Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Adrian C - AWS Pro Arch > Networking and Hybrid > Flashcards

Networking and Hybrid Flashcards

1
Q

What services does DCHP provide to a client?

A

IP address, subnet mask, default gateway. Also DNS servers. Netbios name server, NTP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

At what network layer does DHCP start its communicaiton?

A

Layer 2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Are DHCP option sets changeble once implemented?

A

No, immutable

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How many VPCs can DHCP option sets be associated with?

A

0 to many

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

How many DHCP option sets can VPC have?

A

0 or 1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Are changes to DHCP option sets immediate?

A

Yes, but client DHCP renew takes time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Can you provide your own EC2 domain names using DHCP option sets?

A

Yes, you have to configure your own custom domains and DNS servers and add config to the option set

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is the default gateway for an AWS DHCP option set?

A

VPC router (subnet +1)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is the default DNS server in an AWS DHCP option set?

A

R53 resolver (VPC +2)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Is the VPC router HA?

A

Yes, it is highly available across the region when you provision a VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How does the VPC router participate in each subnet?

A

It has an interface in each subnet, which is the subnet +1 address and is the default gateway in a DHCP option set.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How do you configure the behavior of the VPC router?

A

By using route tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

At what level of the VPC do route tables work?

A

Trick quesiton: They are defined at the VPC level, but associated to a subnet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Can a subnet be associated to more than one route table at a time?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Explain how the default route table works

A

Created at the time of the VPC, associated with all subnets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

If a route table has two paths to a destination, how does it select the route it will use?

A

Selects the most specific path first.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Name on other time route tables can be associated with

A

Gateways

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does target = local mean on a route table

A

in the current VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is always in the route table and uneditable?

A

The local route

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is the primary concern with using stateless firewalls?

A

You have to account for both incoming and outgoing connections of a communication chain. Often means you have to allow all outbound to ephemeral ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where do NACLs fit in the VPC hierarchy?

A

They operate at the subnet boundary…things coming into the subnet and things going out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What two sets of rules do NACLs have?

A

Inbound
Outbound

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

NACLs allow both of what

A 
Explicit Allows
Explicit Denies (different that SGs)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Explain NACL rule evaluation

A

First it selects direction
Then it starts with the lowest rule number
Stops at first match

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the catch all rule in NACLs?

A

a * that catches everything and Denies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

NACL screen shot

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Default NACL

A

Rule 100 that allows all

Catch all that Denies if that first rule didn’t exist.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

At what level are NACLs defined?

A

At the VPC level, but are associated with different subnets. A subnet can have one NACL assoicated at a time. A NACL can be assigned to many subnest in the VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Can you use AWS logical resources in NACLs?

A

No, only IPs, IP ranges, and ports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What can you not do with SGs

A

You cannot explicitly deny traffic with SGs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What can you do with SGs that you can’t do with NACls?

A

You can apply them to enis

You can use IP/cidr ranges…and AWS logical resources…and reference other SGs…and reference yourself!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is automatically allowed with SGs?

A

response traffic

33
Q

Name a benefit of security groups

A

Self reference, basically allows all communication between everything with this SG.

34
Q

Parent region

A

The region that a local zone is tied to and relies upon for management and operational support

35
Q

us-west-2-las-1

A

Parent region: us-west-2

Local zone: las-1

36
Q

Can you have more than one local zone in an area?

A

Yes

37
Q

Do local zones have built in resilience like and AZ?

A

No

38
Q

In local zones, some services utilize services in the parent region

A

EBS snapshots a good example here. Snapshots sent to S3 in the parent region to achieve redundancy and HA

39
Q

Numbers 0-65535 allocated by IANA

A

ASNs Autonomous System Numbers

40
Q

64512-65535

A

Private ASNs

41
Q

BGP operates over this

A

TCP 179

42
Q

BGP exchanges network topology with its peers and is focused on determining the best path to a destination (least hops, not fastest), which is also know as this

A

ASPATH

43
Q

How many routes does a BGP route advertise to the other BGP routers it is peered with?

A

One, the shortest path

44
Q

What if a BGP path is slow and an admin want’s to force a different path?

A

AS Path Prepending can be used…make the ASPATH artificially longer

45
Q

What type of address allows a single IP to be “assumable” by many devices in different locations, with the result of the traffic going to the device closest to the request?

A

Anycast IP

46
Q

What type of addressing does Global Accelerator use to route traffic to the nearest edge location, and then over the AWS transit network?

A

Anycast IP

47
Q

Key difference between AWS Global Accelerator and CloudFront

A

AWS Global Accelerator is any network traffic (TCP/UDP), CloudFront HTTP/HTTPS and caching etc. Global accelerator trying to get you to the closest service endpoint on the fastest route possible.

48
Q

Which phase of an IPSEC VPN tunnel is associated with key exchange and considered slow and heavy?

A

IKE Phase 1

49
Q

Which phase of an IPSEC VPN tunnel is associated with encryption algorithm negotiation, bulk key agreement, and runs over IKE Phase 1?

A

IKE Phase 2

50
Q

Which IKE phase is considered permanent, and one that is fired up for “interesting traffic”?

A

IKE Phase 1 permanent

IKE Phase 2 interesting

51
Q

What type of VPN is an AWS Site-to-Site VPN?

A

IPSEC

52
Q

What are the three components of a site to site VPN?

A

Virtual Private Gateway (VGW)

Customer Gateway (CGW)

VPN Connection between the two

53
Q

Three key components of the Virtual Private Gateway (VGW)

A

Logical gateway that you can attach to the VPC

It can be the target of routes

Lives in the AWS Public Zone

54
Q

Customer Gateway (CGW)

A

Must contain all of the data about the physical router on the customer site, but is a logical representation of that device in AWS.

55
Q

Is a Virtual Private Gateway (VGW) highly available?

A

Yes, it has at least two public IPV4 endpoints in different AZs in the AWS public zone.

56
Q

When you configure a VPN to communicate between the VGW and a CGW, how many tunnels are established?

A

Two, one from each public endpoint of the VGW.

57
Q

What is a static VPN?

A

Routes to the on-premises traffic are configured to route through the VGW on the AWS side, and routes to AWS are configured to route through the CGW on the on prem side.

58
Q

To acheive HA with a site to side VPN, do you need two VGWs?

A

No, but you do need two CGWs, preferably one in a different building on the customer site. From the VGW, it can understand the second CGW and create new VPNs using new public enpoints.

59
Q

What key technology is in use for Dynamic VPNs?

A

BGP

60
Q

Can you use static routing over Dynamic VPNs?

A

Yes, you can, but you can also enable route propagation on your VGW and the BGP routers will advertise their routing information to each other.

61
Q

AWS enforced limit on site to site VPNs

A

1.25 Gbps

62
Q

If latency is an issue for your application, should you choose VPN?

A

Not if you have faster, better performing, more reliable options

63
Q

AWS VPN Cost

A

Hourly, GB out

64
Q

If speed of setup is your key factor, what private connection technology should you choose

A

Site to Site VPN

65
Q

What are the 3 valid attachment types for Transit Gateways?

A

VPC

Site-to-Site VPN

Direct Connect Gateway

66
Q

Transit Gateway has these two properties out of the box

A

HA

Scalable

67
Q

Does VPC peering support transitive routing?

A

No, if you peer A and B and B and C, you still need to peer A and C…and set up routes.

68
Q

Can you terminate a site-to-site VPN on a Transit Gateway, or do you have to terminate it on a Virtual Private Gateway in a VPC?

A

Can terminate at TG

69
Q

Is transit gateway routing transitive?

A

Yes, one you peer a VPC to a TG, it can transitively route traffic

70
Q

Does TG have any limitations for regions and accounts?

A

No, you can peer/share across regions and accounts.

71
Q

What tech would one use to share a TG across accounts?

A

RAM - Resource Access Manager

72
Q

By default, how many route tables does a Transit Gateway have
?

A

1

73
Q

Three properties of the TG default route

A

All attachments use this route table

All attachments dynamically add to it

All attachments can route to all attachments

74
Q

Do peered transit gateways propgate route information?

A

No. You need to use static routes to

75
Q

Just like VPC peering traffic, traffic is this in transit between TG to TG peers

A

Encrypted

76
Q

How many route tables can a TG attachment be associated with?

A

1

77
Q

How many attachments can TG route tables be associated with?

A

Many

78
Q

Steps to isolate routing with TG

A

Define route tables on the TG

Propogate routes to route tables that you want to enable communication, exclude propgating CIDR ranges that you don’t want to route to

Attach route table to appropriate TG attachments

79
Q

What direction of traffic does a route table apply to?

A

Stuff coming out of an attachment, VPC, etc

Adrian C - AWS Pro Arch (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions