CLF-C02 Networking 4 — Questions and Answers
Question 1: Which type of VPC subnet is directly accessible from the internet because its route table contains a route to an Internet Gateway?
- Private subnet
- Isolated subnet
- Public subnet (Correct answer)
- Shared subnet
Correct answer: Public subnet
A public subnet has a route in its route table that points to an Internet Gateway, allowing resources with public IP addresses to communicate with the internet.
Question 2: AWS Security Groups act as virtual firewalls. What is a key characteristic that differentiates them from Network ACLs?
- Security groups operate at the subnet level
- Security groups are stateless
- Security groups are stateful and track connection state (Correct answer)
- Security groups support deny rules
Correct answer: Security groups are stateful and track connection state
Security groups are stateful, meaning if you allow inbound traffic on a port, the return traffic is automatically allowed without needing an explicit outbound rule.
Question 3: A company needs to connect multiple branch offices and VPCs using a single managed service that scales elastically. Which AWS service best fits this requirement?
- VPC Peering
- AWS Site-to-Site VPN on each VPC
- AWS Transit Gateway (Correct answer)
- Multiple Internet Gateways
Correct answer: AWS Transit Gateway
AWS Transit Gateway is a managed network transit hub that connects VPCs and on-premises networks, simplifying network architecture by eliminating complex peering meshes.
Question 4: What does an Elastic IP address provide in AWS networking?
- A dynamic IP that changes with each instance reboot
- A static, public IPv4 address that can be quickly remapped to another instance (Correct answer)
- A private IP address range for a VPC
- An IPv6 address block for a subnet
Correct answer: A static, public IPv4 address that can be quickly remapped to another instance
An Elastic IP address is a static, public IPv4 address that remains associated with your AWS account and can be rapidly remapped to a different instance to mask failures.
Question 5: Which AWS networking service would you use to inspect and filter traffic between your VPCs and the internet using third-party virtual appliances?
- Internet Gateway
- NAT Gateway
- Gateway Load Balancer (Correct answer)
- AWS Direct Connect
Correct answer: Gateway Load Balancer
Gateway Load Balancer enables deployment, scaling, and management of third-party virtual network appliances (like firewalls and IDS/IPS) transparently inline.
Question 6: A Network Load Balancer (NLB) operates at which OSI model layer and is optimized for which type of traffic?
- Layer 7, HTTP/HTTPS traffic
- Layer 4, TCP/UDP traffic with extreme performance (Correct answer)
- Layer 3, IP routing decisions
- Layer 2, MAC address-based forwarding
Correct answer: Layer 4, TCP/UDP traffic with extreme performance
Network Load Balancer operates at Layer 4 (Transport Layer) and is designed to handle millions of requests per second with ultra-low latency for TCP and UDP traffic.
Question 7: What is the CIDR block 10.0.0.0/16 used for when creating a VPC?
- It defines the public IP range for the internet gateway
- It specifies the private IP address range available within the VPC (Correct answer)
- It sets the maximum number of subnets allowed
- It defines the geographic region for the VPC
Correct answer: It specifies the private IP address range available within the VPC
The CIDR block (like 10.0.0.0/16) defines the private IP address space for your VPC, providing 65,536 IP addresses that can be subdivided into subnets.
CLF-C02 Networking 4
Which type of VPC subnet is directly accessible from the internet because its route table contains a route to an Internet Gateway?