Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Certified Solutions Architect Associate SAA-C02 > VPCs > Flashcards

VPCs Flashcards

1
Q

VPC

A

virtual data center in the cloud

1 subnet = 1 AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Largest subnet you can use in your VPC

A

10.0.0.0/16

65,526 addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

VPC features

A

launch instances in a subnet of our choosing
assign custom IP address ranges
configure route tables between subnets
create internet gateway and attach to our VPC
NACLs
instance security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Default vs custom vpc

A

default: user friendly; allows immediate deployment of instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

VPC peering

A

connects 2 VPCs via a direct network route using private IP addresses
Instances behave as if they were on the same private network
can peer across regions
Does not support transitive peering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

security groups vs NACLs

A

security groups: stateful
NACLs: stateless
need to add individual allow and deny lists

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What gets created by default when you create a VPC

A

route table
NACLs
security group

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Route table best practice

A

Keep primary route table private

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

VPC security groups

A

security groups cannot span multiple VPCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

NAT instance vs NAT gateway

A

NAT instance - invidiual instance

NAT gateway - highly available way to provide internet access to private subnets w/out becoming public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

NAT gateways HA/DR

A

redundant inside an AZ

cannot span multiple AZs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

NAT gateway security groups

A

Not associated with security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

NAT gateway config info

A 
no need to patch
need to update route tables
automatically assigned a public ip addr
no need to disable source/dest checks
create a nat gateway in each availability zone
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

NACLs and Security Group order of operations

A

NACLs resolved before security groups

NACL rules resolved in order of rule #, stopping on match

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ACL and subnet associations

A

ACL - can have many subnets

subnet - can only have one ACL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Load balancer config

A

need at least 2 public subnets

17
Q

VPC flow log levels

A

vpc
subnet
network interface level

18
Q

VPC flow log config

A

cannot change VPC config after it’s created
cannot associate a different IAM role w/ flow log
can tag flow logs

19
Q

Bastion host - definition

A

special purpose computer designed and configured to withstand attacks

Either outside of firewall or in DMZ

helps reduce attack surface by removing need to harden devices behind it

used to securely administer EC2 instances

AKA jump box

20
Q

Direct Connect

A

service solution used to establish a dedicated network connection from on-prem to AWS

reduces network costs
increases bandwidth
stable and reliable secure connection

21
Q

global accelerator

A

improves availability and performance of apps

directs traffic to optimal endpoints over AWS

by default provides two default IP addresses
-customer can bring their own

22
Q

global accelerator components

A 
static ip addresses
accelerator
dns name
network zone
listener
endpoint group
endpoint
23
Q

global accelerator network zone

A

services the static ip addresses
similar to an AZ
each zone is isolated within it’s own physical infrastructure

24
Q

global accelerator listener

A

processes inbound connections from clients to global accelerator based on configured port and protocol

listeners forward traffic to endpoints in attached/associated endpoint groups

endpoint groups associated to listeners by region

25
Q

global accelerator endpoint group

A

associated w/ specific aws regions

can specify percentage of traffic directed to each endpoint group

26
Q

global accelerator endpoints

A

NLB, ALB, EC2 instances, Elastic IP addresses

can have weights to specify proportion of traffic received by endpoint

27
Q

VPC endpoint

A

virtual device that allow communication between instances in your VPC and services

allows you to privately connect to VPC w/out requiring an internet gateway, NAT device, VPN, or DirectConnect

28
Q

VPC endpoint types

A

interface endpoint

gateway endpoint

29
Q

interface endpoint

A

network interface w/ private IP addresses that serve as an entry point for traffic to a supported service

30
Q

supported gateway endpoint services

A

amazon s3

dynamo db

31
Q

gateway endpoint

A

similar to NAT gateways

32
Q

PrivateLink

A

Open services in a VPC to other VPCs

Only requires an NLB on the service VPC and an ENI on the client VPC

33
Q

Transit Gateway

A

A way to simplify your network topology

Provides transitive peering between many VPCs and on-prem data centers

can be used across multiple AWS accounts via RAM

can use route tables

supports IP multicast

34
Q

VPN Cloudhub

A

Allows users to connect into a virtual private gateway via VPN

The vpg provides access to VPC subnets

good when there are multiple sites w/ their own VPN connection

35
Q

Network Costs

A

Free
-instances w/in same AZ

Not free

  • instances in different AZs via private IP
  • – more if traffic needs to go over public IP
  • instances in different regions
36
Q

IP traffic that is not monitored/logged

A

DNS traffic to Amazon DNS server

Traffic to Amazon Windows license activation

Traffic to/from 169.254.169.254

DHCP traffic

traffic to reserved IPs for reverse IP routing

37
Q

Direct Connect setup steps

A

Create virtual interface in Direct Connect console

Create a customer gateway

Create a virtual private gateway

attache virtual private gateway to desired VPC

create a new vpn connection

select the virtual private gateway and the customer gateway

set up vpn on customer gateway or firewall

38
Q

Max number of VPCS per account per region

A

5

39
Q

max internet gateways per VPC

A

1

AWS Certified Solutions Architect Associate SAA-C02 (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions