Diwali Deal : Flat 20% off + 2 free self-paced courses + $200 Voucher - SCHEDULE CALL
Diwali Deal : Flat 20% off + 2 free self-paced courses + $200 Voucher - SCHEDULE CALL
AWS VPC lets you set up your network however you want it, with different areas for your apps and data, much like your own private section in the AWS cloud. It's the foundation of many things you do on AWS, and it can greatly benefit beginners. When you understand how VPC works, you can control who can access your apps and keep everything safe. Plus, knowing about VPC will help you do well in job interviews for AWS roles because employers often ask about AWS VPC
A: Amazon VPC is the networking layer for Amazon Elastic Compute Cloud (Amazon EC2), allowing you to build your virtual network within AWS. You control various aspects of your Amazon VPC, including selecting your IP address range, creating your own subnets, and configuring your route tables, network gateways, and security settings. Within a region, you can create multiple Amazon VPCs, and each Amazon VPC is logically isolated even if it shares its IP address space.
A: Stateful filtering checks a request's origin and automatically responds to the source. Stateless filtering only looks at the source and destination IPs without considering if it's a new request or a response. In AWS VPC, security groups do stateful filtering, while network ACLs do stateless filtering. You might get asked about filtering in AWS VPC interviews.
A: Peering connections are set up within the existing VPC infrastructure and don't rely on hardware like VPN gateways. So, if one peering connection fails, it's managed within the VPC infrastructure, reducing the chances of communication failure.
A: To use ClassicLink, you need at least one VPC in your account that is activated explicitly for ClassicLink. Then, tag a security group from the VPC to connect with ClassicLink. Now, your EC2 classic instance is linked to a VPC and becomes part of a security group within that VPC. Remember, an EC2 classic instance can't connect to more than one VPC at a time.
A: ELB, or Elastic Load Balancing, is a service that helps distribute incoming workloads in AWS deployments, making tasks complete faster. A hiring manager might ask this to gauge your understanding of VPC security and scalability. ELB comes in three types: network, application, and classic. You can use application and network ELB within your VPC to direct traffic to specific targets.
A: A NAT device in your VPC helps private subnet instances send data out to other AWS services or the internet, but it blocks incoming traffic initiated from the internet. When data goes out, the NAT device's address replaces the instance's IP address. When the response comes back, the device changes the address to the instance's private IP. AWS offers two types: NAT instance and NAT gateway. NAT doesn't support IPv6.
A: The default VPC is an automatically created virtual network in AWS when you use Amazon EC2 resources for the first time. You can customize its components as needed. The advantages include easy access to features like IPs and network interfaces without creating separate VPC or launch instances.
A: Private IP addresses are used within a network and inaccessible online. Public IPs are, though. When you start an instance, it gets assigned a public IP automatically, which changes every time you stop and restart it. An elastic IP, on the other hand, stays the same until you terminate it. You can detach it from one instance and attach it to another. Elastic IPs are also accessible over the internet.
A: Yes, there are limits. You can create 5 VPCs per region, each allowing up to 200 subnets. If you want to increase the limit, you'll need to match the number of internet gateways to the number of VPCs. Each region allows five elastic IP addresses and 5 of each gateway type—Internet, VPN, and NAT. You can have up to 50 customer gateways and 50 VPN connections per region. Knowing about these limits for AWS VPC interviews is a good idea.
A: An Amazon VPC consists of the following components:
Subnets
Route tables
Dynamic Host Configuration Protocol (DHCP) option sets
Security groups
Network Access Control Lists (ACLs)
An Amazon VPC has the following optional components:
Internet Gateways (IGWs)
Elastic IP (EIP) addresses
Elastic Network Interfaces (ENIs)
Endpoints
Peering
Network Address Translation (NAT) instances and NAT gateways
Virtual Private Gateway (VPG), Customer Gateways (CGWs), and Virtual Private
Networks (VPNs)
A: A subnet is a segment of an Amazon VPC's IP address range where you can launch Amazon EC2 instances, Amazon Relational Database Service (Amazon RDS) databases, and other AWS resources. CIDR blocks define subnets (for example, 10.0.1.0/24 and 192.168.0.0/24). The smallest subnet you can create is a /28 (16 IP addresses).
AWS reserves the first four IP addresses and the last IP address of every subnet for internal networking purposes. For example, a subnet defined as a /28 has 16 available IP addresses; subtract the 5 IPs needed by AWS to yield 11 IP addresses for your use within the subnet.
After creating an Amazon VPC, you can add one or more subnets in each Availability Zone. Subnets reside within one Availability Zone and cannot span zones. This is an important point that can come up in the exam, so remember that one subnet equals one Availability Zone. You can, however, have multiple subnets in one Availability Zone.
A: A route table is a logical construct within an Amazon VPC containing a set of rules (called routes) applied to the subnet and used to determine where network traffic is directed. A route table's routes permit Amazon EC2 instances within different subnets within an Amazon VPC to communicate with each other. You can modify route tables and add your custom routes. You can also use route tables to specify which subnets are public (by directing Internet traffic to the IGW) and which are private (by not having a route that directs traffic to the IGW).
