CLF-C02 Networking 2 — Questions and Answers
Question 1: A company wants to connect their on-premises data center to AWS with a dedicated, private connection that bypasses the public internet. Which service should they use?
- AWS Site-to-Site VPN
- AWS Direct Connect (Correct answer)
- AWS Transit Gateway
- Amazon CloudFront
Correct answer: AWS Direct Connect
AWS Direct Connect establishes a dedicated private network connection between on-premises and AWS, bypassing the public internet for more consistent performance.
Question 2: Which AWS service allows you to logically isolate a section of the AWS Cloud where you can launch AWS resources in a virtual network you define?
- AWS Transit Gateway
- AWS Direct Connect
- Amazon VPC (Correct answer)
- AWS PrivateLink
Correct answer: Amazon VPC
Amazon VPC (Virtual Private Cloud) lets you provision a logically isolated section of AWS where you can launch resources in a virtual network you define.
Question 3: A company has multiple VPCs and needs to route traffic between them through a central hub. Which AWS service is designed for this purpose?
- VPC Peering
- Internet Gateway
- AWS Transit Gateway (Correct answer)
- Elastic Load Balancer
Correct answer: AWS Transit Gateway
AWS Transit Gateway acts as a network transit hub that connects multiple VPCs and on-premises networks through a central point, simplifying the network architecture.
Question 4: What is the purpose of a NAT Gateway in AWS networking?
- To allow inbound internet traffic to private subnets
- To enable instances in private subnets to access the internet without exposing their private IPs (Correct answer)
- To connect two VPCs together
- To route traffic between availability zones
Correct answer: To enable instances in private subnets to access the internet without exposing their private IPs
A NAT Gateway allows instances in private subnets to initiate outbound internet connections while preventing inbound connections from the internet.
Question 5: Which component of Amazon VPC controls inbound and outbound traffic at the subnet level and is stateless?
- Security Group
- Network ACL (Correct answer)
- Route Table
- Internet Gateway
Correct answer: Network ACL
Network Access Control Lists (NACLs) are stateless firewalls that operate at the subnet level, requiring explicit rules for both inbound and outbound traffic.
Question 6: A developer needs to allow EC2 instances in a private subnet to download software updates from the internet. What combination of resources is required?
- Internet Gateway only
- NAT Gateway in a public subnet and a route in the private subnet's route table (Correct answer)
- VPC Peering and a security group
- AWS Direct Connect and a virtual private gateway
Correct answer: NAT Gateway in a public subnet and a route in the private subnet's route table
A NAT Gateway placed in a public subnet, combined with a route in the private subnet's route table pointing to the NAT Gateway, allows outbound internet access for private instances.
Question 7: What is VPC Peering?
- A VPN connection between AWS and on-premises networks
- A networking connection between two VPCs that enables traffic routing using private IP addresses (Correct answer)
- A service that monitors VPC traffic flow
- A way to connect VPCs to the internet
Correct answer: A networking connection between two VPCs that enables traffic routing using private IP addresses
VPC Peering is a networking connection between two VPCs that allows traffic to be routed between them using private IPv4 or IPv6 addresses as if on the same network.
CLF-C02 Networking 2
A company wants to connect their on-premises data center to AWS with a dedicated, private connection that bypasses the public internet.
Which service should they use?