Sample questions
Aws Networking VpcDifficulty 1
In subnet 10.0.1.0/24, which IPv4 addresses does Amazon VPC reserve?
- aOnly
10.0.1.0 and 10.0.1.255, as in a conventional broadcast network - bThe first four addresses (
.0–.3) and the last address (.255)✓ - cThe first address and the final three addresses in the subnet
- dNone; every IPv4 address in an Amazon VPC subnet can be assigned
Explanation:Amazon VPC reserves the first four and last IPv4 address in every subnet: .0 network, .1 router, .2 DNS, .3 future use, and .255 network broadcast. VPC does not support broadcast.
Aws Networking VpcDifficulty 1
What is the primary function of an Internet Gateway (IGW) attached to a VPC?
- aA redundant VPC gateway target for bidirectional internet connectivity✓
- bIt translates private IP addresses to a single public IP for outbound-only traffic from private subnets
- cIt filters inbound traffic based on port and protocol before it reaches instances
- dIt routes traffic between two peered VPCs across AWS regions
Explanation:An IGW is a horizontally scaled, redundant, highly available VPC component that performs the NAT for instances with public IPs and provides a target in route tables for internet-bound traffic — in both directions. Outbound-only translation is NAT Gateway's job (b), port/protocol filtering is Security Groups/NACLs (c), and cross-VPC routing is peering (d).
Aws Networking VpcDifficulty 1
Which statement distinguishes public and private AWS NAT Gateway connectivity types?
- aBoth types require an Elastic IP and can route through an IGW; their addressing and internet-connectivity behavior is therefore identical
- bPrivate NAT Gateway provides inbound internet access without an Elastic IP
- cPublic NAT Gateway uses an Elastic IP for IGW egress; private NAT Gateway has only private IPs✓
- dThe type changes only billing, while address and routing behavior remain identical
Explanation:A public NAT Gateway is associated with an Elastic IP and can send translated traffic through an Internet Gateway. A private NAT Gateway has only private IPs and is intended for private paths such as Transit Gateway or a virtual private gateway; its traffic cannot reach the internet through an IGW.
Aws Networking VpcDifficulty 2
A NAT Gateway is deployed in AZ us-east-1a and serves private subnets in both us-east-1a and us-east-1b. AZ us-east-1a fails entirely. What happens to outbound internet access for instances in us-east-1b?
- aUnaffected — NAT Gateways automatically fail over across AZs
- bUnaffected — NAT Gateway traffic never actually leaves the AZ it's deployed in
- cAutomatically restored within a few seconds via AWS-managed cross-AZ replication
- dLost; NAT Gateway is AZ-scoped, so HA needs one per AZ✓
Explanation:A NAT Gateway is provisioned in a single AZ and has no built-in cross-AZ failover. If that AZ fails, every subnet routed through it loses outbound connectivity — including subnets in other AZs that happened to route to it. The documented HA pattern is one NAT Gateway per AZ, each with its own subnet-level route table pointing to the NAT Gateway in the same AZ.
Aws Networking VpcDifficulty 1
In a VPC, every subnet is automatically associated with a route table if no explicit association is made. Which route table is that?
- aThere is none — every subnet must be explicitly associated with a route table or it has no routing at all
- bThe VPC's main route table✓
- cA newly-created, empty route table dedicated to that subnet
- dThe route table of the subnet with the lowest CIDR range in the VPC
Explanation:Every VPC has exactly one main route table by default, and any subnet without an explicit route table association implicitly uses it. Creating a custom route table and associating it with a subnet overrides this default — the subnet then uses only the custom table.
Aws Networking VpcDifficulty 2
Which statement correctly distinguishes Security Groups from Network ACLs (NACLs)?
- aSecurity Groups are stateful and ENI-scoped; NACLs are stateless and subnet-scoped✓
- bSecurity Groups operate at the subnet level and are stateless; NACLs operate at the instance level and are stateful
- cBoth operate at the subnet level, but only NACLs support explicit deny rules
- dBoth are stateful; the only difference is that NACLs support numbered rule priority and Security Groups do not
Explanation:Security Groups attach to ENIs (effectively per-instance) and are stateful — if inbound traffic is allowed, the corresponding outbound response is automatically allowed regardless of outbound rules, and vice versa. NACLs attach to subnets and are stateless — inbound and outbound rules are evaluated independently, so a rule allowing an inbound request does not automatically allow its response; that must be permitted by a separate outbound rule (e.g. for ephemeral ports).