Font size
WorksheetsAWS Certified Solutions Architect Associate (VPC)
Total questions: 99
Worksheet time: 50mins
Which chapter of the AWS Certified Solutions Architect Associate Exam guide is focused on Amazon Virtual Private Cloud (VPC)?
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Which of the following is NOT one of the objectives covered in Chapter 4 of the AWS Certified Solutions Architect Associate Exam guide?
Design Secure Architectures
Design Resilient Architectures
Design High-Performing Architectures
Design Scalable Architectures
How many domains are covered in Chapter 4 of the AWS Certified Solutions Architect Associate Exam guide?
Two
Three
Four
Five
What does a VPC provide in the context of Amazon's EC2 service?
A) A physical network infrastructure
B) A content delivery network
C) The networking layer
D) A database management system
Can a VPC be connected to other networks?
A) No, it is completely isolated and cannot be connected to any network
B) Yes, but only to on-premises networks
C) Yes, but only to the Internet
D) Yes, including the Internet, on-premises networks, and other VPCs
What is the significance of understanding VPCs for an AWS architect?
A) It is not necessary if not using EC2
B) It is only important for networking professionals
C) It is fundamental to success on the exam and as an AWS architect
D) It is only required for AWS support staff
How are VPCs different from traditional TCP/IP networks?
A) VPCs use physical hardware like switches and VLANs
B) VPCs are not scalable
C) VPCs abstract physical hardware into software functions
D) VPCs cannot extend your network without additional physical hardware
What is the representation of the address range for a VPC?
A) Dynamic Host Configuration Protocol (DHCP)
B) Classless Inter-Domain Routing (CIDR) block
C) Subnet mask
D) Network Access Control List (NACL)
What is the shortest way to represent a range of IP addresses in a VPC?
A) Subnet notation
B) Binary notation
C) Decimal notation
D) Slash notation
How many IP addresses are included in the CIDR block 172.16.0.0/16?
65,536
16
32
255
What is the prefix length of a CIDR block that refers to the length of the subnet mask?
(a)
Which of the following is a valid VPC CIDR range to avoid conflicts with public Internet addresses according to RFC 1918?
10.0.0.0–10.255.255.255
172.16.0.0–172.31.255.255
192.168.0.0–192.168.255.255
All of the above
Can you change the primary CIDR block after you create your VPC?
Yes, at any time
No, you must think carefully before creating a VPC
Yes, but only within the first 24 hours
Yes, but only if you have not launched any instances
Which of the following is NOT allowed as a secondary CIDR block for a VPC?
172.17.0.0/16
172.16.0.0/12
192.168.0.0/16
10.0.0.0/8
What type of IPv6 CIDR does AWS assign to your VPC?
A publicly routable prefix from the global unicast IPv6 address space
An arbitrary IPv6 CIDR of your choice
A private IPv6 CIDR not reachable from the Internet
A secondary IPv6 CIDR based on your primary IPv4 CIDR
What is the prefix length of an IPv6 VPC CIDR assigned by AWS by default?
A) /48
B) /56
C) /64
D) /32
If you want your IPv6 addresses to be reachable via the Internet, what is the smallest prefix length you can advertise?
A) /56
B) /48
C) /64
D) /32
When creating a new VPC using the AWS Command-Line Interface, which CIDR block is used in the example provided?
A) 192.168.0.0/16
B) 172.16.0.0/12
C) 10.0.0.0/8
D) 172.16.0.0/16
What is the state of the VPC immediately after creation as shown in the output example?
A) associated
B) running
C) pending
D) available
What is the initial state of a VPC as AWS creates it?
associated
available
pending
running
What command is used to view the state of a VPC in AWS?
aws ec2 describe-vpcs --vpc-ids [vpc-id]
aws ec2 view-vpcs --vpc-ids [vpc-id]
aws ec2 get-vpc-state --vpc-ids [vpc-id]
aws ec2 list-vpcs --vpc-ids [vpc-id]
What AWS CLI command can be used to delete an unneeded VPC?
aws ec2 terminate-vpc --vpc-id vpc-a01106c2
aws ec2 remove-vpc --vpc-id vpc-a01106c2
aws ec2 delete-vpc --vpc-id vpc-a01106c2
aws ec2 discard-vpc --vpc-id vpc-a01106c2
How many IP addresses does a subnet with a CIDR of 172.16.100.0/24 include?