Each route table contains a default route called the local route, which enables communication within the Amazon VPC, and this route cannot be modified or removed. Additional routes can be added to direct traffic to exit the Amazon VPC via the IGW, the VPG, or the NAT instance. You can practice how this is accomplished in the exercises at the end of this chapter.
You should remember the following points about route tables:
Your VPC has an implicit router.
Your VPC automatically comes with a main route table that you can modify.
You can create additional custom route tables for your VPC.
Each subnet must be associated with a route table, which controls its routing. If you don't explicitly associate a subnet with a particular route table, the subnet uses the main route table.
You can replace the main route table with a custom table you've created so that each new subnet is automatically associated.
Each route in a table specifies a destination CIDR and a target; for example, traffic destined for 172.16.0.0/12 is targeted for the VPG. AWS uses the most specific route that matches the traffic to determine how to route the traffic.
A: An Internet Gateway (IGW) is a horizontally scaled, redundant, and highly available Amazon VPC component that allows communication between instances in your Amazon VPC and the Internet. An IGW provides a target in your Amazon VPC route tables for Internet-routable traffic and performs network address translation for instances that have been assigned public IP addresses.
Amazon EC2 instances within an Amazon VPC only know their private IP addresses. When traffic is sent from the instance to the internet, the IGW translates the reply address to the instance's public IP address (or EIP address, covered later) and maintains the one-to-one map of the instance's private IP address and public IP address.
When an instance receives traffic from the internet, the IGW translates the destination address (public IP address) to the instance's private IP address and forwards the traffic to the Amazon VPC.
It would help if you did the following to create a public subnet with Internet access:
Attach an IGW to your Amazon VPC.
Create a subnet route table rule to send all non-local traffic (0.0.0.0/0) to the IGW.
Configure your network ACLs and security group rules to allow relevant traffic to flow to and from your instance.
A: Dynamic Host Configuration Protocol (DHCP) provides a standard for passing configuration information to TCP/IP network hosts. The options field of a DHCP message contains the configuration parameters. Some of those parameters are the domain name, domain name server, and the netbios-node-type.
AWS automatically creates and associates a DHCP option set for your Amazon VPC upon creation and sets two options: domain-name-servers (defaulted to AmazonProvidedDNS) and domain-name (defaulted to the domain name for your region). AmazonProvidedDNS is an Amazon Domain Name System (DNS) server, and this option enables DNS for instances that need to communicate over Amazon VPC's IGW.
The DHCP option sets elements of an Amazon VPC, allowing you to direct Amazon EC2 hostname assignments to your resources. To assign your domain name to your instances, create a custom DHCP option set and assign it to your Amazon VPC. You can configure the following values within a DHCP option set:
Domain-name-servers—The IP addresses of up to four domain name servers, separated by commas. The default is AmazonProvidedDNS.
Domain name—Specify the desired domain name here (for example, mycompany.com).
NTP-servers—The IP addresses of up to four Network Time Protocol (NTP) servers, separated by commas
NetBIOS-name-servers—The IP addresses of up to four NetBIOS name servers, separated by commas
Netbios-node-type—Set this value to 2.
A: AWS maintains a pool of public IP addresses in each region and makes them available for you to associate with resources within your Amazon VPCs. An Elastic IP Address (EIP) is a static, public IP address in the pool for the region that you can allocate to your account (pull from the pool) and release (return to the pool).
EIPs allow you to maintain a set of fixed IP addresses while the underlying infrastructure may change over time. Here are the essential points to understand about EIPs for the exam:
You must allocate an EIP for use within a VPC and then assign it to an instance.
EIPs are specific to a region (that is, an EIP in one region cannot be assigned to an instance within an Amazon VPC in a different region).
There is a one-to-one relationship between network interfaces and EIPs.
You can move EIPs from one instance to another in the same Amazon VPC or a different Amazon VPC within the same region.
EIPs remain associated with your AWS account until you explicitly release them.
There are charges for EIPs allocated to your account, even when they are not associated with a resource.
A: An Elastic Network Interface (ENI) is a virtual network interface that you can attach to an instance in an Amazon VPC. ENIs are only available within an Amazon VPC and associated with a subnet upon creation. They can have one public IP address and multiple private IP addresses.
If there are multiple private IP addresses, one of them is primary. Assigning a second network interface to an instance via an ENI allows it to be dual-homed (have network presence in different subnets). An ENI created independently of a particular instance persists regardless of the lifetime of any instance it is attached; if an underlying instance fails, the IP address may be preserved by attaching the ENI to a replacement instance.
ENIs allow you to create a management network, use network and security appliances in your Amazon VPC, create dual-homed instances with workloads/roles on distinct subnets, or create a low-budget, high-availability solution.
A: An Amazon VPC peering connection is a networking connection between two Amazon VPCs. It enables instances in Amazon VPC to communicate with each other as if they are within the same network. You can create an Amazon VPC peering connection between your Amazon VPCs or with an Amazon VPC in another AWS account within a single region. A peering connection is neither a gateway nor an Amazon VPN connection and does not introduce a single point of failure for communication.
Peering connections are created through a request/accept protocol. The owner of the requesting Amazon VPC sends a request to peer to the owner of the peer Amazon VPC. If the peer Amazon VPC is within the same account, it is identified by its VPC ID.
If the peer VPC is within a different account, it is identified by Account ID and VPC ID. The owner of the peer Amazon VPC has one week to accept or reject the request to peer with the requesting Amazon VPC before the peering request expires.
A: A network access control list (ACL) is another layer of security that acts as a stateless firewall on a subnet level. A network ACL is a numbered list of rules that AWS evaluates in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any subnet associated with the network ACL.
Amazon VPCs are created with an adjustable default network ACL associated with every subnet, allowing all inbound and outbound traffic. When you create a custom network ACL, its initial configuration will deny all inbound and outbound traffic until you create rules that allow otherwise.
You may set up network ACLs with rules similar to those of your security groups to add a layer of security to your Amazon VPC. Alternatively, you may use the default network ACL, which does not filter traffic traversing the subnet boundary. Overall, every subnet must be associated with a network ACL.
A: By default, any instance that you launch into a private subnet in an Amazon VPC cannot communicate with the internet through the IGW. This is problematic if the instances within private subnets need direct access to the internet from the Amazon VPC to apply security updates, download patches, or update application software.
AWS provides NAT instances and NAT gateways to allow instances deployed in private subnets to gain Internet access. We recommend using a NAT gateway instead of a NAT instance for everyday use cases. The NAT gateway provides better availability and higher bandwidth and requires less administrative effort than NAT instances.
NAT Instance
A network address translation (NAT) instance is an Amazon Linux Amazon Machine Image (AMI) that is designed to accept traffic from instances within a private subnet, translate the source IP address to the public IP address of the NAT instance, and forward the traffic to the IGW.
In addition, the NAT instance maintains the state of the forwarded traffic to return response traffic from the internet to the proper instance in the private subnet. These instances have the string amzn-ami-vpc-nat in their names, which is searchable in the Amazon EC2 console.
NAT Gateway
A NAT gateway is an Amazon-managed resource that operates like a NAT instance. Still, managing it is more straightforward and highly available within an Availability Zone.
To allow instances within a private subnet to access Internet resources through the IGW via NAT gateway, you must do the following:
Configure the route table associated with the private subnet to direct Internet-bound traffic to the NAT gateway (for example, nat-1a2b3c4d).
Allocate an EIP and associate it with the NAT gateway.
A: You can connect an existing data center to Amazon VPC using either hardware or software VPN connections, which will make Amazon VPC an extension of the data center. Amazon VPC offers two ways to connect a corporate network to a VPC: VPG and CGW.
A virtual private gateway (VPG) is the virtual private network (VPN) concentrator on the AWS side of the VPN connection between the two networks. A customer gateway (CGW) represents a physical device or a software application on the customer's side of the VPN connection.
After these two elements of an Amazon VPC have been created, the last step is to create a VPN tunnel. The VPN tunnel is established after traffic is generated from the customer's side of the VPN connection.
You must specify the type of routing that you plan to use when you create a VPN connection. If the CGW supports Border Gateway Protocol (BGP), configure the VPN connection for dynamic routing. Otherwise, configure the connections for static routing.
If you will be using static routing, you must enter the routes for your network that should be communicated to the VPG. Routes will be propagated to the Amazon VPC to allow your resources to route network traffic back to the corporate network through the VGW and the VPN tunnel.
Following are the essential points to understand about VPGs, CGWs, and VPNs for the exam:
The VPG is the AWS end of the VPN tunnel.
The CGW is a hardware or software application on the customer's side of the VPN tunnel.
It would help if you initiated the VPN tunnel from the CGW to the VPG.
VPGs support both dynamic routing with BGP and static routing.
The VPN connection consists of two tunnels for higher availability to the VPC.
AWS Solution Architect Training and Certification
JanBask Training's AWS courses can significantly benefit beginners by providing comprehensive training on VPC and other AWS services. Their courses break down complex topics into easy-to-understand modules, helping beginners grasp the concepts quickly and effectively. With JanBask Training, beginners can gain the skills and confidence needed to excel in AWS interviews and succeed in their careers.
DynamoDB Questions and Answers for AWS Interview
Apr 17, 2024 
634
AWS SysOps Interview Questions & Answers
Dec 12, 2023 605
Cyber Security
QA
Salesforce
Business Analyst
MS SQL Server
Data Science
DevOps
Hadoop
Python
Artificial Intelligence
Machine Learning
Tableau
Download Syllabus
Get Complete Course Syllabus
Enroll For Demo Class
It will take less than a minute
Tutorials
Interviews
You must be logged in to post a comment
