AWS - Certified Solutions Architect VPC Networking and Security Questions and Answers 1 — Questions and Answers
Question 1: A company has a three-tier web application running on EC2 instances within a VPC. The web tier is in a public subnet, and the application and database tiers are in private subnets. The application instances need to download software patches from the internet, but under no circumstances should they be directly accessible from the internet. Which VPC component should be configured to allow this access?
- An Internet Gateway attached to the private subnets.
- A NAT Gateway placed in the public subnet with a route from the private subnets. (Correct answer)
- A VPC Peering connection to another VPC that has internet access.
- An Egress-Only Internet Gateway.
Correct answer: A NAT Gateway placed in the public subnet with a route from the private subnets.
A NAT (Network Address Translation) Gateway is designed for this exact scenario. Placed in a public subnet, it uses an Elastic IP address to route traffic from instances in a private subnet to the internet. The Internet Gateway then allows the outbound traffic to the internet. This setup enables the private instances to initiate outbound connections while preventing any inbound connections from being initiated from the internet, thus keeping them secure.
Question 2: A solutions architect is designing a security model for a VPC. They need to implement a stateful firewall at the instance level. Which of the following AWS security features should be used to meet this requirement?
- Network ACLs
- AWS WAF
- Security Groups (Correct answer)
- VPC Flow Logs
Correct answer: Security Groups
Security Groups act as a virtual firewall for EC2 instances to control inbound and outbound traffic at the instance level. They are stateful, which means that if you allow an inbound request, the corresponding outbound response is automatically allowed, regardless of outbound rules. Network ACLs, in contrast, are stateless and operate at the subnet level.
Question 3: An organization has two VPCs, VPC-A and VPC-B, in the same AWS Region. They need to enable private communication between EC2 instances in both VPCs as if they were on the same network. However, they have discovered that both VPCs were created with the same CIDR block (10.0.0.0/16). What is the primary limitation that prevents them from using a VPC Peering connection?
- VPC Peering does not support transitive routing.
- The VPCs are in the same AWS account.
- The VPCs have overlapping CIDR blocks. (Correct answer)
- Security Groups cannot be referenced across a peering connection.
Correct answer: The VPCs have overlapping CIDR blocks.
A fundamental requirement for establishing a VPC Peering connection is that the VPCs must not have matching or overlapping IPv4 CIDR blocks. Since both VPC-A and VPC-B use 10.0.0.0/16, a peering connection cannot be created. Transitive peering is a limitation, but not the one that applies here. Peering can be done within the same account or across accounts.
Question 4: A security team needs to implement a defense-in-depth strategy. They want to add a layer of security at the subnet level that can explicitly deny traffic from a list of known malicious IP addresses. Which VPC feature should they use?
- Security Groups
- Network Access Control Lists (NACLs) (Correct answer)
- Route Tables
- An Internet Gateway
Correct answer: Network Access Control Lists (NACLs)
Network Access Control Lists (NACLs) operate at the subnet level and support both allow and deny rules. This makes them the ideal tool for blacklisting specific IP addresses or ranges at the subnet boundary. Security groups, on the other hand, only support allow rules and cannot be used to explicitly deny traffic.
Question 5: A company wants to provide private and secure access to Amazon S3 from their EC2 instances located in a private subnet without the traffic traversing the public internet. Which is the most cost-effective and secure method to achieve this?
- Route the traffic through a NAT Gateway in a public subnet.
- Configure a Gateway VPC Endpoint for Amazon S3. (Correct answer)
- Establish a Direct Connect connection to the S3 service.
- Use an Interface VPC Endpoint (PrivateLink) for Amazon S3.
Correct answer: Configure a Gateway VPC Endpoint for Amazon S3.
A Gateway VPC Endpoint for Amazon S3 is the correct solution. It provides a private connection between your VPC and S3 by creating a route table entry that directs S3-bound traffic to the endpoint instead of over the internet. This is highly secure and cost-effective as data transfer via a gateway endpoint within the same region is free. Using a NAT gateway would send traffic over the internet and incur data processing costs.
Question 6: You have established a VPC peering connection between VPC-A and VPC-B. Additionally, VPC-A has a VPN connection to an on-premises corporate network. An EC2 instance in VPC-B needs to communicate with a server in the corporate network. What must be done to enable this communication?
- Configure the VPC-A route table to forward traffic from VPC-B to the Virtual Private Gateway.
- Create a direct VPC peering connection between VPC-B and the corporate network.
- Nothing, transitive routing will automatically allow the connection.
- Establish a separate VPN connection from VPC-B to the corporate network. (Correct answer)
Correct answer: Establish a separate VPN connection from VPC-B to the corporate network.
VPC peering does not support transitive routing. This means that resources in VPC-B cannot use the VPN connection of VPC-A to reach the on-premises network. The traffic flow is limited to the peered VPCs only. To enable communication between VPC-B and the corporate network, a new, dedicated VPN connection must be established directly from VPC-B.
AWS - Certified Solutions Architect VPC Networking and Security Questions and Answers 1
A company has a three-tier web application running on EC2 instances within a VPC.
The web tier is in a public subnet, and the application and database tiers are in private subnets.
The application instances need to download software patches from the internet, but under no circumstances should they be directly accessible from the internet.
Which VPC component should be configured to allow this access?