256
512
1024
128
Which of the following IP addresses is reserved for the Amazon-provided DNS server within a subnet assuming a subnet CIDR of 172.16.100.0/24?
172.16.100.1
172.16.100.2
172.16.100.3
172.16.100.10
Can a subnet have multiple CIDRs?
Yes, just like a VPC
No, a subnet can only have one CIDR
Yes, but only two CIDRs
No, a subnet does not use CIDRs
If a VPC has a primary CIDR of 172.16.0.0/16 and a secondary CIDR of 172.17.0.0/16, what could be a valid CIDR for a subnet within that VPC?
192.168.1.0/24
172.16.1.0/24
10.0.1.0/24
172.17.0.0/15
What is an availability zone in the context of AWS?
A large geographic area like a continent
A single data center
A small geographic location analogous to a datacenter
A specific AWS service
If the us-east-1a zone fails, what will happen to the instance web1?
It will remain available
It will fail because it is in that zone
It will automatically move to us-east-1b
It will not be affected
Is having subnets in different availability zones a requirement?
Yes, it is mandatory for all AWS configurations
No, but it is recommended for high availability
Yes, but only for certain AWS services
No, it is not allowed in AWS
What is the purpose of creating subnets in different availability zones?
To increase the cost of the infrastructure
To comply with legal requirements
To ensure all instances fail simultaneously
To achieve resiliency for applications
Refer to the diagram below. If the us-east-1b zone fails, what will happen to the instance web2?
It will fail because it is in that zone
It will remain available
It will automatically move to us-east-1a
It will not be affected
What is the AWS CLI command to create a subnet in a specific VPC with a given CIDR block and availability zone?
aws ec2 create-subnet --vpc-id [vpc-id] --cidr-block 172.16.100.0/24 --availability-zone us-east-1a
aws ec2 create-subnet --vpc-id [vpc-id] --gateway-id 172.16.100.0/24 --zone us-east-1a
aws ec2 allocate-subnet --vpc-id [vpc-id] --cidr 172.16.100.0/24 --availability-zone us-east-1a
aws ec2 define-subnet --vpc-id [vpc-id] --network-block 172.16.100.0/24 --availability-zone us-east-1a
After creating a subnet, what is the next step to check its status?
aws ec2 describe-subnets --subnet-ids [subnet-id]
aws ec2 check-subnet --subnet-id [subnet-id]
aws ec2 get-subnet-status --subnet-id [subnet-id]
aws ec2 subnet-info --id [subnet-id]
What JSON key in the command output indicates that the subnet is in an available state?
"AvailableZone"
"State"
"SubnetId"
"VpcId"
What is the prefix length for an IPv6 subnet in a VPC?
A) /24
B) /64
C) /56
D) /32
What is the primary network interface on an instance called?
A) Secondary ENI
B) Primary ENI
C) Elastic ENI
D) Virtual ENI
Can an Elastic Network Interface (ENI) be attached to more than one subnet?
A) Yes, it can be attached to multiple subnets.
B) No, it is connected to only one subnet.
C) Yes, but only within the same Availability Zone.
D) No, it can only be attached to VPCs, not subnets.
What functionality does an Elastic Network Interface (ENI) provide to an instance?
A) It allows an instance to communicate with the Internet only.
B) It provides additional storage to an instance.
C) It allows an instance to communicate with other network resources.
D) It increases the computational power of an instance.
What is bound to the primary ENI of an instance that cannot be changed or removed?
The instance's security group
The instance's subnet
The instance's availability zone
The instance's public IP address
Can secondary private IP addresses assigned to an ENI come from a different subnet than the ENI is attached to?
Yes, they can come from any subnet
Yes, but only if they are in the same availability zone
No, they must come from the same subnet
No, secondary private IP addresses are not allowed
What can you do with an ENI that is not attached to an instance?
It cannot be used until it is deleted
It can be attached to an instance later
It can only be used for monitoring purposes
It must be converted to a primary ENI before use
What is the purpose of associating an existing ENI that's not attached to an instance with a working instance as a secondary ENI?
To increase the storage capacity of the instance
To redirect traffic from a failed instance to a working instance
To change the primary private IP address of the working instance
To assign a new security group to the working instance
What is the command used to verify the status of a network interface?
aws ec2 describe-network-interfaces --network-interface-ids [network-interface-id]
aws ec2 check-network-status --interface-ids [network-interface-id]
aws ec2 get-network-interface --id [network-interface-id]
aws ec2 validate-network-interface --network-id [network-interface-id]
What does Enhanced Networking use to allow an instance direct access to the physical network interface on the host?
Network Address Translation (NAT)
Single-root input/output virtualization (SR-IOV)
Direct server return (DSR)
Virtual Extensible LAN (VXLAN)
What is the benefit of using Enhanced Networking compared to ENIs?
Higher network throughput and higher latency
Lower network throughput and higher latency
Higher network throughput and lower latency
Lower network throughput and lower latency
What does the Elastic Network Adapter (ENA) support in terms of throughput?
Up to 10 Gbps
Up to 100 Gbps
Up to 1 Gbps
Up to 50 Gbps
Which virtual function interface is supported by the Intel 82599 and what is its maximum throughput?
ENA, up to 100 Gbps
ENA, up to 10 Gbps
VF, up to 100 Gbps
VF, up to 10 Gbps
What is required for an instance's operating system to support enhanced networking with ENA?
No additional drivers are needed
Must include the appropriate drivers
Must be connected to an Internet gateway
Must create a default route in a route table
What is the AWS resource identifier that begins with 'igw-' used for?
Elastic Network Adapter
Virtual Function Interface
Internet Gateway
Route Table
How is IP routing implemented in the VPC architecture?
As a hardware function
As a software function
Through an external router
Using dynamic routing protocols
What is the term used to describe the router function within AWS VPC that does not require configuring interface IP addresses or dynamic routing protocols?
Explicit router
Implied router
Internet gateway
ENA router
What is automatically created by AWS when you create a VPC, and associates with every subnet in that VPC?
A) A custom route table
B) The main route table
C) A subnet association
D) An Internet gateway
What type of routing is used by route tables in AWS, where routing decisions are based only on the destination IP prefix?
A) Source-based routing
B) Dynamic routing
C) Destination-based routing
D) Local routing
What is the local route in an AWS route table used for?
A) To forward traffic to the Internet gateway
B) To allow communication between instances in different subnets
C) To allow communication between instances in the same VPC
D) To route traffic through a security appliance
What happens to traffic destined for an address outside of the VPC CIDR range if there are no routes for any other IP prefixes?
A) It is forwarded to the main route table
B) It is routed through a security appliance
C) It is allowed and exits the VPC
D) It gets dropped
If you want to force intra-subnet traffic through a particular instance, such as a security appliance, what should you create in the route table?
A) A route with the instance's IP address as the destination and the Internet gateway as the target
B) A route with the subnet CIDR as the destination and the security appliance's ENI as the target
C) A route with the VPC CIDR as the destination and the local route as the target
D) A route with the security appliance's ENI as the destination and the subnet CIDR as the target
What is required to enable Internet access for your instances in Amazon VPC?
Create a security group
Create a default route pointing to the Internet gateway
Assign an Elastic IP address
Configure a Direct Connect
Which IP address range is always listed as the destination in a default route for a subnet that is connected to the Internet?
172.31.0.0/16
192.168.1.0/24
10.0.0.0/8
0.0.0.0/0
What is the difference between a public subnet and a private subnet in the context of an Internet gateway?
A public subnet has a route to an Internet gateway, while a private subnet does not
A private subnet has a route to an Internet gateway, while a public subnet does not
A public subnet can only host web servers, while a private subnet cannot
A private subnet allows direct Internet access, while a public subnet uses a NAT device
What is the purpose of an implied router in AWS VPC?
To provide a physical router for each VPC
To enable direct peering connections between VPCs
To act as an abstraction of an IP routing function within a VPC
To encrypt traffic between different subnets within a VPC
What AWS CLI command is used to attach an Internet gateway to a VPC?
aws ec2 describe-internet-gateway
aws ec2 attach-internet-gateway
aws ec2 connect-internet-gateway
aws ec2 enable-internet-gateway
What information do you need to provide in the command to attach an Internet gateway to a VPC?
--internet-gateway-id and --vpc-id
--gateway-id and --subnet-id
--route-table-id and --vpc-id
--internet-gateway-id and --subnet-id
What does a successful execution of the 'aws ec2 attach-internet-gateway' command produce?
A success message
A confirmation prompt
No output
A detailed report
What AWS CLI command is used to retrieve the route table ID of the main route table for the VPC?
aws ec2 describe-route-tables
aws ec2 get-route-tables
aws ec2 list-route-tables
aws ec2 show-route-tables
What JSON key indicates that the route table is the main one for the VPC?
"MainRouteTable": "true"
"IsMain": "true"
"Main": "true"
"Primary": "true"
What is the function of a security group in Amazon Virtual Private Cloud (VPC)?
It acts as a firewall that controls traffic to and from an instance by permitting traffic to ingress or egress that instance's ENI.
It provides encryption for data in transit within the VPC.
It monitors and logs traffic coming into and out of the VPC.
It serves as a load balancer to distribute traffic evenly across instances.
Every Elastic Network Interface (ENI) must be associated with how many security groups at minimum?
No security groups are required.
At least one security group.
Two security groups.
At least three security groups.
What is a common misconception about security groups and instances in Amazon VPC?
Security groups are attached to the VPC itself, not to instances.
Instances do not require security groups.
Security groups are attached to instances, not to ENIs.
Each instance is attached to multiple security groups by default.
What will happen if you don't explicitly allow traffic using a security group?
The security group will allow all traffic by default.
The security group will only allow traffic from within the VPC.
The security group will block the traffic.
The security group will redirect the traffic to a different instance.
What are the required elements of an inbound rule in a security group?
Source, destination, and protocol.
Protocol, port range, and source.
Destination, port range, and protocol.
Source, destination, and port range.
What does a security group's default setting deny when it is first created?
All inbound traffic that is explicitly allowed by a rule
All outbound traffic that is explicitly allowed by a rule
All inbound traffic that is not explicitly allowed by a rule
All traffic regardless of the rules set
What is the default port for HTTPS that needs to be allowed for an HTTPS-based web application?
22
80
443
8080
Which IP address range does the prefix 0.0.0.0/0 cover?
No IP addresses
Only local IP addresses
Only specific IP addresses set by the user
All IP addresses
What is the purpose of outbound rules in a security group?
To deny all outbound traffic from an instance
To specify what traffic the instance may send out
To allow all inbound traffic to an instance
To restrict traffic between instances in the same VPC
When a new security group is created, what type of outbound rule does AWS automatically create?
A rule that allows all outbound traffic
A rule that denies all outbound traffic
A rule that allows traffic only to specific IP addresses
No outbound rules are created automatically
What is the main purpose of the outbound rule allowing Internet access in an AWS VPC security group?
To block all incoming traffic from the Internet
To allow the instance to access the Internet and other AWS resources
To monitor and log the traffic going out of the instance
To restrict the instance to internal network access only
What can be used as a source or destination in a security group rule?
Only IP addresses within the VPC
Any Classless Inter-Domain Routing (CIDR)
Only AWS account owner IDs
Only security group names
What happens if you delete the outbound rule that allows Internet access in an AWS VPC security group?
The instance can still access the Internet using a different rule
The instance gains unrestricted Internet access
The security group will still permit the instance to access the Internet
The security group won't permit the instance to access the Internet or anything else
What does "stateful" mean in the context of a security group acting as a firewall?
It only monitors inbound traffic but not outbound traffic
It allows traffic in one direction and intelligently allows reply traffic in the opposite direction
It blocks all unsolicited traffic regardless of its direction
It maintains a state of all active connections for auditing purposes
What information does connection tracking look at for TCP and UDP traffic in a security group?
Protocol, source and destination IP address, and source and destination port number
Source and destination MAC address, and packet size
Time of day and traffic volume
Encryption status and packet payload
What is the purpose of creating a custom security group in Exercise 4.5?
To delete the default security group
To modify the rules of the default security group
To allow SSH, HTTP, and HTTPS access from any IP address
To restrict all inbound traffic
Which AWS CLI command is used to create a security group named 'web-ssh'?
aws ec2 modify-security-group
aws ec2 create-security-group --group-name "web-ssh"
aws ec2 authorize-security-group-ingress
aws ec2 delete-security-group
What port is used to allow SSH access in the security group rules?
80
443
22
8080
Which port is specified to allow HTTP access in the security group rules?
22
80
443
8080
What port is used to allow HTTPS access in the security group rules?
22
80
443
8080
What is a network access control list (NACL) in the context of Amazon VPC?
A) A list of users authorized to access the VPC
B) A firewall that contains inbound and outbound rules to control traffic
C) A set of protocols used for routing traffic within the VPC
D) A database of IP addresses associated with the VPC
How does a NACL differ from a security group?
A) A NACL is attached to an ENI, while a security group is associated with a subnet
B) A NACL is stateful, while a security group is stateless
C) A NACL is stateless and does not automatically allow reply traffic, while a security group is stateful
D) A NACL can be deleted, while a security group cannot
Can a subnet have more than one NACL associated with it in a VPC?
A) Yes, a subnet can have multiple NACLs associated with it
B) No, a subnet can only have one NACL associated with it
C) Yes, but only if the NACLs are created by different users
D) No, because NACLs are only associated with security groups, not subnets
What elements does each inbound rule for a NACL contain?
A) Rule number, Protocol, Port range, Source CIDR, Action
B) Rule number, Destination CIDR, Port range, Protocol, Action
C) Source CIDR, Destination CIDR, Protocol, Action, Timestamp
D) Protocol, Port range, Source IP, Destination IP, Rule number
What is the default action of the lowest-numbered rule in the default NACL inbound rules for a VPC with no IPv6 CIDR assigned?
Deny
Allow
Reject
Ignore
What is the effect of the default rule, designated by an asterisk (*) in the NACL inbound rules?
It allows all traffic.
It denies all traffic not explicitly allowed by preceding rules.
It ignores all traffic.
It rejects traffic from specific sources only.
Which protocol and port range does rule number 90 in Table 4.7 block?
All protocols, All ports
TCP, port 80
UDP, port 80
TCP, All ports
According to the note, what happens if traffic matches a rule with a deny action in a NACL?
The traffic is allowed if there is a subsequent rule that allows it.
The traffic is denied and none of the subsequent rules are processed.
The traffic is ignored and the subsequent rules are processed.
The traffic is allowed and all subsequent rules are processed.
What AWS CLI command is used to create a new network ACL?
aws ec2 describe-network-acl
aws ec2 create-network-acl
aws ec2 modify-network-acl
aws ec2 delete-network-acl
What does the "Egress" field in a network ACL entry specify?
Whether the rule is for incoming traffic
Whether the rule is for outgoing traffic
The port range for the traffic
The protocol for the traffic
What is the default action for a network ACL when it is first created, as shown in the output?
allow
deny
reject
accept
What JSON key indicates whether the network ACL created is the default for the VPC?
"IsDefault"
"DefaultAcl"
"AclStatus"
"DefaultNetworkAcl"
What is the value of "IsDefault" for the newly created network ACL in the output?
true
false
null
0
What is the default action of network ACLs for both inbound and outbound traffic?
Allow all traffic
Deny all traffic
Allow only HTTP and HTTPS traffic
No default action is set
