Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS 2020 Test date > VPC > Flashcards

VPC Flashcards

1
Q

True or false: Network ACLs can span multiple VPCs

A

False. A Network ACL belongs to a single VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Can you associate a route table with more than one subnet?

A

Yes. Route tables can be associated with multiple subnets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

True or false: Subnets can only be associated with one Network ACL at a time

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

If a VPC-A has an Internet Gateway and is peered with VPC-B that is not internet connected, is it possible to use the peering connection for access between VPC-B and the internet?

A

No, this is called edge-to-edge routing and is not supported

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are VPC Flow Logs?

A

Information about the traffic flowing in and out of interfaces in the VPC is stored in and can be viewed using CloudWatch logs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Can you change the tenancy for a VPC after it has been created?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a CIDR block?

A

It is a range of IP addresses available for a subnet in a VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True or false: Network ACLs can be associated with multiple subnets at the same time

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

True or false: NAT Gateways scale automatically

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

True or false: Every subnet must be associated with exaclty one NetworkACL

A

True. If you do not explicitly assign one, a subnet is associated with the default Network ACL for that VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When creating a Network ACL, by default is everything allowed or denied?

A

Denied

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Do NAT Gateways sit in front of or behind a Security Group? What about NAT Instances?

A

In front. NAT Instances are behind

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is ICMP?

A

Internet control Message Protocol, which allows messaging between devices in an IP network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

True or false: A security group is limited to a single VPC

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is VPC peering?

A

It allows you to connect a VPC to another VPC using private IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What protocols are supported by NAT Gateways?

A

TCP, UDP, ICMP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What does an internet gateway do?

A
  1. It provides an endpoint for internet/bound traffic that route tables can point to
  2. Performs network address translation (NAT), between a public IP address and the private IP address of the instance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

A subnet which is associated with a route table containing a route to an internet gateway is known as what?

A

Public subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

True or false: VPCs with overlapping CIDR blocks cannot be peered

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When creating a subnet, does AWS automatically include a route to the internet from the main route table for the VPC?

A

No, you must add that yourself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the definition of a VPC?

A

Virtual Private Cloud - amazon lets you provision a logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over this network, including selection of IP address range, subnets and network gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

True or false: to make a subnet public, you must associate it with an internet gateway

A

False. Route tables point to internet gateways, and subnets are associated with route tables.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Can VPC peering occur between VPCs in different regions?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

In what order are rules evaluated in a Network ACL?

A

Numerically by rule number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Are public IP addresses automatically assigned to instances launched within subnets in VPCs you create?

A

Not by default, but you can change the Auto-assign IP setting to Yes for the subnet. In the default VPC, they are automatically assigned.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Can you use VPC peering across accounts?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Does the default VPC automatically include a route to the internet gateway for IPv6 traffic?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What do you do if your NAT Gateway does not have enough bandwidth to handle the traffic being sent to it?

A

Split the workload into multiple subnets and great a separate NAT Gateway for each

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Explain why you have to disable Source/Destination check when creating a NAT instance

A

Normally, ec2 instances must have source/destination checking enabled, which means that either the source or the destination of the traffic must be the Instance. However, with a NAT, the source or dest might be the subnet we are building the NAT for, so we want to disable Source/Destination Checking

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Can Network ACLs span multiple availability zones?

A

Yes, Network ACLs operate at the level of the VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

If the first rule in a Network ACL allows a packet, and the second rule denies it, is the packet allowed or denied?

A

It is allowed. As soon as a given packet meets the criteria of a rule, subsequent rules are not evaluated against the packet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

True or false: Flow log configurations cannot be changed once they are set up

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What is default vs dedicated tenancy?

A

Default tenancy means your VPC will share hardware with other VPCs. Dedicated tenancy mans your VPC will exist on dedicated hardware. Dedicated tenancy is much more expensive than default tenancy.

34
Q

Can Security Groups span multiple Availability Zones?

A

Yes

35
Q

What does a route table’s target respresent?

A

The AWS resource that is responsible for routing the packet

36
Q

What is Network Address Translation?

A

NAT acts as a bridge between private subnets and the internet, so that they can get to the internet without allowing public access

37
Q

True or false: You can only have one internet gateway per VPC

A

True

38
Q

What is a Bastion?

A

A Bastion is an instance which is used to administer instances located in private subnets by permitting SSH and RDP traffic

39
Q

True or false: You must manually create a public IP Address when creating a NAT Gateway

A

False. Public IP addresses are assigned to NAT Gateways automatically

40
Q

What is a NAT Instance?

A

An EC2 instance that acts as a gateway to the internet for a private subnet

41
Q

What are Flow Logs?

A

Logs which capture information about the traffic going in and out of a VPC, subnet or network interface. They can be accessed from CloudWatch

42
Q

True or false: When a new subnet is created, it is automatically associated with the main route table

A

True. which is why the main route table should not offer internet access

43
Q

Does the default Network ACL that comes with a new VPC allow or deny traffic?

A

Allows it

44
Q

NACL is stateful or stateless?

A

NACLS are stateless, meaning both inbound and outbound rules will be check for entrance into the subnet.

45
Q

Can you associate a subnet with more than one route table?

