VPC Section

Question 1

VPC Definition & Components

Answer 1

• VPC -Virtual Private Cloud: private network to deploy your resources
(regional resource)
• Subnets allow you to partition your network inside your VPC (Availability Zone resource)
• A public subnet is a subnet that is accessible from the internet
• A private subnet is a subnet that is not accessible from the internet
• To define access to the internet and between subnets, we use Route Tables
.

Question 2

Internet Gateway

Answer 2

• Helps our VPC instances connect with the internet

* Public Subnets have a route to the internet gateway.

Question 3

NAT Gateways (AWS-managed) & NAT Instances (self-managed)

Answer 3

allow your instances in your Private Subnets to access the internet while remaining private

Question 4

NACL (Network ACL)

Answer 4

• A firewall which controls traffic from and to subnet
• Can have ALLOW and DENY rules
• Are attached at the Subnet level
• Rules only include IP addresses

Question 5

Security Groups

Answer 5

• A firewall that controls traffic to and from an ENI / an EC2 Instance
• Can have only ALLOW rules
• Rules include IP addresses and other security groups

Question 6

Network ACLs vs Security Groups

Answer 6

Security Group
• Operates at instance level
• Supports allow rules only
• Is stateful: Return traffic is automatically allowed, regardless of any rules

NACL
• Operate at subnet level
• Supports allow/deny rules
• Is stateless: Return traffic must be explicitly allowed by rules

Question 7

VPC Flow Logs

Answer 7

Capture information about IP traffic going into your interfaces:
• VPC Flow Logs
• Subnet Flow Logs
• Elastic Network Interface Flow Logs

• Helps to monitor & troubleshoot connectivity issues.

Question 8

VPC Peering

Answer 8

• Connect two VPC, privately using AWS’ network (same network behavior)
• Must not have overlapping CIDR (IP address range)
• not transitive

Question 9

VPC Endpoints

Answer 9

• Endpoints allow you to connect to AWS Services using a private network instead
of the public www network
• This gives you enhanced security and lower latency to access AWS services
• VPC Endpoint Gateway: S3 & DynamoDB
• VPC Endpoint Interface: the rest

Question 10

Site to Site VPN

Answer 10

• Connect an on-premises VPN to AWS
• The connection is automatically encrypted
• Goes over the public internet
• On-premises: must use a Customer Gateway (CGW)
• AWS: must use a Virtual Private Gateway (VGW)

Question 11

Direct Connect (DX)

Answer 11

• Establish a physical connection between on-premises and AWS
• The connection is private, secure and fast
• Goes over a private network
• Takes at least a month to establish