VPC Section Summary

Question 1

CIDR

Answer 1

IP Range

Question 2

VPC

Answer 2

Virtual Private Cloud - we define a list of IPv4 & IPv6 CIDR

Question 3

Subnets

Answer 3

tied to an AZ, we define a CIDR

Question 4

Internet Gateway

Answer 4

at the VPC level, provide IPv4 & IPv6 Internet Access

Question 5

Route Tables

Answer 5

must be edited to add routes from subnets to the IGW, VPC Peering Connections, VPC Endpoints, …

Question 6

Bastion Host

Answer 6

public EC2 instance to SSH into, that has SSH connectivity to EC2 instances in private subnets

Question 7

NAT Instances

Answer 7

gives Internet access to EC2 instances in private subnets. Old, must be setup in a public subnet, disable Source/Destination check flag

Question 8

NAT Gateway

Answer 8

managed by AWS, provides scalable Internet access to private EC2 instances, IPv4 only

Question 9

Private DNS + Route 53

Answer 9

enable DNS Resolution + DNS Hostnames (VPC)

Question 10

NACL

Answer 10

stateless, subnet rules for inbound and outbound, don’t forget Ephemeral Ports

Question 11

Security Groups

Answer 11

stateful, operate at the EC2 instance level

Question 12

Reachability Analyzer

Answer 12

perform network connectivity testing between AWS resources

Question 13

VPC Peering

Answer 13

connect two VPCs with non overlapping CIDR, non-transitive

Question 14

VPC Endpoints

Answer 14

provide private access to AWS Services (S3, DynamoDB, CloudFormation, SSM) within a VPC

Question 15

VPC Flow Logs

Answer 15

can be setup at the VPC/Subnet/ENI Level, for ACCEPT and REJECT traffic, helps identifying attacks, analyze using Athena or CloudWatch Logs Insights

Question 16

Site-to-Site VPN

Answer 16

setup a Customer Gateway on DC, a Virtual Private Gateway on VPC, and site-to-site VPN over public Internet

Question 17

AWS VPN CloudHub

Answer 17

hub-and-spoke VPN model to connect your sites

Question 18

Direct Connect

Answer 18

setup a Virtual Private Gateway on VPC, and establish a direct private connection to an AWS Direct Connect Location

Question 19

Direct Connect Gateway

Answer 19

setup a Direct Connect to many VPCs in different AWS regions

Question 20

AWS PrivateLink/VPC Endpoint Services

Answer 20

• Connect services privately from your service VPC to customers VPC
• Doesn’t need VPC Peering, public Internet, NAT Gateway, Route Tables
• Must be used with Network Load Balancer and ENI

Question 21

ClassicLink

Answer 21

connect EC2-Classic EC2 instances privately to your VPC

Question 22

Transit Gateway

Answer 22

transitive peering connections for VPC, VPN, & DX

Question 23

Transit Mirroring

Answer 23

copy network traffic from ENIs for further analysis

Question 24

Egress-only Internet Gateway

Answer 24

like a NAT Gateway, but for IPv6