A

No. A subnet can only be associated with a single route table at a time.

46
Q

What is a NAT Gateway?

A

An AWS resource which allows instances in a private subnet to connect to the internet or other AWS services, but does not allow public access

47
Q

How can you make a private subnet public?

A

The subnet is private because it is associated with a route table that does not have a route to the internet gateway. To make the subnet public, associate it with a route table that does have a route to the internet gateway

48
Q

How many VPCs are allowed per region?

A

5

49
Q

What is are some differences between a Security Group and a Network ACL?

A
  1. Security Groups apply to instances, NACLs apply to entire subnets.
  2. Security Groups only allow permissions, NACLs both allow and deny permissions.
  3. Security Groups are stateful, meaning inbound rules apply outbound.
  4. NACLs are stateless, so you must set both inbound and outbound rules.
50
Q

Are security groups stateful or stateless?

A

Stateful - This means if the inbound rule is set the outbound rule has the same settings.

51
Q

What does a route table’s destination represent?

A

The IP adress range where the packet will ultimately end up

52
Q

At what three levels can flow logs operate?

A

VPC Subnet Network Interface

53
Q

How many subnets can one VPC have?

A

200, but you can submit a request to Amazon for more

54
Q

How many IP addresses does amazon reserve when you create a subnet?

A
  1. So a /24 subnet which has 256 available addresses will only give you 251
55
Q

True or false: NAT Instances must have an Elastic IP to work

A

True

56
Q

When you create a new VPC, what else is created by default?

A
  1. A default route table
  2. A default network access control list
  3. A default security group No subnets are created
57
Q

When creating a Network ACL, by default is everything alallowed or denied?

A

Denied

58
Q

True or False: NAT instances and NAT gateways are available for both IPv4 and IPv6

A

False. IPv4 only

59
Q

If you need to block incoming traffic from a specific IP address, can you do so with Security Groups, Network ACLs, both or neither

A

Network ACLs. Only Network ACLs can block traffic,

60
Q

What are differences between the default VPC and a custom VPC?

A
  1. Default VPCs are user-friendly, so you can immediately start deploying resources
  2. All subnets in a default VPC have a route out to the internet
  3. In a default VPC, each EC2 instance has both a public and private IP address
61
Q

What is transitive peering?

A
  1. There is one central VPC, and individual VPCs are peered directly with it.
  2. Transitive peering allows the second VPC to then be peered with a third, allowing the first and third VPCs to share resources. This is not permitted in AWS.
62
Q

What is NACL?

A

Act like a frewall which controls traffic to and from subnet.

63
Q

What does Default NACL allow?

A

Allows everything outbound and inbound.

64
Q

How many NACL per subnet:

A

1 NACL per subnet.

New subnets are assigned the Defualt NACL.

65
Q

Define NACL rules:

A
  1. rule numbers 1-32766
  2. Lower the number higher the presidence (eg. 1 is higher than 200)
  3. (*) denies a request in case or no rule match
  4. AWS reccommends rule be 100
66
Q

Newly created NACL will:

A

Deny eveyrthing

67
Q

NACL are great for:

A

Blocking a specific IP at the subnet level.

68
Q

Route tables point to:

A

Internet gateways

69
Q

Subnets are associated with:

A

Route tables

70
Q

AWS reserves 5 IPs address:

A

First 4 and last 1 IP address in each Subnet

71
Q
  • ExamTip:
  • If you need 29 IP addresses for EC2 instances, you can’t choose a Subnet of size /27 (32 IP):
A

• You need at least 64 IP, Subnet size /26 (64-5 = 59 > 29,but 32-5 = 27 < 29)

72
Q

Because VPC is priavte, only Private IP ranges allowed:

A

10.0.0.0 - 10.255.255.255 (10.0.0.0/8)

  1. 16.0.0 - 172.31.255.255 (172.16.0.0/12)
  2. 168.0.0 - 192.168.255.255 (192.168.0.0/16)
73
Q

Default AWS CIDR IP ADDR:

A

172.16.0.0/12

74
Q

How many IP addresses on Subnets are reserved:

A

5

• Ex, if CIDR block 10.0.0.0/24, reserved IP are:

  1. 0.0.0: Network address
  2. 0.0.1: Reserved by AWS for the VPC router
  3. 0.0.2: Reserved by AWS for mapping to Amazon-provided DNS
  4. 0.0.3: Reserved by AWS for future use
  5. 0.0.255:Network broadcast address.AWS does not support broadcast in aVPC, therefore the address is reserved
75
Q
A
76
Q

Max CIDR per VPC:

A

5

77
Q

Max VPc in region:

A

5 (soft limit)

78
Q

VPC CIDR IP overlap:

A

VPC CIDR should not overlap with other networks.

79
Q

VPC CIDR Max size:

A

Max size is /16 = 65,536 IP addr.

80
Q

VPC CIDR Min size:

A

Min size is /28 = 16 IP addresses

81
Q

VPC defaults:

A

1• All new accounts have a default VPC
2• New instances are launched into default VPC if no subnet is specified

3• Default VPC have internet connectivity and all instances have public IP

4• We also get a public and a private DNS name

AWS 2020 Test date (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions