Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Architect > VPC > Flashcards

VPC Flashcards

1
Q

What is a Virtual Private Cloud (VPC)?

A

An isolated section of the AWS cloud where you can launch AWS resources in a user defined virtual network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How many regions can a VPC span?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How many AZs does a VPC span?

A

VPCs span all of the AZs in the Region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How many VPC’s can you have per region?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many subnets can a VPC contain?

A

“200

more can be requested through AWS”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is created in default VPCs?

A 
"A CIDR block size /16
A default subnet per AZ block size /20
An Internet Gateway 
A default security group 
A default NACL 
A default Route Table
Default DHCP options
*CIDR classless inter-domain routing"
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a Default Everywhere IP?

A

“0.0.0.0/0

represents all possible IP addresses”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In VPCs what is the Internet Gateway (IGW) component?

A

“A VPC component used to allow a VPC access to the internet
creates a target in the VPC route tables for internet-routable traffic
performs NAT for instances assigned public IPv4 addresses
*NAT network address translation”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

In VPCs what is the Routing Tables component?

A

A VPC component used to determine where network traffic is directed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the relationship between route tables and subnets?

A

“Each subnet in your VPC must be associated with a route table
A subnet can be associated with only one route table at a time
A route table can be associated with multiple subsets”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a Bastion / Jumpbox?

A

“An EC2 instance with hardened security, the only point that accepts SSH/RDP access from the internet, the only IP allowed to SSH/RDP into surrounding VPC components
Bastions/Jumpboxes must be located in a public subnet”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Bastion vs NAT

A

“NAT provides private subnets outbound access and denys inboud initiations from the internet
Bastions provide inbound access to private subnets”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is a Subnet?

A

“A logical subdivision of an IP network

Subnets can be public or private”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is AWS Direct Connect?

A

“An AWS solution for establishing dedicated network connections from on-premises locatoins to AWS
Offers a very fast and very consistant network
Low-end Bandwidth from 50-500M
High-end Bandwidth either 1GB or 10GB”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a NAT?

A

“Network Address Translation
A method of re-mapping one IP Address space into another
Use cases:
allowing private instances internet access
resolve network address conflicts”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

NAT instance vs NAT Gateway?

A

“Both are:
EC2 instances with NAT
located in public subnets
NAT instance(legacy)
Community maintained EC2 instance for NAT
EC2 controlled by the user
NAT Gateway
AWS maintained and managed EC2 instance for NAT
EC2s controlled by AWS
Launched with redundant instances in the slected AZ
Cannot associate a security group with a NAT gateway”

17
Q

Securly connect two private subnets in different peering VPCs?

A

Create a NAT gateway in both VPC and configure the routes

18
Q

What is the VPC Peering feature?

A

“It allows you to connect one VPC to another over a direct network route using private IP addresses
Instances on peered VPCs behave as though they were on the same network
Can connect to different AWS accounts and different regions”

19
Q

What are some limitations on the VPC Peering feature?

A

“Each connection must be explicitly created
There is no Transitive Peering(the connection must be direct and explicit)
Cannot connect VPC with overlapping CIDR Blocks”

20
Q

In VPCs what is a VPC Endpoint component?

A

“A private network connection from your VPC to anotherAWS service
Endpoints are supported within the same region only.
Benifits:
Instances in VPC don’t require public IP addresses to communicate to service resources
Traffic between your VPC and other services does not leave the AWS network”

21
Q

What are the two types of VPC Endpoints?

A

“Interface Endpoints
Use Elastic Network Interfaces (ENI) with a private IP adress
Powered by AWS PrivateLink
Costs
Gateway Endpoints
Free
Adds a target for a specific route in your route table
Most common use case is connecting to S3 and DynamoDB”

22
Q

What is the VPC Flow Logs feature?

A

“Monitors in-and-out traffic of your network interfaces within you VPC
They contain source and destination IP adresses (not hostnames)
They can be sent to either S3 or CloudWatch Logs”

23
Q

At what infrastructure level can you turn on CloudWatch Logs?

A

“VPC
Subnets
Network Interface
*Each level contains information from all sources below it as well”

24
Q

What are some limitations on VPC Flow Logs?

A

“Cannot be tagged like other AWS services
Cannot change the configuration once its created
Cannot enable flow logs for VPCs peered wiht you VPC unless it is in the same account
Some instance traffic is not monitored”

25
Q

What is a NACL?

A

“Network Access Control Lists

An optional layer of security for your VPC that acts like a firewall in an out of subnets”

26
Q

What level of access do default NACLs allow?

A

all outbound and inbound traffic

27
Q

How many NACLs can a subnet be associated with?

A

“all subnets must be associated to a single NACL
they cannot be associated to more that one NACL
if not explicitly associated to a NACL a subnet will automatically associate with the default NACL”

28
Q

NACL vs Security group

A

“security group - virtual firewall for your instance assigned at launch
NACL - optional layer for VPC that acts as a firewall for one or more subnets
Both
inbound and outbound rules
NACL
Rule can either Allow or Deny traffic
Security Group
Rule can only allow traffic”

29
Q

Precident order between NAT gateway and VPC endpoint

A

VPC endpoints take precedence over NAT Gateway or Internet Gateway

30
Q

Private vs Public vs Elastic IP

A

“Public - the machine can be identified on the internet
when you stop and start an EC2 the private ip remains the same but the public IP is lost
Private - can only be identified on a private network
Elastic - a public IPv4 you own as long as you don’t delete it
Using Elastic IPs usually reflects poorly on the architect as there are better ways to design access”

31
Q

What is the max number of Elastic IPs you can have per account?

A

“5

More can be requested through AWS”

32
Q

How are NACL rules evaluated?

A

“Rules are ordered from lowest to highest on the rule sheet
They are evaluated one by one until a rule matches traffic
Once matched this rule is applied regardless of any higher-numbered rule that contradicts it”

33
Q

How many target tracking scaling policies can an ASG have?

A

Multiple as long as each of them targets a different metric

34
Q

When using ASG, when do instances count during the warm-up phase?

A

Instance do not count in any metrics while the instance warmup is in progress

35
Q

virtual private gateway vs Cutomer Gateway

A

“The two sides of a VPN connection
Virtual private gateway - interface on the VPC
Customer gateway - either a virtual interface or a hardware interface on an outside network “

36
Q

What is DHCP?

A

“Dynamic host configuration protocol
when a new machine is attached to a network it sends out a request for an in-network IP address
the DHCP server or software hears and responds with an unregistered IP
the new machine responds and the connection is registered in the DHCP server or software”

37
Q

What is an EIP?

A

“Elastic Ip address
static ip address owned by you until you stop using it
free if attached to an EC2 instance, costs 0.01/hr if in reserve, charged if remapped >100 times”

38
Q

common ports to know

A

“3306 my SQL server.
443 https.
80 http”

39
Q

What is ClassicLink?

A

a component that allows a classic EC2 without a VPC to communicate with a VPC

AWS Architect (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions