VPC > VPC > Flashcards

VPC Flashcards

(76 cards)

Study These Flashcards
1
Q

VPC

A

Amazon Virtual Private Cloud that lets you provision logically isolated section of the AWS Cloud where you can launch AWS resources in a virtual network that you define

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Hardware VPN

A

Hardware Virtual Private Network - connection between your corporate datacenter and your VPC; leveraging the AWS cloud as an extension of your corporate DC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What can you do with VPCs?

A
  1. Launch instances into a subnet of your choosing
  2. Assign custom IP address ranges in each subnet
  3. Configure route tables between subnets
  4. Create internet gateway and attach it to our VPC
  5. Much better security control over your AWS resources
  6. Instance security groups
  7. Subnet NACL
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Default VPC vs Custom VPC

A
  1. Default VPC is user friendly, allowing you to immediately deploy instances
  2. All subnets in default VPC have a route to the internet
  3. Each EC2 instance has both public and private IP address
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

VPC Peering allows you to

A

connect one VPC with another via a direct network route using Private IP addresses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

In VPC peering, instances behave as if

A

they were on the same private network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

You can peer VPCs with

A
  1. other AWS accounts

2. other VPCs in the same account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Peering should be configured as

A

star configuration (1 central VPC peers with 4 others)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Transitive Peering

A

Means that B can’t go directly to C through A - there has to be a connection from B to C.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Think of VPC as a logical

A

DC in AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

VPC consists of

A
  1. IGW (VPG)
    2.Route tables
  2. NACL
    4, Subnets
  3. Security Groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Subnet to AZ ratio

A

1 Subnet = 1 AZ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Security Groups vs NACL in terms of defining rules

A

Security groups are STATEFUL while NACLS are stateless

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Transitive peering is not allowed - true or false

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Security groups only ? rules

A

allow rules ; no deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

with NACL, what can you do with rules?

A

allow and deny

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When a new VPC gets created, these get created automatically:

A
  1. Route Table
  2. NACL
  3. Default Security Group
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

IP addresses reserved for amazon use

A

first 4 and last IP in each subnet CIDR block (5)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What setting needs to be changed for a public subnet to be publicly accessible?

A

Auto-assign public IP should be changed to yes (default is no)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What happens when you initially create an IGW, does it automatically attaches to a VPC?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

How many IGW can be attached to a VPC?

A

1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Security groups in relation to VPC

A

it doesn’t span VPCs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

When a new VPC gets created, these do not get created automatically

A
  1. Subnets

2. Default IGW

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

How are AZs assigned?

A

randomized; US-East-1A in your AWS account can be a completely different zone to US-East-1A in another AWS account

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Default behavior of Security groups in terms of accessing each other
don't allow access to each other
26
NAT
Network Address Translation
27
What is a NAT Instance
a single ec2 instance that lives in your public subnet that allows your private instances to connect to the internet while blocking inbound traffic from the internet
28
NAT gateway
highly available gateway that allows your private subnets to communicate to the internet without becoming public
29
NAT instance vs NAT gateway
NAT gateway offers great availability and bandwidth and require less configuration and administration compared to NAT instance
30
What should be disabled to make an EC2 instance a NAT instance?
Disable source/destination check - it should be able to send and receive traffic when the source or destination is not itself
31
NAT instances must be in a ? subnet
public
32
In order for the NAT instance to work
there has to be route out of the private subnet to the NAT instance
33
The amount of traffic that the NAT instance can support depends on the
instance size..if there's a bottleneck, increase the instance size
34
A nat instance is behind what component in the configuration?
security group
35
Patching for NAT instance in comparison to NAT gateway
NAT instances need to be patched unlike NAT gateway
36
NAT gateways are redundant inside
AZ
37
NAT gateways are not associated with
security groups
38
NAT gateways are automatically assigned a
public ip address
39
NAT gateways can be shared by ? and its downfall?
resources in multiple AZs but if that AZ goes down, all your resources will lose internet access
40
NAT instances are preferred over NAT gateway - true or false
false; NAT gateways are preferred
41
What are the default rules when a NACL is created
default inbound and outbound rules only have DENY everything
42
VPC automatically comes with a default NACL - TRUE OR FALSE
TRUE
43
What are the Default NACL rules that gets tied to VPC when it gets created?
allows all outbound and inbound traffic
44
Custom NACL rules
denies all inbound and outbound traffic until you rules - STATELESS
45
Each subnet in your VPC must be associated with
a NACL
46
If you don't explicitly associate a subnet with a NACL, the subnet is automatically associated with
default NACL
47
How can IP addresses blocked
using NACLS not security groups
48
NACL relationship to a subnet
one NACL can be associated with multiple subnets
49
Subnet relationship to NACL
a subnet can only be associated to one NACL
50
Evaluation of numbered rules in NACLS
evaluation in order starting with the lowest numbered rule
51
NACLS have separate inbound and outbound rules and each rule can either allow or deny traffic - TRUE OR FALSE
TRUE
52
NACLS are stateless..meaning
responses to allowed inbound traffic are subject to the rules for outbound traffic and vice versa
53
When will the NACLS rule change take effect
immediately
54
If you deny a particular IP address in your NACL, will it reach your security group
no
55
When defining a Load balancer, you need to have at least how many subnets
2
56
If you're going to use a subnet for Load Balancer, what do you need to have?
it has to be public subnet with IGW attached
57
VPC flow logs
feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC
58
Flow log data is stored using
Amazon cloudwatch logs
59
Flow logs can be created at 3 levels:
1. VPC 2. Subnet 3. Network Interface Level
60
You cannot enable flow logs for VPCs that are peered with your VPC unless the peer VPC is in your account - true or false
true
61
Can you tag a flow log
NO
62
After you've created a flow log, you can still change its configuration - true of false
false
63
Not all IP traffic is monitored:
1. Traffic generated by instances when they contact Amazon DNS. 2. Traffic generated by a windows instance for Amazon windows license activation 3. Traffic to and from 169.254.169.254 for instance metadata. 4. DHCP traffic 5. Traffic to the reserved IP addresses for the default VPC router
64
Bastion host
special purpose computer on a network specifically designed and configured to withstand attacks
65
NAT Gateway/NAT instance - used to provide
internet traffic to EC2 instances in a private subnet
66
Bastion is used to securely
administer EC2 instances using SSH or RDP
67
NAT gateways can be used as Bastion host - true or false
false
68
AWS Direct connect
cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS
69
Direct connect directly connects your
DC to AWS
70
Direct connect is useful for
1. high throughput workloads (lots of network traffic) | 2. need a stable and reliable secure connection
71
VPC End point
enables you to privately connect your vpc to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection or AWS Direct Connect connection.
72
Instances in your VPC require public ip address to communicate with resource in the service - true /false
false
73
If you use the VPC endpoint, traffic between your VPC and other service do not leave the amazon network
true
74
2 types for end points
1. Interface Endpoints | 2. Gateway Endpoints
75
Interface Endpoint
an elastic network interface with a private IP address that serves as an entry point for traffic destined to a supported device
76
Gateway Endpoint supports
1. S3 | 2. Dynamo DB
VPC
flashcards
Decks in class (1)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions