Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > VPC > Flashcards

VPC Flashcards

1
Q

<p>What is the definition of a VPC?</p>

A

<p>Virtual Private Cloud - amazon lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. you have complete control over this network, including selection of IP address range, subnets and network gateways</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

<p>True or false: You can only have one internet gateway per VPC</p>

A

<p>True</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

<p>What are differences between the default VPC and a custom VPC?</p>

A

<p>Default VPCs are user-friendly, so you can imediately start deploying resources
All subnets in a default VPC have a route out to the internet
In a default VPC, each EC2 instance has both a public and private IP address</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

<p>What is VPC peering?</p>

A

<p>It allows you to connect a VPC to another VPC using private IP addresses. </p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

<p>Can you use VPC peering across accounts?</p>

A

<p>Yes</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

<p>What is transitive peering?</p>

A

<p>There is one central VPC, and individual VPCs are peered directly with it. Transitive peering allows the second VPC to then be peered with a third, allowing the first and third VPCs to share resources. This is not permitted in AWS.</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

<p>What is a CIDR block?</p>

A

<p>It is a range of IP addresses available for a subnet in a VPC</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

<p>What is default vs dedicated tenancy?</p>

A

<p>Default tenancy means your VPC will share hardware with other VPCs. Dedicated tenancy mans your VPC will exist on dedicated hardware. Dedicated tenancy is much more expensive than default tenancy.</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

<p>When you create a new VPC, what else is created by default?</p>

A

<p>A default route table
A default network access control list
A default security group
No subnets are created</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

<p>How many IP addresses does amazon reserve when you create a subnet?</p>

A

<p>5. So a /24 subnet which has 256 available addresses will only give you 251</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

<p>Can you associate a subnet with more than one route table?</p>

A

<p>No. A subnet can only be associated with a single route table at a time</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

<p>Can you associate a route table with more than one subnet?</p>

A

<p>Yes. Route tables can be associated with multiple subnets</p>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does an internet gateway do?

A
  1. It provides an endpoint for internet/bound traffic that route tables can point to
  2. Performs network address translation (NAT), between a public IP address and the private IP address of the instance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

A subnet which is associated with a route table containing a route to an internet gateway is known as what?

A

Public subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Does the default VPC automatically include a route to the internet gateway for IPv6 traffic?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When creating a subnet, does AWS automatically include a route to the internet from the main route table for the VPC?

A

No, you must add that yourself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or false: When a new subnet is created, it is automatically associated with the main route table

A

True. which is why the main route table should not offer internet access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Are public IP addresses automatically assigned to instances launched within subnets in VPCs you create?

A

Not by default, but you can change the Auto-assign IP setting to Yes for the subnet. In the default VPC, they are automatically assigned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or false: A security group is limited to a single VPC

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is ICMP?

A

Internet control Message Protocol, which allows messaging between devices in an IP network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

True or false: to make a subnet public, you must associate it with an internet gateway

A

False. Route tables point to internet gateways, and subnets are associated with route tables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How can you make a private subnet public?

A

The subnet is private because it is associated with a route table that does not have a route to the internet gateway. To make the subnet public, associate it with a route table that does have a route to the internet gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is Network Address Translation?

A

NAT acts as a bridge between private subnets and the internet, so that they can get to the internet without allowing public access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is a NAT Instance?

A

An EC2 instance that acts as a gateway to the internet for a private subnet

25
Q

What is a NAT Gateway?

A

An AWS resource which allows instances in a private subnet to connect to the internet or other AWS services, but does not allow public access

26
Q

Explain why you have to disable Source/Destination check when creating a NAT instance

A

Normally, ec2 instances must have source/destination checking enabled, which means that either the source or the destination of the traffic must be the Instance. However, with a NAT, the source or dest might be the subnet we are building the NAT for, so we want to disable Source/Destination Checking

27
Q

True or false: NAT Gateways scale automatically

A

True

28
Q

Do NAT Gateways sit in front of or behind a Security Group? What about NAT Instances?

A

In front. NAT Instances are behind

29
Q

True or false: You must manually create a public IP Address when creating a NAT Gateway

A

False. Public IP addresses are assigned to NAT Gateways automatically

30
Q

What is are some differences between a Security Group and a Network ACL?

A

Security Groups apply to instances, NACLs apply to entire subnets
Security Groups only allow permissions, NACLs both allow and deny permissions
Security Groups are stateful, meaning inbound rules apply outbound, while NACLs are stateless, so you must set both inbound and outbound rules

31
Q

True or false: Subnets can only be associated with one Network ACL at a time

A

True

32
Q

True or false: Network ACLs can be associated with multiple subnets at the same time

A

True

33
Q

True or false: Network ACLs can span multiple VPCs

A

False. A Network ACL belongs to a single VPC

34
Q

When creating a Network ACL, by default is everything alallowed or denied?

A

Denied

35
Q

When creating a Network ACL, by default is everything alallowed or denied?

A

Denied

36
Q

In what order are rules evaluated in a Network ACL?

A

Numerically by rule number

37
Q

If the first rule in a Network ACL allows a packet, and the second rule denies it, is the packet allowed or denied?

A

It is allowed. As soon as a given packet meets the criteria of a rule, subsequent rules are not evaluated against the packet

38
Q

Does the default Network ACL that comes with a new VPC allow or deny traffic?

A

Allows it

39
Q

True or false: Every subnet must be associated with exaclty one NetworkACL

A

True. If you do not explicitly assign one, a subnet is associated with the default Netowkr ACL for that VPC

40
Q

Can Network ACLs span multiple availability zones?

A

Yes, Network ACLs operate at the level of the VPC

41
Q

If you need to block incoming traffic from a specific IP address, can you do so with Security Groups, Network ACLs, both or neither

A

Network ACLs. Only Network ACLs can block traffic,

42
Q

What are VPC Flow Logs?

A

Information about the traffic flowing and and out of interfaces in the VPC is stored in and can be viewed using CloudWatch logs.

43
Q

True or false: Flow log configurations cannot be changed once they are set up

A

True

44
Q

What is a Bastion?

A

A Bastion is an instance which is used to administer instances located in private subnets by permitting SSH and RDP traffic

45
Q

True or false: NAT Instances must have an Elastic IP to work

A

True

46
Q

How many VPCs are allowed per region?

A

5

47
Q

Can VPC peering occur between VPCs in different regions?

A

No

48
Q

True or false: VPCs with overlapping CIDR blocks cannot be peered

A

True

49
Q

True or False: NAT instances and NAT gateways are available for both IPv4 and IPv6

A

False. IPv4 only

50
Q

What do you do if your NAT Gateway does not have enough bandwidth to handle the traffic being sent to it?

A

Split the workload into multiple subnets and great a separate NAT Gateway for each

51
Q

What protocols are supported by NAT Gateways?

A

TCP, UDP, ICMP

52
Q

What does a route table’s target respresent?

A

The AWS resource that is responsible for routing the packet

53
Q

What does a route table’s destination represent?

A

The IP adress range where the packet will ultimately end up

54
Q

Can Security Groups span multiple Availability Zones?

A

Yes

55
Q

If a VPC-A has an Internet Gateway and is peered with VPC-B that is not internet connected, is it possible to use the peering connection for access between VPC-B and the internet?

A

No, this is called edge-to-edge routing and is not supported

56
Q

Can you change the tenancy for a VPC after it has been created?

A

No

57
Q

What are Flow Logs?

A

Logs which capture information about the traffic going in and out of a VPC, subnet or network interface. They can be accessed from CloudWatch

58
Q

How many subnets can one VPC have?

A

200, but you can submit a request to Amazon for more

59
Q

At what three levels can flow logs operate?

A

VPC
Subnet
Network Interface

AWS (8 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions