Network + 2 (for DNS)
Network + 3 (for future AWS use)
Network broadcast address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Does VPC support broadcast communication?

A

No, VPC does not support broadcast communication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do you automatically assign a public IP address to new instances within a subnet?

A

Use the Auto-assign public IPv4 address or Auto-assign IPv6 address configuration component for the subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are some important considerations for designing a VPC?

A
  • VPC size
  • Network (overlapping CIDR ranges within VPC, Cloud, On-premises, Partners, etc.)
  • Structure (tiers, resiliency, and availability)
  • Avoid common IP ranges (e.g., 10.0.0.0/16, 10.1.0.0/16)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What component implicitly manages traffic flow within a VPC?

A

The VPC Router (uses the network + 1 IP address)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What VPC component defines how network traffic from your subnet or gateway is directed?

A

Route table, each subnet must be associated with a route table containing a set of rules called routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How many route tables can a VPC subnet be associated with?

A

One, and only one

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How many VPC subnets can be associated with a single route table?

A

A route table can be shared with multiple subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Which route table is used by default for subnets that aren’t associated with a custom one?

A

The VPC main route table

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

In a route table, which prefix has higher priority: /16 (VPC) or /32 (single IP)?

A

In a route table, the more specific prefix (higher number) takes priority, so the answer is /32

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Which routes are always present and uneditable in a route table and ALWAYS take priority?

A

Local routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What VPC component acts as a bridge between two networks (public internet and VPC), enabling inbound and outbound connections from resources within a VPC?

A

Internet Gateway (IGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How many VPCs can an Internet Gateway be attached to?

A

One VPC only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the resiliency scope of an Internet Gateway?

A

Internet Gateway is a region-resilient service that runs within the AWS Public Zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Which type of firewalls do not track the state of connections, where each request and response is treated individually and requires its own rules

A

Stateless firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can the IPv4 public address be configured on the EC2 instance OS?

A

No, the OS is unaware of public addressing, Internet Gateway maintains private IPv4 to public IPv4 mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Which type of firewalls track the state of connections by maintaining state tables, where requests and responses are identified as two components of the same connection, so a rule configured to accept incoming traffic will allow outgoing by default?

A

Stateful firewalls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

How could you identify the requester and responder knowing only ports?

A
  • Requests are always made to well-known ports (80, 443, etc.)
  • Requester may use an ephemeral port (1024/49152–65535) to initiate requests
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Which optional layer of security within a VPC acts as a stateless firewall for controlling traffic in and out of one or more subnets?

A

Network Access Control List (NACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the difference between default and custom VPC NACLs?

A
  • Default NACL allows inbound and outbound traffic by default
  • Custom NACL implicitly denies inbound and outbound traffic by default
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

If you configure the VPC NACL Inbound rule to allow HTTP connections on port 80, will the outbound traffic be allowed by default?

A

No, both rules for inbound and outbound connections should be configured in stateless firewalls, as they are treated separately

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

How do VPC NACLs process rules?

A

NACL rules are processed in order, the lowest rule number is processed first, and once a match occurs, processing stops

The rule with the “*” number is an implicit DENY rule, so if no other rule matches, traffic is denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Describe the content of a VPC NACL rule and the configurations present.

A
  • Rule number
  • Protocol/port
  • IP/CIDR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Can you use VPC NACLs to restrict traffic from one instance to another within the same subnet?

A

No, NACLs only impact data crossing subnet boundaries

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the relationship between subnets and NACLs within a VPC?

A
  • ONE Subnet can be associated with only ONE NACL
  • ONE NACL can be associated with MANY Subnets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Which VPC security component could restrict traffic from a certain IP or IP range?

A

Network Access Control List (NACL)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Which VPC security component represents a virtual stateful firewall for the network interface to control incoming and outgoing traffic?

A

Security Group (SG)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

If you configure the VPC Security Group Inbound rule to allow HTTP connections on port 80, will the outbound traffic be allowed by default?

A

Yes, in stateful firewalls, inbound and outbound traffic are treated as the same request

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Can you explicitly DENY traffic using a VPC Security Group?

A

No, security groups do not have an explicit DENY rule, so if traffic is not explicitly allowed, then it is implicitly denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What elements define a VPC Security Group rule in AWS?

A
  • Protocol (e.g., TCP, UDP)
  • Port range (e.g., 80, 443)
  • Source or destination IP/CIDR block
  • Rule direction (inbound or outbound)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What’s the best practice for using NACLs and SGs within a VPC?

A
  • Use Security Groups to explicitly allow traffic and reference logical resources
  • Use NACLs to explicit deny traffic to specific IP or network
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are the benefits of referencing logical resources within VPC Security Group rules?

A
  • Reference another security group to allow traffic from certain application tiers
  • Reference the current group itself to manage communication between components within the security group
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What VPC architectural component enables outbound internet connections for services running in private subnets?

A

Network Address Translator (NAT) Gateway

39
Q

What is the resiliency scope of a NAT Gateway?

A

It’s an AZ-resilient service, for high availability, deploy one NAT Gateway in each AZ

40
Q

What is the maximum bandwidth a NAT Gateway can scale up to?

40
Q

What components are required when creating a NAT Gateway?

A
  • Elastic IP (static public IPv4 address)
  • Public Subnet within the VPC
41
Q

What’s the primary function of a NAT Gateway within a VPC?

A

It performs IP masquerading, hiding private IP addresses behind a single public IP address and maintaining a translation table for communication

42
Q

Does NAT Gateway support IPv6 addresses?

A

No IPv6 are publically routable by default

  • IGW with a route to ::/0 can be used for IPv6 addresses
  • For private IPv6 outbound connections, Egress-only IGW can be used
43
Q

What feature of NAT Instance service needs to be disabled for NAT functionality?

A

Source/Destination Checks feature has to be disabled

44
Q

How do AWS NAT Instances differ from AWS NAT Gateways?

A

NAT Instance: Customer-managed, single instance (less resilient), cheaper, predictable costs (can be free-tier eligible), can be multi-purpose, can have both NACL on the subnet and SG on the instance

NAT Gateway: AWS-managed, AZ-resilient (auto-scales and recovers within AZ), more expensive, less predictable costs due to auto-scaling, no free-tier eligibility, can have NACL on the subnet, but NO SG

45
Q

Can logical resources be configured in the VPC NACL rule?

46
Q

Can logical resources be configured in the VPC Security Group rule?

47
Q

How many default VPCs can be defined per region?

A

One, it can be deleted and recreated

48
Q

What is the default VPC CIDR range?

A

172.31.0.0/16

49
Q

How many subnets are in the default VPC, and what is their CIDR?

A

The subnet is present in each AZ of the region with /20 CIDR

50
Q

Which network components does the default VPC have pre-created?

A
  • Internet Gateway (IGW)
  • Security Group (SG)
  • Network Access Control List (NACL)
51
Q

Do subnets in the default VPC assign public IPv4 addresses to the resources?

52
Q

What feature enables capturing packet metadata for network traffic in a VPC?

A

VPC Flow Logs

53
Q

Can VPC Flow Logs track both accepted and rejected traffic?

A

Yes, it can capture ACCEPTED, REJECTED, or ALL traffic types

54
Q

Do VPC Flow Logs capture packet content?

A

No, they capture only packet metadata, to analyze packet content, a packet sniffer is required

55
Q

At what scope can VPC Flow Logs be configured to capture data?

A
  • VPC level: Captures logs for all interfaces in a VPC
  • Subnet level: captures logs for all interfaces within a subnet
  • Individual network interface level: captures logs for a specific interface
55
Q

Is VPC Flow Logs a real-time solution?

A

No, logs are delivered with a delay

55
Q

What kind of metadata is captured by VPC Flow Logs?
Hint: provide an example of its fields.

A
  • version: 2
  • account-id: 493062997015
  • interface-id: eni-014b6c6b372721dOb
  • srcaddr: 79.33.7.58
  • dstaddr: 172.31.8.238
  • srcport: 54517
  • dstport: 23
  • protocol: 6
  • packets: 3
  • bytes: 180
  • start: 1433807174
  • end: 1433807218
  • action: REJECT
  • log-status: OK
56
Q

Where can VPC Flow Logs store captured packet metadata?

A

In Amazon S3 or CloudWatch Logs

57
Q

Does VPC Flow Logs capture all types of traffic within a VPC?

A

No, it excludes:

  • Metadata service requests (169.254.169.254)
  • Time server requests
  • DHCP traffic
  • Amazon DNS server requests
  • Amazon Windows license server requests
58
Q

What is the protocol number for Internet Control Message Protocol (ICMP)?

58
Q

What is the protocol number for Transmission Control Protocol (TCP)?

59
Q

What is the protocol number for User Datagram Protocol (UDP)?

60
Q

Which VPC component provides IPv6-enabled instances with outbound-only access to public AWS services and the internet?

A

Egress-only Internet Gateway

61
Q

Why can’t a regular VPC Internet Gateway provide outbound-only access for IPv6-enabled instances?

A

All IPv6 addresses are publicly routable by default, so an Internet Gateway allows both inbound and outbound traffic, which is not suitable for outbound-only requirements

62
Q

What is the primary purpose of an Egress-only Internet Gateway in AWS VPC?

A

It enables outbound-only access to the public internet for IPv6-enabled instances

63
Q

What configuration is required to use an Egress-only Internet Gateway in AWS VPC?

A

Add a default IPv6 route (::/0) to the route table, with the Egress-only Internet Gateway (eigw-id) as the target

64
Q

Which AWS VPC feature creates a private and encrypted network link between two VPCs, enabling communication using private IP addresses as if within the same network?

