AWS AWS Networking and Content Delivery 3 — Questions and Answers
Question 1: Which AWS service allows you to create a private connection between your VPC and AWS services without traversing the public internet?
- AWS Direct Connect
- VPC Endpoint (Correct answer)
- NAT Gateway
- Internet Gateway
Correct answer: VPC Endpoint
VPC Endpoints allow private connectivity between your VPC and supported AWS services without requiring internet access, a NAT device, or VPN.
Question 2: What is the maximum number of Elastic IP addresses you can allocate per AWS region by default?
- 5 (Correct answer)
- 10
- 20
- 50
Correct answer: 5
By default, AWS allows 5 Elastic IP addresses per region per account, though you can request an increase via a support case.
Question 3: Which CloudFront feature lets you run code at edge locations in response to CloudFront events without provisioning servers?
- CloudFront Functions
- Lambda@Edge
- Both A and B are correct (Correct answer)
- CloudFront Signed URLs
Correct answer: Both A and B are correct
Both CloudFront Functions and Lambda@Edge allow running code at the edge; CloudFront Functions are lighter-weight and cheaper, while Lambda@Edge supports more complex logic.
Question 4: In AWS Route 53, what routing policy would you use to route traffic to the resource with the lowest network latency for your users?
- Weighted routing
- Geolocation routing
- Latency-based routing (Correct answer)
- Failover routing
Correct answer: Latency-based routing
Latency-based routing directs users to the AWS region that provides the lowest latency based on actual network measurements.
Question 5: What AWS Global Accelerator component serves as the entry point for client traffic and provides static anycast IP addresses?
- Endpoint Group
- Listener
- Accelerator (Correct answer)
- Edge Location
Correct answer: Accelerator
The Accelerator in AWS Global Accelerator provides the static anycast IP addresses that serve as the global entry points for client traffic.
Question 6: Which type of VPC endpoint is used specifically for Amazon S3 and DynamoDB without requiring an ENI?
- Interface Endpoint
- Gateway Endpoint (Correct answer)
- PrivateLink Endpoint
- Transit Endpoint
Correct answer: Gateway Endpoint
Gateway Endpoints are used for S3 and DynamoDB and are added as a target in your route table rather than creating an ENI in your subnet.
Question 7: When configuring a Network ACL in a VPC, what is a key behavioral difference compared to Security Groups?
- NACLs are stateful; Security Groups are stateless
- NACLs are stateless; Security Groups are stateful (Correct answer)
- Both are stateful
- Both are stateless
Correct answer: NACLs are stateless; Security Groups are stateful
Network ACLs are stateless, meaning you must explicitly allow both inbound and outbound traffic, while Security Groups are stateful and automatically allow return traffic.
AWS AWS Networking and Content Delivery 3
Which AWS service allows you to create a private connection between your VPC and AWS services without traversing the public internet?