AWS Certified Solutions Architect VPC Networking and Security 2 — Questions and Answers
Question 1: A company needs to connect their on-premises data center to an AWS VPC with consistent, low-latency bandwidth. Which service provides a dedicated private connection?
- AWS VPN CloudHub
- AWS Direct Connect (Correct answer)
- AWS Transit Gateway
- VPC Peering
Correct answer: AWS Direct Connect
AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet for consistent performance.
Question 2: Which VPC feature allows you to capture and log IP traffic going to and from network interfaces in your VPC for security analysis?
- CloudTrail Logs
- VPC Flow Logs (Correct answer)
- AWS Config Rules
- CloudWatch Metrics
Correct answer: VPC Flow Logs
VPC Flow Logs capture information about IP traffic to and from network interfaces and can be published to CloudWatch Logs or S3.
Question 3: A Solutions Architect needs to allow EC2 instances in a private subnet to download software updates from the internet without being directly reachable. What should they use?
- Internet Gateway
- NAT Gateway (Correct answer)
- Virtual Private Gateway
- Egress-Only Internet Gateway
Correct answer: NAT Gateway
A NAT Gateway allows instances in private subnets to initiate outbound internet traffic while preventing inbound connections from the internet.
Question 4: What is the maximum number of security groups that can be associated with a single EC2 instance's network interface?
- 2
- 5 (Correct answer)
- 10
- 16
Correct answer: 5
By default, up to 5 security groups can be associated with a single network interface, though this limit can be increased.
Question 5: A company wants to restrict traffic between subnets within their VPC based on subnet-level rules. Which feature should they implement?
- Security Groups
- Network ACLs (Correct answer)
- IAM Policies
- AWS WAF
Correct answer: Network ACLs
Network ACLs (NACLs) are stateless firewalls that control inbound and outbound traffic at the subnet level.
Question 6: An application needs IPv6 connectivity for EC2 instances in a private subnet to communicate outbound to IPv6 internet resources. Which gateway should be used?
- NAT Gateway
- Internet Gateway
- Egress-Only Internet Gateway (Correct answer)
- Virtual Private Gateway
Correct answer: Egress-Only Internet Gateway
An Egress-Only Internet Gateway allows IPv6 traffic from instances to the internet but prevents the internet from initiating IPv6 connections to those instances.
Question 7: Which AWS service enables you to centrally manage and connect multiple VPCs and on-premises networks through a single hub?
- VPC Peering
- AWS PrivateLink
- AWS Transit Gateway (Correct answer)
- AWS Direct Connect Gateway
Correct answer: AWS Transit Gateway
AWS Transit Gateway acts as a cloud router connecting multiple VPCs and on-premises networks through a single gateway, simplifying network architecture.
AWS Certified Solutions Architect VPC Networking and Security 2
A company needs to connect their on-premises data center to an AWS VPC with consistent, low-latency bandwidth.
Which service provides a dedicated private connection?