Network & Content Delivery

Question 1

What are the two different types of VPC endpoints?

Answer 1

• Gateway Endpoints rely on creating entries in a route table and pointing them to private endpoints used for S3 or DynamoDB.
• Interface Endpoints use AWS PrivateLink and leverage the new Network Load Balancer capabilities.

Question 2

True or False. Amazon S3 and DynamoDB use interface endpoints.

Answer 2

False. Amazon S3 and DynamoDB use gateway endpoints.

Question 3

True or False. You can access Amazon DynamoDB Streams through a VPC endpoint.

Answer 3

False. You cannot access Amazon DynamoDB Streams through a VPC endpoint.

Question 4

Multi True and False. If False, why?

• Endpoints are supported within the multi Regions. You can create an endpoint between a VPC and a service in a different Region.
• Endpoints support IPv6 traffic only.
• You cannot transfer an endpoint from one VPC to another, or from one service to another.

Answer 4

• False. Endpoints are supported within the same Region only. You cannot create an endpoint between a VPC and a service in a different Region.
• False. Endpoints support IPv4 traffic only.
• True. You cannot transfer an endpoint from one VPC to another, or from one service to another.

Question 5

Does Cloudfront have a geo restriction functionality? And if yes, how does it work?

Answer 5

• Allow your users to access your content only if they’re in one of the countries on a whitelist of approved countries.
• Prevent your users from accessing your content if they’re in one of the countries on a blacklist of banned countries.

For example, if a request comes from a country where, for copyright reasons, you are not authorized to distribute your content, you can use CloudFront geo-restriction to block the request.

This is the easiest and most effective way to implement a geographic restriction for the delivery of content.

Question 6

Can security groups block traffic based by country?

Answer 6

No, they cannot.

Question 7

True or False. Geo restriction applies to an entire web distribution. If you need to apply one restriction to part of your content and a different restriction (or no restriction) to another part of your content, you must either create separate CloudFront web distributions or use a third-party geolocation service.

Answer 7

True.

Question 8

True or False. One subnet can only connect with a single ACL but a single ACL can have multiple subnets.

Answer 8

True.

Question 9

True or False. A subnet can only be associated with one or more route table at a time.

Answer 9

False. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table.