AWS Networking and Content Delivery Flashcards

Which VPC component allows instances in a private subnet to access the internet for outbound traffic without being directly reachable from the internet?

Answer: NAT Gateway

A NAT Gateway enables private subnet instances to initiate outbound IPv4 traffic while blocking inbound connections from the internet.

What is the maximum number of IP addresses AWS reserves in every VPC subnet, making them unavailable for your instances?

Answer: 5

AWS reserves 5 IP addresses in each subnet for the network address, VPC router, DNS, future use, and broadcast.

Which feature provides a private connection between a VPC and supported AWS services without traversing the public internet?

Answer: VPC Endpoint

VPC Endpoints (Gateway or Interface) let resources reach AWS services privately without an internet gateway or NAT.

By default, how does a network ACL differ from a security group regarding traffic state?

Answer: Network ACLs are stateless, security groups are stateful

Network ACLs are stateless so return traffic must be explicitly allowed, while security groups are stateful and automatically allow return traffic.

Which AWS service establishes a dedicated, private physical network connection between an on-premises data center and AWS?

Answer: AWS Direct Connect

AWS Direct Connect provides a dedicated private physical link bypassing the public internet for consistent bandwidth and lower latency.

What does Amazon CloudFront use to cache content closer to end users worldwide?

Answer: Edge locations

CloudFront caches content at globally distributed edge locations to reduce latency for end users.

Which routing policy in Amazon Route 53 directs traffic based on the geographic location of the user's DNS resolver?

Answer: Geolocation

Geolocation routing answers DNS queries based on the geographic origin of the request.