VPC peering

VPC Peering has been enabled between VPC A and VPC B, and the route tables have been updated for VPC A. But, the EC2 instances cannot communicate. What is the likely issue?

• Check the NACL

• Check the Route Tables in VPC B

• Check the EC2 instance attached Security Groups

• Check if DNS Resolution is enabled

Answer explanation

Route tables must be updated in both VPCs that are peered

You have set up a Direct Connect connection between your corporate data center and your VPC A in your AWS account. You need to access VPC B in another AWS region from your corporate datacenter as well. What should you do?

• Enable VPC Peering

• Use a Customer Gateway

• Use a Direct Connect Gateway

• Set up a NAT Gateway

Answer explanation

This is the main use case of Direct Connect Gateways

When using VPC Endpoints, what are the only two AWS services that have a Gateway Endpoint available?

• Amazon S3 & Amazon SQS

• Amazon SQS & DynamoDB

• Amazon S3 & DynamoDB

Answer explanation

These two services have a VPC Gateway Endpoint (remember it), all the other ones have an Interface endpoint (powered by Private Link - means a private IP)

AWS reserves 5 IP addresses each time you create a new subnet in a VPC. When you create a subnet with CIDR 10.0.0.0/24, the following IP addresses are reserved, EXCEPT ....................

• 10.0.0.1

• 10.0.0.2

• 10.0.0.3

• 10.0.0.4

You have 3 VPCs A, B, and C. You want to establish a VPC Peering connection between all the 3 VPCs. What should you do?

• As VPC Peering supports Transitive Peering, so you need to establish 2 VPC Peering connections (A-B, B-C)

• Establish 3 VPC Peering connections (A-B, A-C, B-C)

How can you capture information about IP traffic inside your VPCs?

Enable VPC Flow Logs

Enable VPC Traffic Mirroring

Enable CloudWatch Traffic Logs

• Enable VPC Flow Logs

• Enable VPC Traffic Mirroring

• Enable CloudWatch Traffic Logs

Answer explanation

VPC Flow Logs is a VPC feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC

If you want a 500 Mbps Direct Connect connection between your corporate datacenter to AWS, you would choose a .................. connection

• Dedicated

• Hosted

When you set up an AWS Site-to-Site VPN connection between your corporate on-premises datacenter and VPCs in AWS Cloud, what are the two major components you want to configure for this connection?

• Customer Gateway and NAT Gateway

• Internet Gateway and Customer Gateway

• Virtual Private Gateway and Internet Gateway

• Virtual Private Gateway and Customer Gateway

Your company has several on-premises sites across the USA. These sites are currently linked using private connections, but your private connections provider has been recently quite unstable, making your IT architecture partially offline. You would like to create a backup connection that will use the public Internet to link your on-premises sites, that you can failover in case of issues with your provider. What do you recommend?

• VPC Peering

• AWS VPN CloudHub

• Direct Connect

• AWS PrivateLink

Answer explanation

AWS VPN CloudHub allows you to securely communicate with multiple sites using AWS VPN. It operates on a simple hub-and-spoke model that you can use with or without a VPC

You need to set up a dedicated connection between your on-premises corporate datacenter and AWS Cloud. This connection must be private, consistent, and traffic must not travel through the Internet. Which AWS service should you use?

• Site-to-Site VPN

• AWS PrivateLink

• AWS Direct Connect

• Amazon EventBridge