What does the CIDR 10.0.4.0/28 correspond to?

• 10.0.4.0 to 10.0.4.15

• 10.0.4.0 to 10.0.32.0

• 10.0.4.0 to 10.0.4.28

• 10.0.0.0 to 10.0.16.0

Answer explanation

/28 means 16 IPs (=2^(32-28) = 2^4), means only the last digit can change.

You have a corporate network of size 10.0.0.0/8 and a satellite office of size 192.168.0.0/16. Which CIDR is acceptable for your AWS VPC if you plan on connecting your networks later on?

• 172.16.0.0/12

• 172.16.0.0/16

• 10.0.16.0/16

• 192.168.4.0/18

Answer explanation

CIDR not should overlap, and the max CIDR size in AWS is /16.

You plan on creating a subnet and want it to have at least capacity for 28 EC2 instances. What's the minimum size you need to have for your subnet?

• /28

• /27

• /26

• /25

Answer explanation

Perfect size, 64 IPs. Must include enough space for the 5 reserved IPs.

Security Groups operate at the ________ level while NACLs operate at the ________ level.

• EC2 instance, Subnet

• Subnet, EC2 instance

You have attached an Internet Gateway to your VPC, but your EC2 instances still don't have access to the Internet. What is NOT a possible issue?

• Route Tables are missing entries

• The EC2 instances don't have public IPs

• The Security Group does not allow traffic in

• The NACL does not allow traffic out

Answer explanation

Security groups are stateful and if traffic can go out, then it can go back in.

You would like to provide Internet access to your EC2 instances in private subnets with IPv4 while making sure this solution requires the least amount of administration and scales seamlessly. What should you use?

• NAT Instances with Source/Destination Check flag off

• Egress Only Internet Gateway

• NAT Gateway

VPC Peering has been enabled between VPC A and VPC B, and the route tables have been updated for VPC A. But, the EC2 instances cannot communicate. What is the likely issue?

• Check the NACL

• Check the Route Tables in VPC B

• Check the EC2 instance attached Security Groups

• Check if DNS Resolution is enabled

Answer explanation

Route tables must be updated in both VPCs that are peered.

You have set up a Direct Connect connection between your corporate data center and your VPC A in your AWS account. You also need to access VPC B in another AWS region from your corporate datacenter. What should you do?

• Enable VPC Peering

• Use a Customer Gateway

• Use a Direct Connect Gateway

• Set up a NAT Gateway

Answer explanation

This is the main use case of Direct Connect Gateways.

When using VPC Endpoints, what are the only two AWS services that have a Gateway Endpoint available?

• Amazon S3 & Amazon SQS

• Amazon SQS & DynamoDB

• Amazon S3 & DynamoDB

Answer explanation

These two services have a VPC Gateway Endpoint (remember it), all the other ones have an Interface endpoint (powered by Private Link - means a private IP).

AWS reserves 5 IP addresses each time you create a new subnet in a VPC. When you create a subnet with CIDR 10.0.0.0/24, the following IP addresses are reserved, EXCEPT:

• 10.0.0.1

• 10.0.0.2

• 10.0.0.3

• 10.0.0.4