CCP AWS Networking and Content Delivery 2 — Questions and Answers
Question 1: What is VPC Peering?
- A method to connect your VPC to the public internet through a managed gateway
- A networking connection between two VPCs that enables routing traffic between them using private IP addresses (Correct answer)
- A service that replicates your VPC configuration to multiple AWS Regions automatically
- A tool that monitors network traffic between subnets for security threats
Correct answer: A networking connection between two VPCs that enables routing traffic between them using private IP addresses
VPC Peering is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 or IPv6 addresses, as if they were in the same network.
Question 2: How do Network Access Control Lists (NACLs) differ from Security Groups?
- NACLs apply at the subnet level and are stateless, while Security Groups apply at the instance level and are stateful (Correct answer)
- NACLs are only used for IPv6 traffic, while Security Groups handle IPv4 traffic
- NACLs require approval from AWS Support to modify, while Security Groups can be changed freely
- NACLs only allow traffic rules, while Security Groups can both allow and deny traffic
Correct answer: NACLs apply at the subnet level and are stateless, while Security Groups apply at the instance level and are stateful
NACLs act as a firewall at the subnet level and are stateless (must explicitly allow both inbound and outbound), while Security Groups operate at the instance level and are stateful (return traffic is automatically allowed).
Question 3: What is AWS Site-to-Site VPN primarily used for?
- Connecting two Amazon VPCs in different accounts using private IPs
- Creating an encrypted connection between an on-premises network and an AWS VPC over the public internet (Correct answer)
- Providing low-latency access to AWS services for mobile applications
- Establishing dedicated bandwidth between AWS and a colocation facility
Correct answer: Creating an encrypted connection between an on-premises network and an AWS VPC over the public internet
AWS Site-to-Site VPN creates an encrypted IPsec tunnel between your on-premises network and your Amazon VPC over the public internet, enabling secure hybrid cloud connectivity.
Question 4: What is the function of Amazon API Gateway?
- It manages network routing between EC2 instances in different availability zones
- It provides a fully managed service to create, publish, maintain, monitor, and secure APIs (Correct answer)
- It acts as a DNS resolver for internal AWS service endpoints
- It accelerates content delivery by caching API responses at CloudFront edge locations only
Correct answer: It provides a fully managed service to create, publish, maintain, monitor, and secure APIs
Amazon API Gateway is a fully managed service that makes it easy to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs at any scale.
Question 5: Which type of Elastic Load Balancer operates at the connection level (Layer 4)?
- Application Load Balancer
- Gateway Load Balancer
- Network Load Balancer (Correct answer)
- Classic Load Balancer
Correct answer: Network Load Balancer
Network Load Balancer operates at the transport layer (Layer 4) and is capable of handling millions of requests per second with ultra-low latency, making it ideal for TCP/UDP traffic.
Question 6: What is AWS Global Accelerator?
- A service that automatically scales EC2 instances globally based on traffic demand
- A networking service that improves application availability and performance by routing traffic through AWS global network infrastructure (Correct answer)
- A CDN service that caches static assets at AWS edge locations worldwide
- A tool that optimizes SQL queries for globally distributed RDS databases
Correct answer: A networking service that improves application availability and performance by routing traffic through AWS global network infrastructure
AWS Global Accelerator is a networking service that uses the AWS global network to optimize the path from users to applications, improving performance and availability by up to 60%.
Question 7: What is a VPC Endpoint used for?
- To expose a private application to the public internet through a managed gateway
- To allow private communication between a VPC and supported AWS services without requiring internet access (Correct answer)
- To extend a VPC's IP address range when the original CIDR block is exhausted
- To monitor and log all network traffic within a VPC for compliance purposes
Correct answer: To allow private communication between a VPC and supported AWS services without requiring internet access
A VPC Endpoint enables private connections between your VPC and supported AWS services without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect.