A

VPC Peering

65
Q

Can VPC Peering connections resolve public hostnames to private IPs?

A

Yes, but this must be explicitly enabled

66
Q

Can an AWS VPC Peering connection be established between two VPCs with overlapping CIDR ranges?

A

No, peering connections cannot be created if the VPCs have overlapping CIDR ranges

67
Q

Can a single AWS VPC Peering connection link more than two VPCs?

A

No, each VPC Peering connection links only two VPCs

68
Q

Is cross-account AWS VPC Peering supported?

A

Yes, VPC Peering supports connections within the same account, across accounts, in the same region, and across regions

69
Q

Can VPC A communicate with VPC C through VPC B if A is peered with B and B is peered with C?

A

No, transitive peering is not supported, consider using Transit Gateway for such scenarios

70
Q

What configurations are required for an AWS VPC Peering connection?

A
  • The peering connection must be accepted upon creation
  • Route tables on both sides must be updated to direct traffic to the remote CIDR range using the peer gateway object
71
Q

Can Security Groups in same-region peered VPCs reference each other?

A

Yes, Security Groups in same-region peered VPCs can reference each other as if they belong to the same VPC

72
Q

How can the number of VPC peering connections required for a mesh topology be calculated?

A

Use the formula: n × (n−1) / 2 where n is the number of VPCs

This approach becomes unmanageable as the number of VPCs grows:
- For 5 VPCs: 10 peering connections
- For 10 VPCs: 45 peering connections

73
Q

Which AWS VPC component allows private connections to supported AWS services?

A

VPC Endpoint ensures that traffic between a VPC and supported service stays within the AWS network

74
Q

What are the two types of AWS VPC Endpoints?

A
  • Gateway Endpoint
  • Interface Endpoint
75
Q

Which VPC Endpoint type is created per service, per region, and must be associated with one or more subnets?

A

Gateway Endpoint

76
Q

Which AWS VPC Endpoint type enables private access to S3 and DynamoDB without public addressing?

A

Gateway Endpoint

77
Q

Which VPC Endpoint type is designed to be highly available across all AZs in a region?

A

Gateway Endpoint

78
Q

Can Gateway Endpoints be used to access services in a different AWS region?

A

No, Gateway Endpoints cannot access cross-region services

79
Q

Is it possible to access a Gateway Endpoint from outside its VPC?

A

No, Gateway Endpoints cannot be accessed from outside the VPC

80
Q

What are some ideal use cases for a AWS VPC Gateway Endpoint?

A
  • Enabling private access to public AWS services from within a VPC
  • Securing S3 buckets by restricting access to the Gateway Endpoint, ensuring buckets are private
81
Q

How is access controlled for AWS VPC Gateway Endpoints?

A

Through an Endpoint Policy, which specifies the resources (e.g., specific S3 buckets) the endpoint can access

82
Q

Which AWS VPC Endpoint type relies on routing to direct traffic?

A

Gateway Endpoint

83
Q

What must be added to an AWS VPC Route Table to direct traffic to public services through a Gateway Endpoint?

A

Prefix lists associated with the Gateway Endpoint

84
Q

Which AWS VPC Endpoint type enables private access to public AWS services using Elastic Network Interfaces (ENIs) within a VPC?

A

Interface Endpoint

85
Q

Which AWS VPC Endpoint type is not highly available by default?

A

Interface Endpoint

86
Q

Which AWS VPC Endpoint type must be deployed in each Availability Zone (AZ) for high availability?

A

Interface Endpoint

87
Q

Which AWS VPC Endpoint type supports only the TCP protocol and IPv4?

A

Interface Endpoint

88
Q

Which AWS VPC Endpoint type leverages PrivateLink to inject AWS or third-party services into a VPC?

A

Interface Endpoint

89
Q

How is access to AWS VPC Interface Endpoints managed?

A

Through both Endpoint Policies and Security Groups

90
Q

Which AWS VPC Endpoint type relies on DNS for connectivity instead of routing?

A

Interface Endpoint

91
Q

What DNS names are created when an AWS VPC Interface Endpoint is set up for a service in a specific region?

A
  • Regional DNS name (high availability)
  • Zonal DNS name
  • Service DNS name
92
Q

How are the created DNS names used in AWS VPC Interface Endpoints?

A

These DNS names provide private access to the service within the VPC

93
Q

What does the Private DNS feature of AWS VPC Interface Endpoints do?

A

It overrides default service DNS names, allowing clients to connect privately via interface endpoints instead of using public access

94
Q

Which outbound port range should be specified in AWS Network ACLs for ephemeral responses?

A

1024-65535 (to cover requests originating from AWS Lambda, NAT, Windows operating systems, and AWS ELB)

AWS Certified Solutions Architect - Associate (47 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions