Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS Solutions Architect- Associate > VPC > Flashcards

VPC Flashcards

1
Q

What are 3 IPs that are reserved for private IPs on a network?

A

1) 10.0.0.0 - 10.255.255.255
2) 172.16.0.0 - 172.31.255.255
3) 192.168.0.0 - 192.168.255.255

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Do you have to create your own VPC when running a new EC2 instance?

A

No, all new EC2 instances can be added to AWS’s default VPC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is VPC peering?

A

Allows you to join two VPCs and instances behave as if they are part of the same network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a VPC?

A

A logical data center in the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the 5 main components of a VPC?

A

1) IGWs (or VPGs)
2) Route tables
3) Network Access Control Lists
4) Subnets (1 subnet == 1 AZ)
5) Security groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Are Security groups stateful or stateless?

A

Security groups are stateful if you open one port (e.g. 22) then the outbound is allowed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a NACL?

A

Network Access Control List

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Are NACL stateful or stateless?

A

Stateless. You must specify inbound and outbound IP address rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Is transitive allowed for VPCs?

A

No, transitive peering is not allowed. Peering must be on a one to one basis, so separate connections must be made e.g. A and D VPC connection example

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

When a custom VPC is created what is created by default?

A

1) Route table
2) NACL
3) A security group (default)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What 2 things will not be created when a custom VPC is created?

A

1) Subnet

2) Default internet gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Are all assigned AZs the same for two independent AWS accounts?

A

No, they are not

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How many IP addresses are reserved within your subnet?

A

5

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is the maximum number of internet gateways you can have in a VPC?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What does NAT stand for?

A

Network Address Translation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What is a NAT instance used for?

A

A NAT instance is used to allow access to the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Where must NAT instances be situated?

A

They must be situated in a public subnet. There must be a route out of the private subnet to the NAT instance in order for this to work.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the most likely bottle neck of traffic in a NAT instance based network architecture?

A

The size of the NAT instance. Increase the instance size to reduce the bottle neck.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Are NAT instances in front or behind a security group?

A

Behind

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

How does a NAT gateway work?

A

An instance within your private subnet connects directly to a NAT gateway and the NAT gateway connect to the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Are NAT gateways in front or behind a security group?

A

In front

22
Q

What are the advantages of using a NAT gateway?

A

1) Implements redundancy within an AZ
2) Preferred by enterprise
3) Can scale massively up to 456GBs
4) No need to patch (unlike NAT instances)
5) Automatically assigned a public IP address

23
Q

What is NAT based AZ independent architecture? and how will it reduce the potential for failure?

A

Adding NAT gateways in each AZ and configuring routing to ensure that resources use the NAT gateway in the same AZ

24
Q

What traffic with you custom VPC default ACL allow?

A

ALL outbound and inbound traffic!

25
Q

When you create a custom ACL, by default what traffic is allowed?

A

By default custom ACLs DENIES ALL inbound and outbound traffic until you add rules

26
Q

What will happen if you do not associate a subnet in a VPC with a network ACL?

A

If you do not associate a subnet with a ACL it wiill automatically associate with the default network ACL (ALLOWS ALL OUTBOUND AND INBOUND TRAFFIC)

27
Q

Can you block IP addresses using a security group?

A

No, you can only block an IP address using a NACL

28
Q

Can you associate a network ACL with multiple subnets?

A

Yes, however a subnet can only be associated with one NACL at a time

29
Q

How does a NACL work?

A

It is comprised of a list of rules which are ordered numerically starting with the lowest numbered rule.

NACLs have separate rules for inbound and outbound traffic and each can either allow or deny traffic

30
Q

What order must allow and deny rules go in?

A

Deny rules must always go before an allow rule

31
Q

What is the minimum number of public subnets needed to deploy an internet facing load balancer?

A

2

32
Q

Can you enable VPC flow logs for peered VPCs that are not in your account?

A

No they must be within your AWS account

33
Q

Can you change the configuration of a flow log? e.g. associating a new IAM role with the flow log?

A

No, you cannot change the configuration of a flow log once created

34
Q

Is all traffic monitored within a VPC flow log?

A

No

1) traffic to/from a DNS server is not logged
2) Traffic from a windows instance for windows license activation
3) Traffic to/from instance metadata /latest/user-data/

35
Q

What is a bastion host?

A

A bastion host enables you to securely connect to your Linux instances without exposing your environment to the Internet.

Access instances in your VPC through Secure Shell (SSH) connections on Linux (inside private subnets). Bastion hosts are also configured with security groups to provide fine-grained ingress control

36
Q

Can you use NAT gateway as a bastion host?

A

No

37
Q

What is Direct connect?

A

A method to directly connect your data center to AWS.

38
Q

What is the use case for a direct connect?

A

Useful for high throughput workloads (lots of network traffic) and if you need a stable and reliable, secure connection

39
Q

What is a VPC endpoint?

A

Allows you to privately connect your VPC to supported AWS services. ** ALL WITHIN AWS ENV **

e.g. Instance > VPC gateway > S3 bucket.

40
Q

What are the 2 types of VPC endpoints?

A

1) Loads e.g. machine learning services…..

2) Gateways e.g. S3 and DynamoDB

41
Q

What are the X steps to creating own VPC?

A

1) Create subnet
- -> Select VPC > Set AZ > name subnet
2) Configure access to instances in VPC
- -> Allow auto assignment of public IPs (off by default)
3) Create an internet gateway and attach to VPC
4) Configure the route table
- -> Need to allow route out to internet > Create 2 > 1 public where you assign 0.0.0.0/0 and ;;/0 and 1 private route table for internal IP access.
5) Create EC2 instance select VPC and subnet association

42
Q

What is a VPN

A

Virtual Private Network

Lets you establish a secure and private encrypted tunnel from your network or device to the AWS global network

43
Q

What are 2 features of a VPN?

A

1) customer gateway

2) Virtual private gateway

44
Q

Are all EC2 instances assigned a private and public IP address by default?

A

Yes

45
Q

By default how many VPCs can you have per region?

A

5

46
Q

True of False… by default instances in new subnets in a custom VPC can communicate with each across an AZ

A

True

47
Q

What is the purpose of an egress only internet gateway?

A

An egress internet only internet gateway is used to allow IPv6 based traffic within a VPC access to the internet whilst denying any connection back into the VPC

48
Q

Can you conduct your own vulnerability scans on your AWS environment?

A

Yes, but some may require alerting AWS

49
Q

How many subnets can you create per VPC?

A

200

50
Q

What is a route table?

A

A route table contains a set of rules, called routes, that are used to determine where network traffic from your subnet or gateway is directed.

AWS Solutions Architect- Associate (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions