Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Cert > VPC > Flashcards

VPC Flashcards

1
Q

What is VPC

A

Its is like a logical datacenter inside AWS,

Consists of Subnets, gateways, Route tables, network access control lists and security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the use of NAT Gateway

A

It is a Gateway which is used by private Subnets to talk to the internet, but prevent the intrenet from initiating any connection with the instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Difference between NAT instance and NAT Gateway

A

NAT instance is a single EC2 instance used by private subnets to connect to internet, whereas NAT gateway is a full-blown, highly available gateway used by private Subnets to talk to outside Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the default rules for new NACL?

A

All inbound and outbound traffic are denied by default.
Rules are always added in chronological order.
Inbound and outbound rules can be specified independently to allow or deny traffic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Do we have to create NACL while creating VPC?

A

While creating a VPC an NACL is created by default.
By default, it allows all inbound and outbound traffic.
Every subnet added to the VPC will automatically get associated to the default NACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Relationship between NACL and Security groups?

A

NACL’s are always going to be evaluated before the security groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the best option to block ip addresses, Security groups or NACL’S?

A

NACL’s are the best option to block ip addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the relationship between Subnets and NACL’s

A

Each subnet must be associated with only one NACL, but an NACL could be associated with more than 1 subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is VPC flow log?

A

It’s a way to Analyse traffic flowing in and out of subnets, VPC’s and instances.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What kind of traffic are not monitored by flow logs

A

1) Traffic to Amazon DNS
2) License activation calls
3) DHCP traffic
4) Calls to Instance Metadata
5) Traffic to reserved ip address for default VPC router

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is Bastion Host

A

It is a jump box, which sits in a Public subnet, through which we connect to a private subnet. This machine is configured only to have a proxy server and everything else is removed to reduce the attack surface.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is direct Connect in AWS

A

The dedicated connection from Customer premises to AWS, region, and services. Useful for high throughput workloads or if you need a secure and highly available connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is VPC endpoint?

A

It is a way to privately connect VPC to supported AWS services like S3, etc without the need for Internet Gateway, NAT device, VPN or AWS Direct Connect Connection.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Difference between NACL and Security group?

A

Security groups are stateful, whereas NACL is stateless.
We can define inbound and outbound which can deny and allow connectiosns in NACL. NACL is the first line of defence, followed by the security group.

Whereas in Security Group, we cant create deny rules, if a port is opened to allow a request then then response will flow back in following the same port

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

how to connect to an ec2 machine inside a private subnet?

A

Create a security group, which will allow icmp and http, https, https traffic, my sql and aurora to this machine and also mention the CIDR address range or ip addresses which can communicate with this security group.Then we can connect to this machine which sits inside the CIDR range we have defined to allow access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

How to give a machine inside a private subnet connect to internet?

A

1) Use a NAT instance in public subnet which has access to the public internet.
2) Modify the route table associated with private subnet to direct internet bound traffic to the NAT Instance.
3) Then we create a route in a route table for the VPC to allow access to he internet. The destination will be 0.0.0.0 and the instance selected in TARGET will be the NAT instance then, Disable source and destination checks in the NAT instance else the whole thing won’t work.

Or

1) Create a NAT gateway in a public subnet.
2) Give it a new elastic ip address for NAT gateway.
3) Modify the route table associated with private subnet to direct internet bound traffic to the NAT Instance.
4) Add a new route in the route table of our VPC to connect to the internet and select the Target for this route to be the NAT gateway.
5) The NAT gateway sends the traffic to the internet gateway using the NAT gateway’s Elastic IP address as the source IP address.

17
Q

How to Change Elastic ip address associated with NAT gateway ?

A

Once associated the elastic ip address cant be changed.

18
Q

How to associate Security groups with NAT gateway?

A

We cant associate Security Groups with NAT Gateway.

19
Q

How to avoid Data processing fees while accessing S3 and Dynamo db in the same region?

A

Set up a gateway endpoint and route the traffic through the gateway endpoint instead of the NAT gateway. There are no charges for using a gateway endpoint.

20
Q

What are the uses of NACL?

A

To control the traffic which flows in and out of a subnet.

21
Q

How to make Nat Gateways highly available?

A

Create them in multiple Az’s

22
Q

What is Internet Gateway in VPC?

A

It is through internet gateway instances inside a VPC connect to internet. It provides a target for the routes defined in the route table and its is through the Internet Gateway the outside world can connect to instance inside the VPC.

23
Q

What is the default setting for a Security group

A

The default settings for a default security group allow no inbound traffic from the internet and allow all outbound traffic to the internet.

24
Q

What is the use of Elastic ip address?

A

If you want any instance or Gateway to be reachable from the internet over IPv4 the it needs an elastic ip address.

25
Q

What is route Table?

A

Contains a set of rules called routes, which determines where the traffic from a Subnet is routed.
VPC has an implicit router, and you use route tables to control where network traffic is directed

26
Q

How are routes defined for communication within the VPC?

A

every route table comes with a default set of routes configured for communication within the VPC

27
Q

Types of VPC Endpoint?

A

Gateway endpoint and Interface endpoint

28
Q

What is the scope of VPC and Subnet?

A

VPC have regional scope and Subnets are associated with an AZ. Each Subnet is associated with one AZ and they cannot span multiple Az’s.

29
Q

How many VPC’s can be created per region?

A

Max of 5 VPC per region

30
Q

What is a peering connection?

A

A peering connection enables you to route traffic via private IP addresses between two peered VPCs

31
Q

What are some options to connect to a VPC?

A

Hardware based VPN
Software VPN
Direct Connect VPN
CloudHub

32
Q

What is a Elastic Ip address?

A

An Elastic IP address is a static IPv4 address that is associated with an instance or network interface.

33
Q

Difference between Elastic ip address and auto -assigned public ip address?

A

Elastic IPs are retained in your account whereas auto-assigned public IPs are released.

AWS Cert (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions