AWS - VPC Quiz 1

Which of the following statements are true with respect to VPC? (choose 2)

• A subnet can have multiple route tables associated with it.

• A network ACL can be associated with multiple subnets.

• A route with target “local” on the route table can be edited to restrict traffic within VPC.

• Subnet’s IP CIDR block can be same as the VPC CIDR block.

How many VPCs can an Internet Gateway be attached to at any given time?

• 2

• 5

• 1

• By default 1. But it can be attached to any VPC peered with its belonging VPC.

Your organization was planning to develop a web application on AWS EC2. Application admin was tasked to perform AWS setup required to spin EC2 instance inside an existing private VPC. He/she has created a subnet and wants to ensure no other subnets in the VPC can communicate with your subnet except for the specific IP address. So he/she created a new route table and associated with the new subnet. When he/she was trying to delete the route with the target as local, there is no option to delete the route. What could have caused this behavior?

• Policy attached to IAM user does not have access to remove routes.

• A route with the target as local cannot be deleted.

• You cannot add/delete routes when associated with the subnet. Remove associated, add/delete routes and associate again with the subnet.

• There must be at least one route on the route table. Add a new route to enable delete option on existing routes.

Your organization has an existing VPC setup and has a requirement to route any traffic going from VPC to AWS S3 bucket through AWS internal network. So they have created VPC endpoint for S3 and configured to allow traffic for S3 buckets. The application you are developing involves sending traffic to AWS S3 bucket from VPC for which you planned to use a similar approach. You have created a new route table, added route to VPC endpoint and associated route table with your new subnet. However, when you are trying to send a request from EC2 to S3 bucket using AWS CLI, the request is getting failed with 403 access denied errors. What could be causing the failure?

• AWS S3 bucket is in the different region than your VPC.

• EC2 security group outbound rules not allowing traffic to S3 prefix list.

• VPC endpoint might have a restrictive policy and does not contain the new S3 bucket.

• S3 bucket CORS configuration does not have EC2 instance as the origin.

Which of the following is an AWS component which consumes resources from your VPC?

• Internet Gateway

• Gateway VPC Endpoints

• Elastic IP Addresses

• NAT Gateway

You have successfully set up a VPC peering connection in your account between two VPCs – VPC A and VPC B, each in a different region. When you are trying to make a request from VPC A to VPC B, request getting failed. Which of the following could be a reason?

• Cross region peering is not supported in AWS

• CIDR blocks of both VPCs might be overlapping.

• Routes not configured in route tables for peering connections.

• VPC A security group default outbound rules not allowing traffic to VPC B IP range.

VPC A security group default outbound rules not allowing traffic to VPC B IP range.

• In a Network ACL, for a successful HTTPS connection, add an inbound rule with HTTPS type, IP range in source and ALLOW traffic.

• In a Network ACL, for a successful HTTPS connection, you must add an inbound rule and outbound rule with HTTPS type, IP range in source and destination respectively and ALLOW traffic.

• In a Security Group, for a successful HTTPS connection, add an inbound rule with HTTPS type and IP range in the source.

• In a Security Group, for a successful HTTPS connection, you must add an inbound rule and outbound rule with HTTPS type, IP range in source and destination respectively.

You have a business-to-business web application running in a VPC consisting of an Elastic Load Balancer (ELB), web servers, application servers and a database. Your web application should only accept traffic from predefined customer IP addresses. Which two options meet this security requirement? (Choose 2)

• Configure web server VPC security groups to allow traffic from your customers’ IPs

• Configure your web servers to filter traffic based on the ELB’s “X-forwarded-for” header

• Configure ELB security groups to allow traffic from your customers’ IPs and deny all outbound traffic

• Configure a VPC NACL to allow web traffic from your customers’ IPs and deny all outbound traffic

A user has created a VPC with public and private subnets using the VPC Wizard. The VPC has CIDR 20.0.0.0/16. The private subnet uses CIDR 20.0.0.0/24. Which of the below mentioned entries are required in the main route table to allow the instances in VPC to communicate with each other?

• Destination : 20.0.0.0/24 and Target : VPC

• Destination : 20.0.0.0/24 and Target : VPC

• Destination : 20.0.0.0/0 and Target : ALL

• Destination : 20.0.0.0/16 and Target : Local

A user has created a VPC with two subnets: one public and one private. The user is planning to run the patch update for the instances in the private subnet. How can the instances in the private subnet connect to the internet?

• Use the internet gateway with a private IP

• Allow outbound traffic in the security group for port 80 to allow internet updates

• The private subnet can never connect to the internet

• Use NAT with an elastic IP