Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My AWS:SA Associate > VPC > Flashcards

VPC Flashcards

1
Q

What is a VPC?

A

A VPC is basically a virtual data center within the AWS Cloud.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How many VPCs can you have in a region?

A

Soft cap of 5 VPCs in a given region. You can call AWS to increase the limit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What security features does VPC have?

A

NACLS (Network Access Control List)

Security Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What subnet ranges can you use?

A

You can use any classful private IP address ranges as well as CIDR/VLSM blocks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is the lowest and highest prefix length for a subnet you can use in VPC?

A

/16

/28

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are subnets in VPC/AWS?

A

Each subnet is in its own AZ. 1 subnet = 1AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How many internet gateways can you have in a VPC?

A

You can only have 1 internet gateway per VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How is a default VPC structured?

A

All subnets in the default VPC has a route out to the internet.

All EC2 instances have a private and public IP address

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is VPC Peering?

A

VPC peering allows you to connect one VPC with another. You can even connect VPCs in one AWS account with another AWS account’s VPC.

Instances will behave as if they are on the same private network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What type of logical network topography is a VPC peer in?

A

Star-type, 1 central VPC with other peers connecting to that central VPC. Each peer does not have transitive access to the other through the central VPC. (Not mesh)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What do VPCs consist of?

A

Internet Gateways/VP Gateways, Route Tables, NACLs, Security Groups, Subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Are Security Groups stateful?

A

Yes, Security groups are stateful which means that if an inbound connection is allowed, once the session is created outbound will also be allowed even if it’s not explicitly configured so.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Are NACLs stateful?

A

No. NACLs are not stateful. NACLs are stateless. You must explicitly configure inbound and outbound.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What does it mean for a network connection to be stateful?

A

It means that if the connection session has been created whether inbound or outbound the opposite (inbound/outbound) does not need to be explicitly configured.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a NAT Gateway used for?

A

A NAT gateway allows a subnet to reach the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a Bastion (Jump Box)?

A

A jumpbox/bastion allows you to access the rest of a private network by SSHing or RDPing.

17
Q

What is a VPC Flow Log?

A

A VPC Flow Log is a type of a log that you can create which captures most IP traffic.

18
Q

What are the 3 Levels VPC Flow Logs can be created at?

A

3 Levels:

  • VPC
  • Subnet
  • Network Interface
19
Q

What is a requirement that must be in place before you create a VPC Flow Log?

A

You must have a CloudWatch Log group.

20
Q

Where does a VPC Flow Log end up?

A

CloudWatch Log

21
Q

What are some examples of traffic which a VPC Flow Log will not capture?

A
  • DNS traffic to an Amazon DNS Server (unless it’s your own)
  • Amazon’s Windows Instance Activation traffic
  • Traffic from a VPC Peer unless that VPC peer belongs to your own account
  • Traffic from and to http://169.254.169.254/latest/meta-data/
22
Q

How should you create NACL rules?

A

You should create NACL rules by incrementing 100 each rule so you have a chance to omit your rule if you make a mistake

23
Q

What is a VPC Endpoint?

A

A VPC endpoint is used to communicate with an AWS service through the internal network and not the internet

24
Q

What are the two types of VPC Endpoints and what are their differences?

A

Interface Endpoint:

  • An ENI that is used to receive internal traffic from an AWS service
  • Single Host-wide

Gateway Endpoint:

  • Used as a gateway/route on a subnet to communicate with an AWS service
  • Subnet-wide
25
Q

What are the advantages of a NAT Gateway over a NAT Instance?

A

Automatically scales to 10Gbit/s. No need to patched, fully managed. Highly Available via elastic IP.

26
Q

What do you have to set up in order to use a NAT instance?

A
  • Src/Dest check disable
  • Create EC2 instance from community AMI NAT instance image
  • Set 0.0.0.0/0 to point to it from routing table
  • Patch it
  • Use autoscaling groups/ELBs to scale it
  • Use script to failover
27
Q

Once you create a Flow Log are you able to change its configuration?

A

Nope. Once you create a Flow Log you cannot change its configuration.

28
Q

You are creating an Application Load Balancer. What do you have to have in a VPC before you can do this?

A

Your VPC must have two public facing subnets as a requirement for creating a Load Balancer is that you have two subnets you can attach it to.

29
Q

What level do security groups operate at?

A

Security Groups operate at the instance level.

30
Q

How do security groups evaluate rules?

A

Security groups evaluate all rules

31
Q

Can you set a deny rule on a Security Group?

A

Nope. Only allow rules

My AWS:SA Associate (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions