Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solutions Architect - Associate > VPC: Virtual Private Cloud > Flashcards

VPC: Virtual Private Cloud Flashcards

1
Q

Can VPCs owned by the same AWS account talk to each other be default?

A

No. VPCs are isolated by default. They must be configured to talk to other resources, such as other VPCs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is a Virtual Private Cloud (VPC)?

A

A virtual network inside AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Are VPCs global, Region, or AZ services?

A

Region

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is the default access setting for a Custom VPC?

A

Private and isolated. Nothing can communicate with a Custom VPC unless you configure the VPC to allow it.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many Default VPCs are allowed per Region?

A

One.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the default VPC CIDR for the Default VPC?

A

172.31.0.0/16

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Where are VPC subnets located?

A

In Availability Zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How many subnets does the default VPC have and where are they located?

A

The Default VPC for a Region has one subnet in each AZ in the Region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How resilient are subnets?

A

Subnets are AZ resilient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can the Default VPC be deleted?

A

Yes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Can the VPC CIDR of the Default VPC be changed?

A

No. It is always 172.31.0.0/16 and cannot be changed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How large are the subnets in the Default VPC?

A

/20 which is 4096 IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What type of IP addresses do resources that are deployed into the Default VPC receive automatically?

A

Public IPv4 addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the minimum and maximum sizes of a VPC inside AWS?

A

The minimum is /28 which is 16 IP addresses.

The maximum is /16 which is 65535 IP addresses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How resilient is a VPC?

A

VPCs are Region resilient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is dedicated tenancy for a VPC?

A

All resources created inside the VPC have to be on dedicated hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When assigning an IPv6 CIDR block to a custom VPC, what size must the block be?

A

/56, but the block must either be assigned by AWS or you must use addresses that you own.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the Route 53 DNS IP address in a VPC?

A

Base IP + 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What option must be set to enable DNS resolution (using the Base IP + 2 address) in a VPC?

A

enableDnsSupport

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What option must be set to give resources DNS names?

A

enableDnsHostnames

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the maximum number of Availability Zones that a subnet can be in?

A

One.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Can subnet IP ranges overlap with other subnets?

A

No.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the reserved IP addresses in an AWS subnet?

A
  1. Network address (x.y.z.0)
  2. Network + 1 address (x.y.z.1) - VPC router
  3. Network + 2 address (x.y.z.2) - DNS
  4. Network + 3 address (x.y.z.3) - Reserved
  5. Broadcast address (x.y.z.255) - Broadcast
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How many Availability Zones does a VPC’s router run in?

A

Every AZ that the VPC uses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What address is used to access the VPC’s router in each subnet?

A

The Network + 1 address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What set of rules defines how a VPC router operates?

A

A route table.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What notation is used to specify the default route in an AWS routing table?

A

0.0.0.0/0 for IPv4
::/0 for IPv6

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

If routes in the routing table overlap, which route has a higher priority?

A

The route with the higher prefix value because it is more specific. The exception is the default local routes which always take priority and route traffic within the VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How many subnets can a route table be attached to?

A

Zero or more.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

How many route tables can a subnet have?

A

One.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

How resilient is an Internet Gateway (IGW)?

A

An IGW is Region resilient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How many Internet Gateways can a VPC have?

A

Zero or one.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How many VPCs can an Internet Gateway be attached to?

A

Zero or one.

34
Q

What zone does an Internet Gateway run from within?

A

AWS Public Zone.

35
Q

When an EC2 instance inside a VPC has a public IPv4 address, where is that IPv4 address configured?

A

On the Internet Gateway. It is not actually configured on the instance itself. The IGW maps the public IPv4 address to the instance’s private IPv4 address and forwards packets appropriately. EC2 instances never have knowledge of their public IPv4 address.

36
Q

What is a Bastion Host / Jumpbox?

A

An EC2 instance in a public subnet that allows for incoming connections. It provides access to internal VPC resources and serves as the only ingress to the VPC.

37
Q

For a stateless firewall, how many rules are needed to govern a typical TCP connection?

A

Two. One rule for the outbound traffic and one for the inbound traffic. Because the firewall is stateless, it does not understand that the inbound and outbound traffic flows are part of the same request/response connection pair.

38
Q

When using stateless firewalls, what security risks are exposed because of the use of ephemeral ports?

A

Client devices use of ephemeral ports means that the firewall must allow traffic on the entire range of ephemeral ports.

39
Q

How do stateful firewalls lower admin overhead?

A

Correlating requests and responses reduces the number of firewall rules required to allow connections.

40
Q

What types of connections do Network Access Control Lists (NACL) govern?

A

NACLs govern traffic entering or leaving a subnet. Connection within a subnet are not governed by NACLs.

41
Q

How many rule types do NACLs have?

A

Two. Inbound and outbound rules.

42
Q

Are NACLs stateful or stateless?

A

Stateless.

43
Q

What type of actions do NACLs enable?

A

Explicit allow or explicit deny.

44
Q

How are NACL rules processed?

A

Starting at the lowest rule number until there is a match.

45
Q

What network security control mechanism should you use to explicitly deny traffic from known bad actors or bad IPs?

A

NACLs

46
Q

Are Security Groups stateful or stateless?

A

Stateful.

47
Q

Do Security Groups allow explicit DENY, implicit DENY, or both?

A

Implicit DENY only. Security Groups CANNOT explicitly DENY traffic.

48
Q

What can Security Groups be attached to?

A

IP, CIDRs, and the Elastic Network Interface (ENI) of AWS Resources.

49
Q

What does a Security Group reference apply to?

A

An SG reference applies to anything to which the SG is attached. This allows you to scale resources inside the security group without creating more rules.

50
Q

Can a Security Group reference itself?

A

Yes. This allows traffic between all resources that have the SG attached to them.

51
Q

What functionality does a NAT Gateway provide?

A

A NAT Gateway provides ranges of IP address that are not publicly routable with outgoing Internet and AWS Public Zone access. This is done using IP Masquerading.

52
Q

Where is a NAT Gateway deployed?

A

In a public subnet of a VPC.

53
Q

In a typical NAT Gateway deployment, where do the default routes for the private and public subnets point?

A

The default route for the private subnet points at the NAT Gateway.

The default route for the public subnet points at an Internet Gateway.

54
Q

How resilient is a NAT Gateway?

A

A NAT Gateway is AZ resilient.

55
Q

How much bandwidth does a NAT Gateway provide?

A

Up to 45 Gbps.

56
Q

How are NAT Gateways charged?

A
  1. An hourly rate (full hours only)
  2. Gb of data processed rate
57
Q

To enable maximum availability of NAT Gateway in a VPC, how many NAT Gateways must be deployed?

A

One in each Availability Zone that is being used.

58
Q

Does NAT Gateway work with IPv6?

A

No. All IPv6 addresses are publicly routable, so Internet Gateway works with IPv6 without needing a NAT Gateway.

59
Q

What data do VPC Flow Logs capture?

A

Metadata only. They do not capture packet contents.

60
Q

Are VPC Flow Logs realtime?

A

No. There is a delay between when traffic is observed and when data shows up in the log destination.

61
Q

What type of connections can Flow Logs capture metadata on?

A

ACCEPTED connections, REJECTED connections, or both.

62
Q

What does an Egress-Only Internet Gateway provide?

A

Outbound-Only Internet access for IPv6. IPv4 is handled by a NAT Gateway.

63
Q

How many Egress-Only Internet Gateways can you have?

A

Up to one for each VPC in a Region.

64
Q

What do Gateway Endpoints provide?

A

Access to services in the AWS Public Zone (specifically, S3 and DynamoDB) from private resources without implementing typical Internet-access infrastructure. This allows you to grant access to S3 and DynamoDB without also providing general Internet access to the private resources.

65
Q

How resilient is a Gateway Endpoint?

A

A Gateway Endpoint is Region resilient.

66
Q

How do you control the specific accesses (e.g., specific S3 buckets) that a Gateway Endpoint can provide access to?

A

By creating an Endpoint Policy.

67
Q

How do you implement cross-region access with Gateway Endpoints?

A

You can’t. They aren’t cross-region.

68
Q

What does an Interface Endpoint provide?

A

Access to services in the AWS Public Zone other than DynamoDB (S3 is now supported) from private resources without implementing typical Internet-access infrastructure. This allows you to grant access to DynamoDB without also providing general Internet access to the private resources.

69
Q

How resilient are Interface Endpoints?

A

They are AZ resilient.

70
Q

How is network access controlled with Interface Endpoints?

A

By using Security Groups. Gateway Endpoints do not work with Security Groups.

71
Q

What network protocols are supported by Interface Endpoints?

A

TCP and IPv4 only.

72
Q

How does an Interface Endpoint inject public services into the VPC?

A

By using PrivateLink.

73
Q

How do Gateway Endpoints and Interface Endpoints differ in implementation?

A

Gateway Endpoints automatically add prefixes to the VPC Router’s route table to route traffic to the specified public services.

Interface Endpoints inject an Elastic Network Interface into a subnet for each public service that you are trying to access. They use DNS to resolve to the IP address of the Interface Endpoint in the subnet.

74
Q

What does VPC Peering do?

A

It creates a direct, encrypted network link between exactly two VPCs.

75
Q

What is the maximum number of VPCs that can be connected by VPC Peering?

A

Two.

76
Q

Does VPC Peering support cross-region and cross-account peering?

A

Yes.

77
Q

What Security Group capability is available when using VPC Peering?

A

In the same Region, Security Groups can reference Security Groups in the peer VPC.

78
Q

How do you implement transitive peering with VPC Peering?

A

You can’t. You have to peer each pair of VPCs directly.

79
Q

After peering two VPCs, what addition steps are needed to ensure traffic flows correctly?

A

Routing configuration, Security Group configuration, and Network Access List configuration.

80
Q

What limitations are there for VPC CIDRs with regards to VPC peering.

A

VPC Peering connections cannot be created when there is overlap in the VPC CIDRs.

AWS Certified Solutions Architect - Associate (49 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions