VPC

Which of the following is TRUE about NACLs and Security Groups?

1. A.Both are stateful.
2. B.NACLs are stateless and operate at subnet level; Security Groups are stateful and operate at instance level.✓ Correct
3. C.NACLs operate at instance level; Security Groups operate at subnet level.
4. D.Security Groups support deny rules, NACLs do not.

Which AWS service provides a virtual network in the cloud, isolated from other customers?

1. A.Amazon VPC✓ Correct
2. B.AWS Direct Connect
3. C.AWS Transit Gateway
4. D.Amazon Route 53

What is the difference between a public and private subnet in a VPC?

1. A.Private subnets are in different regions.
2. B.A public subnet has a route to an Internet Gateway in its route table; a private subnet does not.✓ Correct
3. C.Public subnets are free.
4. D.Private subnets cannot have EC2 instances.

Which device allows EC2 instances in a private subnet to make outbound internet requests (e.g., to download patches) but blocks inbound internet connections?

1. A.Internet Gateway
2. B.NAT Gateway (or NAT instance)✓ Correct
3. C.Egress-only Internet Gateway (IPv6 only)
4. D.Route 53 resolver

What is VPC Peering?

1. A.A service to connect VPCs to on-premises only.
2. B.A networking connection between two VPCs that enables routing using private IPs as if they were the same network.✓ Correct
3. C.A service to connect to the internet.
4. D.A way to attach a VPC to multiple regions automatically.

Which AWS service is BEST for connecting many VPCs and on-premises networks through a central hub?

1. A.VPC Peering full mesh
2. B.AWS Transit Gateway✓ Correct
3. C.AWS Direct Connect alone
4. D.VPN Gateway

Which type of VPC endpoint is used for S3 and DynamoDB?

1. A.Interface Endpoint
2. B.Gateway Endpoint✓ Correct
3. C.Direct Connect Endpoint
4. D.Transit Endpoint

What does VPC Flow Logs capture?

1. A.Disk I/O on EC2 instances.
2. B.IP traffic information for ENIs in a VPC, subnet, or specific ENI — captured to CloudWatch Logs or S3.✓ Correct
3. C.API calls.
4. D.User logins.

Which AWS service is a private connection between a VPC and AWS services without traversing the public internet?

1. A.AWS PrivateLink (Interface VPC Endpoint)✓ Correct
2. B.AWS Transit Gateway
3. C.Direct Connect
4. D.Internet Gateway

Which is true about a VPC and its CIDR block?

1. A.A VPC must be exactly /16.
2. B.A VPC has a primary CIDR block (between /16 and /28). You can add up to 4 secondary CIDR blocks.✓ Correct
3. C.VPCs cannot use private IP ranges.
4. D.A VPC is bound to one AZ only.

Which is true about subnets in a VPC?

1. A.A subnet can span multiple AZs.
2. B.A subnet is bound to a single Availability Zone — for HA you create subnets in multiple AZs.✓ Correct
3. C.Subnets can span regions.
4. D.Each subnet must be exactly /24.

Which device lets EC2 instances in a VPC communicate with the public internet?

1. A.Internet Gateway (IGW)✓ Correct
2. B.NAT Gateway
3. C.Customer Gateway
4. D.Direct Connect Gateway

Which is true about Security Group rules?

1. A.Security Groups support both allow and deny rules.
2. B.Security Groups support ONLY allow rules — there are no deny rules. The default is to deny all.✓ Correct
3. C.Security Group rules apply at subnet level.
4. D.Security Groups are stateless.

Which is true about NACL rules?

1. A.NACLs only support allow rules.
2. B.NACLs support both allow and deny rules, evaluated in numeric order. Default NACL allows all in/out.✓ Correct
3. C.NACLs are stateful.
4. D.NACLs operate at instance level.

Which AWS service provides a managed encrypted VPN over the internet from your data center to your VPC?

1. A.AWS Site-to-Site VPN✓ Correct
2. B.AWS Client VPN
3. C.AWS Direct Connect
4. D.AWS PrivateLink

Which is true about IPv6 in AWS VPC?

1. A.AWS does not support IPv6.
2. B.VPCs and subnets can have IPv6 CIDR blocks. IPv6 addresses are public; private subnets use an Egress-only IGW for outbound IPv6.✓ Correct
3. C.IPv6 is only available in some regions.
4. D.IPv6 in AWS works exactly the same as IPv4.

Which is the recommended way to allow EC2 instances in a private subnet to access AWS services privately?

1. A.Through a NAT Gateway and the public internet.
2. B.Through VPC Endpoints (Gateway endpoint for S3/DynamoDB; Interface endpoints for others) — keeps traffic on the AWS network.✓ Correct
3. C.Through Direct Connect only.
4. D.Through Client VPN.

What is the maximum number of VPCs per AWS region by default?

1. A.1
2. B.5 (soft limit)✓ Correct
3. C.100
4. D.Unlimited

What is the difference between a NAT Gateway and a NAT Instance?

1. A.They are identical.
2. B.NAT Gateway is fully managed by AWS (high availability, scalable); NAT Instance is a customer-managed EC2 — older approach.✓ Correct
3. C.NAT Instance is cheaper for high traffic.
4. D.NAT Gateway is on-premises.

Which is the role of a route table?

1. A.It defines firewall rules.
2. B.It controls how traffic is routed within a subnet — to other subnets, IGW, NAT Gateway, VPC peering, etc.✓ Correct
3. C.It encrypts traffic.
4. D.It lists IAM users.

Which CIDR block sizes are supported for a VPC?

1. A.Only /16
2. B.Between /16 (largest, ~65k IPs) and /28 (smallest, 16 IPs)✓ Correct
3. C.Any size up to /8
4. D.Only /24

Which network construct provides private connectivity between two VPCs in the same OR different regions?

1. A.VPC Peering (works across regions, accounts, even if in different organizations)✓ Correct
2. B.Internet Gateway
3. C.NAT Gateway
4. D.Customer Gateway

Which service helps you visualize, troubleshoot, and audit your VPC network at scale?

1. A.VPC Reachability Analyzer / Network Access Analyzer✓ Correct
2. B.Amazon Inspector
3. C.AWS Trusted Advisor
4. D.Amazon GuardDuty

Which is true about Direct Connect?

1. A.It is a public internet connection.
2. B.It is a private dedicated connection from your data center to AWS, bypassing the internet (1, 10, or 100 Gbps).✓ Correct
3. C.It is encrypted by default.
4. D.It is the cheapest option for any company.

What does AWS automatically provision for every new account in each region?

1. A.Nothing — accounts start with no VPCs.
2. B.A default VPC with default subnets in each AZ, an Internet Gateway, and pre-populated route tables — ready to launch instances.✓ Correct
3. C.Only an Internet Gateway.
4. D.Only EC2 instances.

Your remote employees need to connect from their personal laptops to private resources inside your AWS VPC over an encrypted tunnel. Which AWS service should you use?

1. A.AWS Site-to-Site VPN
2. B.AWS Client VPN✓ Correct
3. C.AWS Direct Connect
4. D.AWS PrivateLink

What is the main difference between AWS Site-to-Site VPN and AWS Client VPN?

1. A.Site-to-Site VPN connects networks (e.g. on-premises ↔ AWS); Client VPN connects individual user devices (e.g. laptop ↔ AWS).✓ Correct
2. B.Site-to-Site VPN is faster than Client VPN.
3. C.Client VPN does not encrypt traffic; Site-to-Site VPN does.
4. D.Client VPN replaces Direct Connect.

A SaaS vendor wants to expose its API to customer VPCs without traffic ever traversing the public internet. Which AWS service should they use?

1. A.VPC Peering
2. B.AWS Transit Gateway
3. C.AWS PrivateLink (with an NLB-fronted endpoint service)✓ Correct
4. D.AWS Direct Connect