AWS Solutions Architect Professional > Networking > Flashcards

Networking Flashcards

(50 cards)

Study These Flashcards
1
Q

Route53 Record Types

A
  • A - maps a hostname to IPv4
  • AAAA - maps hostname to IPv6
  • CNAME - maps a hostname to another hostname
  • NS - Name Servers for the Hosted Zone (indicates which DNS server is authoritative for that domain)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Route53

CNAME vs Alias

A
  • CNAME: Points a hostname to any other hostname (can’t be use with root domain)
  • Alias: Points a hostname to an AWS resource (works with root domain) and is free of charge.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Route53

Alias Records Targets

A
  • ELB
  • CloudFront Distributions
  • API Gateway
  • Elastic Beanstalk
  • S3 websites
  • VPC Interface endpoints
  • Global Accelerator
  • Route53 record in the same hosted zone
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Routing Policies

Simple

A

Route traffic to a single resource, can’t be associated with Health Checks. If a record has multiple values, a random one is chosen by the client.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Routing Policies

Weighted

A

Control de % of the requests that go to each resource. Can be associated with Health Checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Route Policy

Latency based

A

Redirect to the resource that has the least latency, based on traffic between users and AWS regions. Can be associated with Health Checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Routing Policies

Failover (Active-Passive)

A

You have a primary and secondary record for disaster recovery.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Routing Policies

Geolocation

A

Based on user location by continent, country or US state Can be associated with Health Checks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Routing Policies

Geoproximity

A

Based on the geographical location of users and resources. Ability to shift more traffic to resources based on the defined bias.

Must use Route53 Traffic Flow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Route53 Traffic Flow

A

Visual editor to
* Manage complex routing trees
* Create and mantain records in complex configurations.
* Configurations can be saved as Traffic Flow Policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Routing Policies

Multi-Value

A

Can be associated with Health Checks, returns up to 8 healthy records.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Routing Policies

IP-based Routing

A

You provide a list of CIDRs for your clients and the corresponding endpoints. Optimizes performance and reduces network costs.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Route 53

Hosted Zones

A

Container for records that define how to route traffic.

  • Public: specify how to route traffic on the Internet
  • Private: specify how to route traffic within one or more VPCs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DNS Security Extensions (DNSSEC)

A

Verifies DNS data integrity and origin. Works only with Public Hosted Zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Route53 Health Checks

A
  • Health checks that monitor a public endpoint
  • Health checks that monitor up to 256 other health checks (calculated health checks)
  • Health checks that monitor CloudWatch alarms (efective for private resources)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Route53 Resolver

A

Answers DNS queries for:
1. Local domain names for EC2 instances
2. Records in Private Hosted Zones
3. Records in public Name Servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Route 53

Resolver Endpoints for Hybrid DNS

A

Can be associated with one or move VPCs in the same region
* Inbound Endpoint forward external DNS queries of domain names, for AWS resources and records in Private Hosted Zones to Route 53 resolver.
* Outbound Endpoint Conditionally forwards DNS queries to other DNS resolvers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

AWS Global Accelerator

A

Provides static IP addresses that serve as single fixed entry points for your clients. You associate them to regional endpoints. Accept incoming traffic onto the AWS global network from the edge location that is closest to your users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

With which resources does standard Global Accelerator works?

A
  • Elastic IP
  • EC2 instances
  • ALB
  • NLB

Continuously monitors the health of all endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

CloudFront vs Global Accelerator

A

CloudFront
* Improves performance for both cacheable content
* Dynamic content served at the edge

Global Accelerator
* Manage traffic globally to multiple regional applications
* Optimize API performance by reducing latency
* Use static IP addresses for application access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Network ACLs

Study These Flashcards
A

Stateless firewall at the subnet level. Supports allow and deny rules

22
Q

Security Groups

Study These Flashcards
A

Stateful rules at the instance level. Only supports allow rules

23
Q

VPC Peering

Study These Flashcards
A
  • Connect to VPC privately using AWS network.
  • Is not transitive.
  • Must update route tables in subnets, uses the longest prefix match.
24
Q

VPC Peering

Edge to edge routing

Study These Flashcards
A

Invalid configuration of VPC Peering. Not transitive with VPN, Direct Connect, IGW, NAT and VPC Endpoints.

25
Transit Gateway
Transitive peering between thousands of VPCs and on-premise. Is a hub-and-spoke connection.
26
How to configure Transit Gateway Cross Account
Share Transit Gateway using Resource Access Manager (RAM)
27
IP Multicast in AWS
Only Transit Gateway allows to send IP datagrams to a group of interested receivers in a single transmission.
28
A single internet exit point
* Create a central NAT Gateway in a public subnet * Create an ENI in a private subnet to which Transit Gateway redirects traffic * Connect all VPCs to a Transit Gateway * Create Routing Tables to direct traffic to the NAT Gateway
29
Direct Connect Gateway and Transit Gateway
Is possible to connect one direct connect gateway to multiple transit gateways in different regions
30
Transit Gateway Peering Attachments
You can do an intra-region or inter-region peering mesh. If data go cross-region it has standard charges.
31
VPC Endpoints
Allow you to connect to AWS services using a private network
32
VPC Endpoint Gateway
For S3 and DynamoDB * One gateway per VPC * Must update route tables entries * DNS resolution must be enabled in VPC
33
VPC Endpoint Interface
For all services, * Provision an ENI that will have a private endpoint interface hostname * Must be in a subnet * Enable private DNS so public hostname of a service will resolve to de private endpoint interface hostname * Can be accessed from Direct Connect and VPN
34
VPC Endpoint Gateway troubleshooting
* Check SGs outbound rules * Check VPC endpoint policy * Check route tables * Check DNS resolution is enabled * Check S3/Dynamo policy
35
Private Link
Secure way to expose a service to other VPCs without peering, internate gateway or NAT. * Requires a NLB on the service side and an ENI on the consumer side
36
Connect to S3 with Direct Connect
In a VPC create a PrivateLink to which DirectConnect sends traffic. From there direct it to a Interface VPC Endpoint and to S3.
37
Site to Site VPN configuración
1. On-premise setup a VPN appliance accessible using a public IP 2. On AWS setup a Virtual Private Gateway and attach it to a VPC 3. On AWS setup a Customer Gateway pointing to the VPN appliance
38
Site to Site VPN and Direct Connect Internet Access
It is not possible to connect a S2S VPN and Direct Connect to an Internet Gateway through a NAT Gateway. Must use a NAT Instance
39
AWS VPN CloudHub
Connect up to 10 Customer Gateways to a Virtual Private Gateway
40
AWS Client VPN
Connect from a computer using OpenVPN to a private network on AWS
41
Direct Connect Gateway
Setup a Direct Connect to one or more VPCs in different regions. Can also be used to connect to a Transit Gateway.
42
Border Gateway Protocol
Set of rules that determine the best network routes for data transmission on the internet
43
# Direct Connect Virtual Interfaces (VIF)
Enable access to AWS services public VIF or private VIF. A transit VIF is used to access one or more Transit Gateways associated with Direct Connect gateways
44
IPv6 for existing VPCs and subnets
1. Associate an IPv6 CIDR block with your VPC and subnet 2. For a public subnet, create a route that routes **all IPv6 traffic** from the subnet to the internet gateway. For a private subnet, create a route that routes **all internet-bound IPv6 traffic** from the subnet to an egress-only internet gateway. 3. Update your security groups rules 4. Assign IPv6 addresses to your instances
45
Egress-only internet gateway
Allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection.
46
Egress-only internet gateway vs NAT gateway
An egress-only internet gateway is for use with IPv6 traffic only. To enable outbound-only internet communication over IPv4, use a NAT gateway instead.
47
Keep a static MAC Address in an EC2 instance
If a static MAC address is assigned to an Elastic Network Interface it remains unchanged
48
VPC Routing Enhancement
Any traffic from within a VPC destined to a target within the VPC is covered by the local route and therefore directly routed. The enhancement allows you to configure specific routes at a subnet route table level or replace target for the “local” destination with a middlebox such as firewall.
49
Virtual appliances to handle traffic filtering and provide security inspection capabilities
1. Gateway Load Balancer is deployed in a separate security VPC along with the virtual appliances. Because GLB endpoints are a routable target. 2. To ensure flow symmetry, appliance mode is enabled on the Transit Gateway
50
Reserved IP addresses in subnet
1. First IP Address: Network address 2. Second IP Address: VPC Router 3. Third IP Address: DNS Server 4. Fourth IP Address: Future use 5. Last IP Address: Broadcast address
AWS Solutions Architect Professional
flashcards
Decks in class (11)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions