Quizzes · The core four

Networking

Level 0 questions on Networking. Read the pillar first if it's new to you.

15 questions, from a pool of 52
Most have 1 correct answer of 4; some ask for 2 of 5
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1A teammate says a subnet is public because the instances in it have public IP addresses. What actually makes a subnet public?

Its route table sends traffic for 0.0.0.0/0 to an internet gateway.Correct. That route is the only thing that makes a subnet public. Without it, even an instance with a public IP has no path to the internet.The instances in it have public IP addresses.Not this one. A public IP is needed to be reached from the internet, but it doesn't make the subnet public. With no route to an internet gateway, the address leads nowhere.Its security group allows inbound traffic from 0.0.0.0/0.Not this one. Security groups filter traffic at a network card. They don't create a path to the internet, and they belong to network interfaces, not to subnets.It was created with the "public" subnet type.Not this one. There is no such setting. "Public" and "private" are names for what the route table does.

Learn it: Subnet · Internet gateway

Question 2Only Todo.io's app servers may connect to the MySQL database on port 3306. The app servers come and go during the day, so their private IP addresses keep changing. How should the database's security group allow them in?

Allow inbound TCP 3306 with the app servers' security group as the source.Correct. A security group rule can name another security group as its source: anything wearing that group may connect, whatever its IP. It follows the servers as they come and go.Allow inbound TCP 3306 from each app server's private IP address.Not this one. This breaks every time a server is replaced, because the new one gets a different IP.Allow inbound TCP 3306 from the whole VPC's address range.Not this one. It works, but anything in the VPC could then reach the database. Least privilege means only the app servers.Allow inbound TCP 3306 from 0.0.0.0/0, since the database is in a private subnet anyway.Not this one. The subnet isn't a filter for traffic from inside the VPC. Defence in depth means the security group should still allow only what needs in.

Learn it: Security group

Question 3A security group on Todo.io's app server allows inbound HTTPS (TCP 443) from anywhere. Someone deletes all of its outbound rules. What happens to the replies the server sends to users' HTTPS requests?

They still get out. Security groups are stateful, so the reply to an allowed request is allowed automatically.Correct. Security groups remember the connections they let in, and let their replies out. Outbound rules only matter for connections the server starts itself.They are blocked until an outbound rule for TCP 443 is added.Not this one. That's how it would work if security groups were stateless. They aren't.They are blocked until an outbound rule for ports 1024–65535 is added.Not this one. That's the fix for a stateless firewall (network ACLs, Level 1). Security groups don't need it.They need a NAT gateway to leave the subnet.Not this one. A NAT gateway lets private resources start connections out. Replies to requests that came in through the internet gateway go back the same way.

Learn it: Security group

Question 4A brand-new AWS account wants to launch an EC2 instance right away, without designing a network. Where can it go?

Into the default VPC that every account has in each Region, which already has public subnets.Correct. The default VPC lets you start straight away. Level 1 replaces it with a designed one.Nowhere, until a VPC has been created by hand.Not this one. Every account already has a default VPC in each Region.Outside any VPC, directly on the internet.Not this one. EC2 instances always live in a VPC.Only into us-east-1, where the account was created.Not this one. There is a default VPC in every Region.

Learn it: VPC (Virtual Private Cloud)

Question 5Todo.io's app servers all sit in one subnet. Which Availability Zones does that subnet cover?

Exactly one. A subnet lives in a single Availability Zone.Correct. So everything in one subnet goes down if that AZ does. Surviving an AZ failure needs subnets in more than one.Every Availability Zone in the Region.Not this one. That is true of a VPC, not of a subnet.Two, for redundancy.Not this one. Redundancy comes from using several subnets in different AZs.None. Subnets aren't tied to Availability Zones.Not this one. Each subnet is created in one AZ and stays there.

Learn it: Subnet · Region

Question 6How many internet gateways can be attached to one VPC?

One.Correct. A VPC has at most one internet gateway. AWS runs it and scales it for you, so one is enough.One per subnet.Not this one. Subnets share the VPC's gateway; their route tables decide whether they use it.One per Availability Zone.Not this one. The internet gateway isn't tied to an AZ.As many as you need for bandwidth.Not this one. It scales by itself, so you never add more.

Learn it: Internet gateway

Question 7Todo.io wants to block one abusive IP address from reaching its web server, while still allowing everyone else. Can it add that block to the server's security group?

No. Security groups only have allow rules, so a security group can't block one address.Correct. Security groups have no deny rules. A stateless network ACL, which has both, comes in Level 1.Yes, with a deny rule for that address.Not this one. Security groups have no deny rules.Yes, with a lower rule number so it is checked first.Not this one. Security group rules have no numbers or order; every allow is checked together.Yes, by removing the outbound rules.Not this one. Replies to allowed traffic go out anyway: security groups are stateful.

Learn it: Security group

Question 8What does a security group attach to?

A network interface (ENI): the one on an EC2 instance, a Fargate task or a VPC-attached Lambda function.Correct. Security groups filter traffic at the network card, not at the subnet.A subnet.Not this one. Subnets don't take security groups. (Network ACLs attach to subnets, in Level 1.)The whole VPC.Not this one. Each network interface has its own security groups.A route table.Not this one. Route tables decide where traffic goes. They hold no rules about who may connect.

Learn it: ENI (Elastic Network Interface) · Security group

Question 9Where should Todo.io place its MySQL database inside the VPC?

In a private subnet, with a security group that only lets the app servers in.Correct. With no route to the internet gateway, nothing on the internet can even try to connect. The security group then narrows it to the app.In a public subnet, with a public IP, so the app can find it.Not this one. The app reaches it by private IP. A public IP only adds exposure.In a public subnet with no security group.Not this one. Every network interface has a security group, and a database should never face the internet.Outside the VPC, on the internet.Not this one. RDS databases always run inside a VPC.

Learn it: Subnet · Security group

Question 10Servers in Todo.io's private subnets must download updates from the internet, but must not be reachable from it. Where does the NAT gateway go?

In a public subnet. The private subnets' route tables send 0.0.0.0/0 to it.Correct. The NAT gateway needs its own way out through the internet gateway, so it must sit in a public subnet.In the private subnet, next to the servers.Not this one. A NAT gateway in a private subnet has no route out itself.Outside the VPC.Not this one. A NAT gateway lives in a subnet of your VPC.One attached to each server.Not this one. One NAT gateway serves a whole set of subnets; servers reach it through their route table.

Learn it: NAT gateway

Question 11Todo.io's backend runs on Lambda. Browsers need an HTTPS address to send requests to. What should sit in front of the function?

Amazon API Gateway.Correct. API Gateway gives you a managed HTTPS endpoint and passes each request to Lambda: the classic serverless API.A public IP address on the function.Not this one. Lambda functions don't have IP addresses you can call.Put the function in a public subnet.Not this one. A subnet doesn't give a function an HTTPS endpoint.An SQS queue.Not this one. A queue holds work for later. A browser waiting for an answer needs a request and a response.

Learn it: API Gateway

Question 12A buggy client starts sending thousands of requests a second to Todo.io's API. Which API Gateway feature protects the backend?

Throttling: a rate limit that rejects excess requests before they reach the backend.Correct. Extra requests get HTTP 429 (Too Many Requests) and never reach Lambda or the database.Logging every request to CloudTrail.Not this one. CloudTrail records AWS API calls; it doesn't stop anything.A WebSocket API.Not this one. That keeps connections open; it doesn't limit how many requests arrive.A longer Lambda timeout.Not this one. That makes each request last longer, which is worse under a flood.

Learn it: API Gateway

Question 13Todo.io's API Gateway invokes its Lambda function. In Todo.io's setup, which policy says that API Gateway may invoke the function?

A resource-based policy on the function.Correct. It lives on the function and names the caller (apigateway.amazonaws.com): who may use this resource.The function's execution role.Not this one. The execution role says what the function may do, not who may call it.An SCP on the account.Not this one. SCPs only cap permissions; they never grant them.A security group on the function.Not this one. Security groups filter network traffic. Invoking a function is an AWS API call, decided by IAM.

Learn it: API Gateway · IAM policy · Lambda

Question 14When a todo changes, Todo.io wants every open browser tab to update at once, without the browser asking again and again. What fits?

An API Gateway WebSocket API; the backend pushes to each connection.Correct. A WebSocket stays open both ways, so the server can send whenever something happens.A REST API with a longer timeout.Not this one. The browser still has to ask; the server can only answer.An SQS queue the browser reads from.Not this one. Browsers don't read SQS queues, and that would still be asking repeatedly.CloudWatch Logs.Not this one. Logs are for engineers to read, not for talking to browsers.

Learn it: WebSocket (API Gateway WebSocket API)

Question 15Which routes does every API Gateway WebSocket API have built in?

$connect, $disconnect and $default.Correct. They run when a browser connects, when it disconnects, and for any message no other route matches. Each can call Lambda or an HTTP backend.GET, POST, PUT and DELETE.Not this one. Those are HTTP methods, used by REST APIs./login and /logout.Not this one. Those would be routes you design yourself.$open, $close and $message.Not this one. The names are $connect, $disconnect and $default.

Learn it: WebSocket (API Gateway WebSocket API)

Question 16Todo.io's Lambda function tries to push a message to a browser by POSTing to the WebSocket API's @connections URL, and gets AccessDenied. What fixes it?

Allow execute-api:ManageConnections in the function's execution role.Correct. Pushing to a connection is an AWS API call, so IAM must allow it like any other.Open port 443 in the function's security group.Not this one. AccessDenied is an IAM answer. A network problem would time out instead.Enable CORS on the API.Not this one. CORS is about browsers calling across websites. This call comes from Lambda.Give the browser an IAM role.Not this one. The browser is the receiver here, and app users are never IAM principals.

Learn it: WebSocket (API Gateway WebSocket API) · IAM policy

Question 17Todo.io wants an API with no servers to patch or scale. Which combination is the classic serverless pattern?

API Gateway → Lambda → DynamoDB.Correct. Every piece is managed and scales on its own; you pay for requests, not idle servers.EC2 → RDS.Not this one. Both run on servers you size, and EC2 you also patch.API Gateway → EC2 → RDS.Not this one. EC2 still means servers to manage.SQS → CloudWatch Logs.Not this one. That is a queue and a log store; neither serves an API.

Learn it: API Gateway · Lambda

Question 18Which of these does API Gateway handle for Todo.io?

The HTTPS endpoint, throttling and authorisation, before requests reach the backend.Correct. It is the front door; your code behind it does the actual work.Storing the todos.Not this one. Data lives in a database such as DynamoDB or RDS.Running the business logic.Not this one. That runs in the backend, usually Lambda.Patching the backend's servers.Not this one. With Lambda there are none; with EC2 that is still your job.

Learn it: API Gateway

Question 19Where does Todo.io's public API Gateway endpoint run, relative to its VPC?

Outside the VPC, as a managed AWS service with its own public endpoint.Correct. Like DynamoDB and SQS, it is a public AWS service. It doesn't need your subnets or a NAT gateway.Inside one of the VPC's public subnets.Not this one. API Gateway doesn't run in your subnets.Inside a private subnet, reached through a NAT gateway.Not this one. NAT is for things inside the VPC calling out, not for a public front door.On an EC2 instance that Todo.io launches.Not this one. It is fully managed; there is no instance to launch.

Learn it: API Gateway · VPC (Virtual Private Cloud)

Question 20Hundreds of browsers hold WebSocket connections open to Todo.io. How does the backend send a message to one of them?

By its connection id, which API Gateway gave that connection when it opened.Correct. The backend POSTs to @connections/{id}. Todo.io stores each user's connection ids when they connect.By the browser's IP address.Not this one. The backend never talks to browsers directly; API Gateway holds the connections.By the user's IAM ARN.Not this one. App users aren't IAM principals.By an SQS queue URL.Not this one. Queues aren't connected to browsers.

Learn it: WebSocket (API Gateway WebSocket API)

Question 21Todo.io's Lambda function, not attached to any VPC, swaps its DynamoDB table for an RDS MySQL database in a private subnet. Which two network changes let the function reach the database?

Choose two.

Attach the function to the VPC, in the private subnets.Correct. By default a function runs outside your VPC. To reach something private like RDS, it has to be attached to the VPC, so it gets a network card there.Let the function's security group in through the database's security group, on port 3306.Correct. The database's security group decides what may connect. A rule that names the function's security group keeps working as invocations come and go.Add a NAT gateway so the function can reach the database.Not this one. A NAT gateway lets private things call out to the internet. The database is inside the VPC, so reaching it doesn't need one. (Reaching SQS afterwards would.)Move the database to a public subnet so the function can reach it from outside the VPC.Not this one. Databases belong in private subnets, with no route to the internet. Bring the function into the VPC instead.Allow the database's SQL actions in the function's execution role.Not this one. IAM doesn't approve SQL connections here: the app logs in to MySQL with a username and password, through the security group.

Learn it: Lambda · Subnet · Security group · RDS (Relational Database Service) · NAT gateway

Question 22On EC2, browsers reached Todo.io's app through the internet gateway, at the server's public IP. Todo.io moves the app to a Lambda function. What is the front door now?

API Gateway, which gives the function a managed HTTPS endpoint.Correct. API Gateway gives a backend like Lambda a managed HTTPS endpoint, outside your VPC, and calls the function for each request.The same internet gateway, now pointing at the function.Not this one. An internet gateway is the VPC's door to the internet. It routes traffic for things in public subnets; it doesn't call functions.A NAT gateway in a public subnet.Not this one. A NAT gateway only lets private things start connections out. Nothing outside can start a connection in through it.The function's security group, with HTTPS allowed from anywhere.Not this one. A security group only allows or drops traffic that already reaches a network card. It gives nothing an address browsers can call.

Learn it: API Gateway · NAT gateway · VPC (Virtual Private Cloud) · Security group · Internet gateway

Question 23What does "Region" mean?

A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Correct. Think of it as: A city where AWS has its buildings.Your own private network inside an AWS Region.Not this one. That describes VPC (Virtual Private Cloud).A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: Region

Question 24Which term is this? "A geographic area where AWS runs data centres, like us-east-1 (N. Virginia)."

RegionCorrect. Yes. Think of it as: A city where AWS has its buildings.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: Region

Question 25Which AWS term is described by this analogy? "A city where AWS has its buildings."

RegionCorrect. Yes: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region. Its analogy: A fenced-off private estate inside the city.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: Region

Question 26What does "VPC (Virtual Private Cloud)" mean?

Your own private network inside an AWS Region.Correct. Think of it as: A fenced-off private estate inside the city.A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Not this one. That describes Region.A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: VPC (Virtual Private Cloud)

Question 27Which term is this? "Your own private network inside an AWS Region."

VPC (Virtual Private Cloud)Correct. Yes. Think of it as: A fenced-off private estate inside the city.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: VPC (Virtual Private Cloud)

Question 28Which AWS term is described by this analogy? "A fenced-off private estate inside the city."

VPC (Virtual Private Cloud)Correct. Yes: Your own private network inside an AWS Region.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia). Its analogy: A city where AWS has its buildings.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: VPC (Virtual Private Cloud)

Question 29What does "Subnet" mean?

A slice of a VPC's addresses that lives in one Availability Zone.Correct. Think of it as: One street on the estate.Your own private network inside an AWS Region.Not this one. That describes VPC (Virtual Private Cloud).The VPC's door to the public internet.Not this one. That describes Internet gateway.A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Not this one. That describes Region.

Learn it: Subnet

Question 30Which term is this? "A slice of a VPC's addresses that lives in one Availability Zone."

SubnetCorrect. Yes. Think of it as: One street on the estate.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).

Learn it: Subnet

Question 31Which AWS term is described by this analogy? "One street on the estate."

SubnetCorrect. Yes: A slice of a VPC's addresses that lives in one Availability Zone.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region. Its analogy: A fenced-off private estate inside the city.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia). Its analogy: A city where AWS has its buildings.

Learn it: Subnet

Question 32What does "Internet gateway" mean?

The VPC's door to the public internet.Correct. Think of it as: The estate's front gate.A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.An address the whole internet can reach.Not this one. That describes Public IP address.Your own private network inside an AWS Region.Not this one. That describes VPC (Virtual Private Cloud).

Learn it: Internet gateway

Question 33Which term is this? "The VPC's door to the public internet."

Internet gatewayCorrect. Yes. Think of it as: The estate's front gate.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region.

Learn it: Internet gateway

Question 34Which AWS term is described by this analogy? "The estate's front gate."

Internet gatewayCorrect. Yes: The VPC's door to the public internet.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region. Its analogy: A fenced-off private estate inside the city.

Learn it: Internet gateway

Question 35What does "Public IP address" mean?

An address the whole internet can reach.Correct. Think of it as: A street address printed on the outside of the building.The VPC's door to the public internet.Not this one. That describes Internet gateway.A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.

Learn it: Public IP address

Question 36Which term is this? "An address the whole internet can reach."

Public IP addressCorrect. Yes. Think of it as: A street address printed on the outside of the building.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.

Learn it: Public IP address

Question 37Which AWS term is described by this analogy? "A street address printed on the outside of the building."

Public IP addressCorrect. Yes: An address the whole internet can reach.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.

Learn it: Public IP address

Question 38What does "Security group" mean?

A firewall attached to a network card, listing what traffic is allowed in and out.Correct. Think of it as: A bouncer standing at one particular door, holding a guest list.An address the whole internet can reach.Not this one. That describes Public IP address.A virtual network card that gives something an address in a subnet.Not this one. That describes ENI (Elastic Network Interface).The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: Security group

Question 39Which term is this? "A firewall attached to a network card, listing what traffic is allowed in and out."

Security groupCorrect. Yes. Think of it as: A bouncer standing at one particular door, holding a guest list.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: Security group

Question 40Which AWS term is described by this analogy? "A bouncer standing at one particular door, holding a guest list."

Security groupCorrect. Yes: A firewall attached to a network card, listing what traffic is allowed in and out.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet. Its analogy: A phone line installed in a particular room.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: Security group

Question 41What does "ENI (Elastic Network Interface)" mean?

A virtual network card that gives something an address in a subnet.Correct. Think of it as: A phone line installed in a particular room.A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.Lets things in private subnets reach out to the internet, while nothing can reach in.Not this one. That describes NAT gateway.An address the whole internet can reach.Not this one. That describes Public IP address.

Learn it: ENI (Elastic Network Interface)

Question 42Which term is this? "A virtual network card that gives something an address in a subnet."

ENI (Elastic Network Interface)Correct. Yes. Think of it as: A phone line installed in a particular room.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.NAT gatewayNot this one. NAT gateway is: Lets things in private subnets reach out to the internet, while nothing can reach in.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.

Learn it: ENI (Elastic Network Interface)

Question 43Which AWS term is described by this analogy? "A phone line installed in a particular room."

ENI (Elastic Network Interface)Correct. Yes: A virtual network card that gives something an address in a subnet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.NAT gatewayNot this one. NAT gateway is: Lets things in private subnets reach out to the internet, while nothing can reach in. Its analogy: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.

Learn it: ENI (Elastic Network Interface)

Question 44What does "NAT gateway" mean?

Lets things in private subnets reach out to the internet, while nothing can reach in.Correct. Think of it as: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.A virtual network card that gives something an address in a subnet.Not this one. That describes ENI (Elastic Network Interface).A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.An address the whole internet can reach.Not this one. That describes Public IP address.

Learn it: NAT gateway

Question 45Which term is this? "Lets things in private subnets reach out to the internet, while nothing can reach in."

NAT gatewayCorrect. Yes. Think of it as: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.

Learn it: NAT gateway

Question 46Which AWS term is described by this analogy? "A one-way turnstile at the gate. Staff can go out, strangers can't walk in."

NAT gatewayCorrect. Yes: Lets things in private subnets reach out to the internet, while nothing can reach in.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet. Its analogy: A phone line installed in a particular room.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.

Learn it: NAT gateway

Question 47What does "API Gateway" mean?

A managed HTTPS front door that passes requests to your code.Correct. Think of it as: A receptionist who takes every visitor's request and phones the right person.Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.Not this one. That describes WebSocket (API Gateway WebSocket API).Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.

Learn it: API Gateway

Question 48Which term is this? "A managed HTTPS front door that passes requests to your code."

API GatewayCorrect. Yes. Think of it as: A receptionist who takes every visitor's request and phones the right person.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.WebSocket (API Gateway WebSocket API)Not this one. WebSocket (API Gateway WebSocket API) is: An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.

Learn it: API Gateway

Question 49Which AWS term is described by this analogy? "A receptionist who takes every visitor's request and phones the right person."

API GatewayCorrect. Yes: A managed HTTPS front door that passes requests to your code.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.WebSocket (API Gateway WebSocket API)Not this one. WebSocket (API Gateway WebSocket API) is: An API Gateway API that keeps each browser connection open, so your backend can push messages at any time. Its analogy: An open phone line instead of sending letters back and forth.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.

Learn it: API Gateway

Question 50What does "WebSocket (API Gateway WebSocket API)" mean?

An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.Correct. Think of it as: An open phone line instead of sending letters back and forth.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.Upload a function; AWS runs it only when something calls it.Not this one. That describes Lambda.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.

Learn it: WebSocket (API Gateway WebSocket API)

Question 51Which term is this? "An API Gateway API that keeps each browser connection open, so your backend can push messages at any time."

WebSocket (API Gateway WebSocket API)Correct. Yes. Think of it as: An open phone line instead of sending letters back and forth.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.

Learn it: WebSocket (API Gateway WebSocket API)

Question 52Which AWS term is described by this analogy? "An open phone line instead of sending letters back and forth."

WebSocket (API Gateway WebSocket API)Correct. Yes: An API Gateway API that keeps each browser connection open, so your backend can push messages at any time.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.LambdaNot this one. Lambda is: Upload a function; AWS runs it only when something calls it. Its analogy: A taxi. You pay for the ride, not for owning the car.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.

Learn it: WebSocket (API Gateway WebSocket API)

Networking

Score by pillar

Score by domain

Worth another look

Your weak spots

Services

Concepts