AWS Cloud Practitioner Flashcards
(51 cards)
What are subnets?
Subnets are separate areas that are used to group together resources. They are also used to control access/traffic permissions to the gateway.
T/F: Subnets can be public or private.
TRUE
What are Public subnets?
Public subnets contain resources that need to be accessible by the public, such as an online store’s website.
What are Private subnets?
Private subnets contain resources that should be accessible only through your private network, such as a database that contains customers’ personal information and order histories.
What is a packet?
A packet is a unit of data sent over the internet or a network.
When a customer requests data from an application hosted in the AWS Cloud, this request is sent as a packet.
T/F: A packet enters into a VPC through an internet gateway.
TRUE
T/F: Before a packet can enter into a subnet or exit from a subnet, it checks for permissions.
TRUE - These permissions indicate who sent the packet and how the packet is trying to communicate with the resources in a subnet.
T/F: The VPC component that checks packet permissions for subnets is an instance.
FALSE - The VPC component that checks packet permissions for subnets is a network access control list (ACL).
What is a Network Access Control List?
A network access control list (ACL) is a virtual firewall that controls inbound and outbound traffic at the subnet level. The ACL also checks packet permissions for subnets.
T/F: By default, your account’s default network ACL allows all inbound and outbound traffic, but you can modify it by adding your own rules.
TRUE
T/F: For custom network ACLs, all inbound and outbound traffic is denied until you add rules to specify which traffic to allow.
TRUE
T/F: All network ACLs have an explicit deny rule. This rule ensures that if a packet doesn’t match any of the other rules on the list, the packet is denied.
TRUE
stateless packet filtering
Network ACLs perform stateless packet filtering. They remember nothing and check packets that cross the subnet border each way: inbound and outbound.
When a packet response for that request comes back to the subnet, the network ACL does not remember your previous request. The network ACL checks the packet response against its list of rules to determine whether to allow or deny.
Security groups
A VPC component (a virtual firewall) that checks packet permissions and controls inbound and outbound traffic for an Amazon EC2 instance.
T/F: By default, a security group denies all outbound traffic and allows all inbound traffic. You can add custom rules to configure which traffic to allow or deny.
FALSE - By default, a security group denies all inbound traffic and allows all outbound traffic. You can add custom rules to configure which traffic to allow or deny.
T/F; Security groups perform stateful packet filtering. They remember previous decisions made for incoming packets.
FALSE
T/F: Both network ACLs and security groups enable you to configure custom rules for the traffic in your VPC.
TRUE
Which VPC component should be used for isolating databases containing customer’s personal information?
Private subnet
Which VPC component should be used for creating a VPN connection between the VPC and the internal corporate network?
Virtual private gateway
Which VPC component should be used for supporting the customer-facing website?
Public subnet
Which VPC component should be used for establishing a dedicated connection between the on-premises data center and the VPC?
AWS Direct Connect
Which statement best describes an AWS account’s default network access control list?
A. It is stateless and denies all inbound and outbound traffic.
B. It is stateful and allows all inbound and outbound traffic.
C. It is stateless and allows all inbound and outbound traffic.
D. It is stateful and denies all inbound and outbound traffic.
C. It is stateless and allows all inbound and outbound traffic.
Network access control lists (ACLs) perform stateless packet filtering. They remember nothing and check packets that cross the subnet border each way: inbound and outbound. Each AWS account includes a default network ACL. When configuring your VPC, you can use your account’s default network ACL or create custom network ACLs.
By default, your account’s default network ACL allows all inbound and outbound traffic, but you can modify it by adding your own rules. For custom network ACLs, all inbound and outbound traffic is denied until you add rules to specify which traffic should be allowed. Additionally, all network ACLs have an explicit deny rule. This rule ensures that if a packet doesn’t match any of the other rules on the list, the packet is denied.
T/F: Every EC2 instance, when it’s launched, automatically comes with a security group. And by default, the security group does not allow any traffic into the instance at all. All ports are blocked; all IP addresses sending packets are blocked.
TRUE
T/F: You can modify the security group to accept a specific type of traffic.
TRUE
