Quizzes · Service

VPC

Level 0 questions on VPC. Read about it first if it's new to you.

Works with: EC2 (7), RDS (6), Lambda (5), DynamoDB (4), ECS + Fargate (3), SQS (2), API Gateway (1), IAM (1), S3 (1), CloudWatch Logs (1)

15 questions, from a pool of 48
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1A teammate says a subnet is public because the instances in it have public IP addresses. What actually makes a subnet public?

Its route table sends traffic for 0.0.0.0/0 to an internet gateway.Correct. That route is the only thing that makes a subnet public. Without it, even an instance with a public IP has no path to the internet.The instances in it have public IP addresses.Not this one. A public IP is needed to be reached from the internet, but it doesn't make the subnet public. With no route to an internet gateway, the address leads nowhere.Its security group allows inbound traffic from 0.0.0.0/0.Not this one. Security groups filter traffic at a network card. They don't create a path to the internet, and they belong to network interfaces, not to subnets.It was created with the "public" subnet type.Not this one. There is no such setting. "Public" and "private" are names for what the route table does.

Learn it: Subnet · Internet gateway

Question 2Only Todo.io's app servers may connect to the MySQL database on port 3306. The app servers come and go during the day, so their private IP addresses keep changing. How should the database's security group allow them in?

Allow inbound TCP 3306 with the app servers' security group as the source.Correct. A security group rule can name another security group as its source: anything wearing that group may connect, whatever its IP. It follows the servers as they come and go.Allow inbound TCP 3306 from each app server's private IP address.Not this one. This breaks every time a server is replaced, because the new one gets a different IP.Allow inbound TCP 3306 from the whole VPC's address range.Not this one. It works, but anything in the VPC could then reach the database. Least privilege means only the app servers.Allow inbound TCP 3306 from 0.0.0.0/0, since the database is in a private subnet anyway.Not this one. The subnet isn't a filter for traffic from inside the VPC. Defence in depth means the security group should still allow only what needs in.

Learn it: Security group

Question 3A security group on Todo.io's app server allows inbound HTTPS (TCP 443) from anywhere. Someone deletes all of its outbound rules. What happens to the replies the server sends to users' HTTPS requests?

They still get out. Security groups are stateful, so the reply to an allowed request is allowed automatically.Correct. Security groups remember the connections they let in, and let their replies out. Outbound rules only matter for connections the server starts itself.They are blocked until an outbound rule for TCP 443 is added.Not this one. That's how it would work if security groups were stateless. They aren't.They are blocked until an outbound rule for ports 1024–65535 is added.Not this one. That's the fix for a stateless firewall (network ACLs, Level 1). Security groups don't need it.They need a NAT gateway to leave the subnet.Not this one. A NAT gateway lets private resources start connections out. Replies to requests that came in through the internet gateway go back the same way.

Learn it: Security group

Question 4A brand-new AWS account wants to launch an EC2 instance right away, without designing a network. Where can it go?

Into the default VPC that every account has in each Region, which already has public subnets.Correct. The default VPC lets you start straight away. Level 1 replaces it with a designed one.Nowhere, until a VPC has been created by hand.Not this one. Every account already has a default VPC in each Region.Outside any VPC, directly on the internet.Not this one. EC2 instances always live in a VPC.Only into us-east-1, where the account was created.Not this one. There is a default VPC in every Region.

Learn it: VPC (Virtual Private Cloud)

Question 5Todo.io's app servers all sit in one subnet. Which Availability Zones does that subnet cover?

Exactly one. A subnet lives in a single Availability Zone.Correct. So everything in one subnet goes down if that AZ does. Surviving an AZ failure needs subnets in more than one.Every Availability Zone in the Region.Not this one. That is true of a VPC, not of a subnet.Two, for redundancy.Not this one. Redundancy comes from using several subnets in different AZs.None. Subnets aren't tied to Availability Zones.Not this one. Each subnet is created in one AZ and stays there.

Learn it: Subnet · Region

Question 6How many internet gateways can be attached to one VPC?

One.Correct. A VPC has at most one internet gateway. AWS runs it and scales it for you, so one is enough.One per subnet.Not this one. Subnets share the VPC's gateway; their route tables decide whether they use it.One per Availability Zone.Not this one. The internet gateway isn't tied to an AZ.As many as you need for bandwidth.Not this one. It scales by itself, so you never add more.

Learn it: Internet gateway

Question 7Todo.io wants to block one abusive IP address from reaching its web server, while still allowing everyone else. Can it add that block to the server's security group?

No. Security groups only have allow rules, so a security group can't block one address.Correct. Security groups have no deny rules. A stateless network ACL, which has both, comes in Level 1.Yes, with a deny rule for that address.Not this one. Security groups have no deny rules.Yes, with a lower rule number so it is checked first.Not this one. Security group rules have no numbers or order; every allow is checked together.Yes, by removing the outbound rules.Not this one. Replies to allowed traffic go out anyway: security groups are stateful.

Learn it: Security group

Question 8What does a security group attach to?

A network interface (ENI): the one on an EC2 instance, a Fargate task or a VPC-attached Lambda function.Correct. Security groups filter traffic at the network card, not at the subnet.A subnet.Not this one. Subnets don't take security groups. (Network ACLs attach to subnets, in Level 1.)The whole VPC.Not this one. Each network interface has its own security groups.A route table.Not this one. Route tables decide where traffic goes. They hold no rules about who may connect.

Learn it: ENI (Elastic Network Interface) · Security group

Question 9Where should Todo.io place its MySQL database inside the VPC?

In a private subnet, with a security group that only lets the app servers in.Correct. With no route to the internet gateway, nothing on the internet can even try to connect. The security group then narrows it to the app.In a public subnet, with a public IP, so the app can find it.Not this one. The app reaches it by private IP. A public IP only adds exposure.In a public subnet with no security group.Not this one. Every network interface has a security group, and a database should never face the internet.Outside the VPC, on the internet.Not this one. RDS databases always run inside a VPC.

Learn it: Subnet · Security group

Question 10Servers in Todo.io's private subnets must download updates from the internet, but must not be reachable from it. Where does the NAT gateway go?

In a public subnet. The private subnets' route tables send 0.0.0.0/0 to it.Correct. The NAT gateway needs its own way out through the internet gateway, so it must sit in a public subnet.In the private subnet, next to the servers.Not this one. A NAT gateway in a private subnet has no route out itself.Outside the VPC.Not this one. A NAT gateway lives in a subnet of your VPC.One attached to each server.Not this one. One NAT gateway serves a whole set of subnets; servers reach it through their route table.

Learn it: NAT gateway

Question 11Where does Todo.io's public API Gateway endpoint run, relative to its VPC?

Outside the VPC, as a managed AWS service with its own public endpoint.Correct. Like DynamoDB and SQS, it is a public AWS service. It doesn't need your subnets or a NAT gateway.Inside one of the VPC's public subnets.Not this one. API Gateway doesn't run in your subnets.Inside a private subnet, reached through a NAT gateway.Not this one. NAT is for things inside the VPC calling out, not for a public front door.On an EC2 instance that Todo.io launches.Not this one. It is fully managed; there is no instance to launch.

Learn it: API Gateway · VPC (Virtual Private Cloud)

Question 12Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?

Add a NAT gateway in a public subnet, and route the private subnets' internet traffic (0.0.0.0/0) to it.Correct. A VPC-attached Lambda function can only reach what its subnet can reach. A NAT gateway lets it call out to public AWS endpoints such as SQS, while nothing can call in. (A VPC endpoint is another fix, in a later level.)Move the function's network interfaces to a public subnet.Not this one. Lambda's network interfaces never get a public IP, so a public subnet doesn't help. This is a classic exam trap.Add an outbound rule for port 443 to the function's security group.Not this one. Security groups allow all outbound traffic by default, and a timeout means there's no route out at all. An outbound rule can't create a route.Add sqs:SendMessage to the function's execution role again.Not this one. IAM already allows it. A permission problem shows up as AccessDenied, not as a timeout.

Learn it: NAT gateway · Lambda · IAM policy · ENI

Question 13Todo.io stopped and started its web server overnight. Now users can't reach it at the public IP address they had. What happened?

A normal public IP is released when an instance stops; it got a new one on start. An Elastic IP stays fixed.Correct. Inside the VPC the instance only knows its private IP. The public IP is mapped to it, and that mapping changes on stop and start.The security group was reset.Not this one. Security groups don't change when an instance stops.The subnet became private.Not this one. A subnet only changes if someone edits its route table.The internet gateway was removed.Not this one. Stopping an instance doesn't touch the gateway.

Learn it: Public IP address

Question 14An EC2 instance sits in a private subnet with no NAT gateway. It needs to download a software update from the internet. What happens?

The download fails: the subnet has no route out. A NAT gateway in a public subnet would give it one.Correct. Private means no route to the internet gateway. A NAT gateway lets it call out while nothing calls in.It works, because security groups allow all outbound traffic by default.Not this one. Security groups allow it, but there is no route for the traffic to take.It works if the instance has a public IP.Not this one. In a private subnet a public IP leads nowhere: there is still no route to the internet gateway.It works through the internet gateway automatically.Not this one. Only subnets whose route table points to the internet gateway use it.

Learn it: NAT gateway · Subnet

Question 15Todo.io's web server is in a public subnet and has a public IP, but users get a timeout on HTTPS (port 443). What should be checked first?

That the instance's security group allows inbound TCP 443.Correct. Security groups deny everything that isn't allowed. A missing inbound rule shows up as a timeout.That there is a NAT gateway.Not this one. NAT is for calling out from private subnets, not for being reached.That there is an outbound rule for the replies.Not this one. Security groups are stateful; replies are allowed automatically.That the instance is in a private subnet.Not this one. A private subnet would make it unreachable from the internet.

Learn it: Security group

Question 16What does each Fargate task get in Todo.io's VPC?

Its own network interface, with a private IP address and its own security groups.Correct. So each task can be allowed or blocked on its own, like an EC2 instance.Nothing. Fargate tasks run outside the VPC.Not this one. Fargate tasks run inside your subnets.A share of the host server's IP address.Not this one. On Fargate there is no host of yours; each task has its own ENI.A public IP address, always.Not this one. A public IP is optional, and in a private subnet it would be useless.

Learn it: ECS and Fargate · ENI

Question 17Todo.io's Fargate tasks run in private subnets. Their IAM permissions are correct, but every call they make to SQS times out. What fixes it?

A NAT gateway in a public subnet, with the private subnets routing 0.0.0.0/0 to it.Correct. SQS is a public AWS service. From a private subnet, traffic needs a way out. (VPC endpoints are another fix, in a later level.)An outbound rule in the task's security group.Not this one. Security groups allow outbound traffic by default; the problem is the missing route.A public IP on each task, left in the private subnet.Not this one. A public IP is useless without a route to the internet gateway.More permissions on the task role.Not this one. A permission problem returns AccessDenied, not a timeout.

Learn it: NAT gateway · IAM policy

Question 18Todo.io creates a new Lambda function and doesn't attach it to any VPC. Can it call DynamoDB?

Yes. By default a function runs outside your VPC and can reach public AWS endpoints such as DynamoDB.Correct. With no VPC there are no subnets or security groups involved; IAM decides.No. It needs a NAT gateway first.Not this one. NAT is only needed once a function is attached to a VPC.No. Every function must be in a VPC to reach AWS services.Not this one. The default, outside a VPC, already reaches them.Only if the function has a public IP.Not this one. Lambda functions don't get IP addresses you manage.

Learn it: Lambda · DynamoDB

Question 19When should Todo.io attach a Lambda function to its VPC?

When it needs to reach something private inside the VPC, such as the RDS database.Correct. Attaching gives the function network interfaces in your subnets, so it can reach private resources.Whenever it needs the internet.Not this one. Outside a VPC it already has it. Inside, it would need a NAT gateway.To make it run faster.Not this one. Speed comes from memory size, not from the VPC.Always; IAM only works inside a VPC.Not this one. IAM has nothing to do with VPCs.

Learn it: Lambda

Question 20Todo.io's app can't connect to its RDS MySQL database: the connection times out. The password is correct. What is the most likely cause?

The database's security group doesn't allow inbound TCP 3306 from the app.Correct. A silent timeout is what a security group does with traffic it doesn't allow.The app's IAM role lacks permission to run SQL.Not this one. Connections to MySQL on RDS use a database username and password, and a wrong one is refused, not timed out.CloudTrail is blocking the connection.Not this one. CloudTrail only records; it never blocks.The database needs a public IP.Not this one. The app is in the same VPC and uses the private IP.

Learn it: Security group · RDS (Relational Database Service)

Question 21Todo.io is creating a single-AZ RDS database, but its DB subnet group must include subnets in at least two Availability Zones. Why?

So a standby in another Availability Zone can be added later without rebuilding.Correct. RDS insists on two AZs up front, even if you only use one today.Because the data is split across both AZs.Not this one. A single-AZ database keeps its data in one AZ.Because it is cheaper.Not this one. The subnet group costs nothing either way.So the database gets a public IP.Not this one. Public access is a separate setting, and a bad idea here.

Learn it: RDS (Relational Database Service) · Subnet

Question 22Unlike DynamoDB, where does an Amazon RDS database run?

Inside your VPC, in your subnets, with security groups deciding who can connect.Correct. DynamoDB is reached through a public AWS endpoint instead.Outside the VPC, behind a public AWS endpoint.Not this one. That describes DynamoDB.Only in your own data centre.Not this one. RDS runs in AWS.Inside the Lambda function that uses it.Not this one. Databases run on their own; functions connect to them.

Learn it: RDS (Relational Database Service) · VPC (Virtual Private Cloud)

Question 23Todo.io's app on EC2, in a public subnet, calls DynamoDB. Which way does the request travel?

Out through the internet gateway to DynamoDB's public AWS endpoint.Correct. DynamoDB isn't inside your VPC. A gateway endpoint (Level 1) can keep this traffic off the internet.Straight to the table inside the VPC.Not this one. Tables don't live in your VPC.Through the RDS database.Not this one. RDS and DynamoDB are unrelated.Through an SQS queue.Not this one. Queues pass messages between your own components.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · Internet gateway

Question 24Todo.io wants traffic from its VPC to DynamoDB to stay off the internet, without paying extra for it. What should it add?

A VPC gateway endpoint for DynamoDB.Correct. Gateway endpoints (for DynamoDB and S3) add a route to the service that never leaves AWS, and cost nothing.A NAT gateway.Not this one. A NAT gateway costs per hour and per GB, and the traffic still goes out to the public endpoint.A public IP on every instance.Not this one. That puts more traffic on the internet, not less.Move the table into the VPC.Not this one. DynamoDB tables can't be placed in a VPC.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · NAT gateway

Question 25A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?

None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides.Correct. Security groups only exist on network interfaces in a VPC.The VPC's default security group.Not this one. The function isn't in the VPC.The DynamoDB table's security group.Not this one. Tables have no security groups.The NAT gateway's security group.Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.

Learn it: DynamoDB · Security group

Question 26Is Amazon S3 inside Todo.io's VPC?

No. S3 is a public AWS service; traffic reaches it through the internet gateway, a NAT gateway or a gateway endpoint.Correct. Like DynamoDB and SQS, S3 sits outside every customer VPC.Yes. Each subnet has its own copy of every bucket.Not this one. Buckets live in a Region, not in subnets.Only in private subnets.Not this one. S3 isn't in any of your subnets.Only Lambda can reach S3.Not this one. Anything with permission and a network path can.

Learn it: VPC (Virtual Private Cloud) · S3

Question 27An EC2 instance in a public subnet sends its log lines to CloudWatch Logs. Which way do they travel?

Out through the internet gateway to CloudWatch Logs' public AWS endpoint.Correct. Like SQS and DynamoDB, CloudWatch Logs is a public AWS service, not something inside the VPC.They stay inside the VPC; CloudWatch Logs runs in every subnet.Not this one. It runs outside every customer VPC.Through the RDS database.Not this one. Logs don't pass through databases.Through an SQS queue.Not this one. The agent sends straight to CloudWatch Logs.

Learn it: VPC (Virtual Private Cloud) · CloudWatch Logs

Question 28What does "VPC (Virtual Private Cloud)" mean?

Your own private network inside an AWS Region.Correct. Think of it as: A fenced-off private estate inside the city.A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Not this one. That describes Region.A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: VPC (Virtual Private Cloud)

Question 29Which term is this? "Your own private network inside an AWS Region."

VPC (Virtual Private Cloud)Correct. Yes. Think of it as: A fenced-off private estate inside the city.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: VPC (Virtual Private Cloud)

Question 30Which AWS term is described by this analogy? "A fenced-off private estate inside the city."

VPC (Virtual Private Cloud)Correct. Yes: Your own private network inside an AWS Region.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia). Its analogy: A city where AWS has its buildings.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: VPC (Virtual Private Cloud)

Question 31What does "Subnet" mean?

A slice of a VPC's addresses that lives in one Availability Zone.Correct. Think of it as: One street on the estate.Your own private network inside an AWS Region.Not this one. That describes VPC (Virtual Private Cloud).The VPC's door to the public internet.Not this one. That describes Internet gateway.A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Not this one. That describes Region.

Learn it: Subnet

Question 32Which term is this? "A slice of a VPC's addresses that lives in one Availability Zone."

SubnetCorrect. Yes. Think of it as: One street on the estate.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).

Learn it: Subnet

Question 33Which AWS term is described by this analogy? "One street on the estate."

SubnetCorrect. Yes: A slice of a VPC's addresses that lives in one Availability Zone.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region. Its analogy: A fenced-off private estate inside the city.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia). Its analogy: A city where AWS has its buildings.

Learn it: Subnet

Question 34What does "Internet gateway" mean?

The VPC's door to the public internet.Correct. Think of it as: The estate's front gate.A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.An address the whole internet can reach.Not this one. That describes Public IP address.Your own private network inside an AWS Region.Not this one. That describes VPC (Virtual Private Cloud).

Learn it: Internet gateway

Question 35Which term is this? "The VPC's door to the public internet."

Internet gatewayCorrect. Yes. Think of it as: The estate's front gate.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region.

Learn it: Internet gateway

Question 36Which AWS term is described by this analogy? "The estate's front gate."

Internet gatewayCorrect. Yes: The VPC's door to the public internet.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region. Its analogy: A fenced-off private estate inside the city.

Learn it: Internet gateway

Question 37What does "Public IP address" mean?

An address the whole internet can reach.Correct. Think of it as: A street address printed on the outside of the building.The VPC's door to the public internet.Not this one. That describes Internet gateway.A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.

Learn it: Public IP address

Question 38Which term is this? "An address the whole internet can reach."

Public IP addressCorrect. Yes. Think of it as: A street address printed on the outside of the building.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.

Learn it: Public IP address

Question 39Which AWS term is described by this analogy? "A street address printed on the outside of the building."

Public IP addressCorrect. Yes: An address the whole internet can reach.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.

Learn it: Public IP address

Question 40What does "Security group" mean?

A firewall attached to a network card, listing what traffic is allowed in and out.Correct. Think of it as: A bouncer standing at one particular door, holding a guest list.An address the whole internet can reach.Not this one. That describes Public IP address.A virtual network card that gives something an address in a subnet.Not this one. That describes ENI (Elastic Network Interface).The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: Security group

Question 41Which term is this? "A firewall attached to a network card, listing what traffic is allowed in and out."

Security groupCorrect. Yes. Think of it as: A bouncer standing at one particular door, holding a guest list.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: Security group

Question 42Which AWS term is described by this analogy? "A bouncer standing at one particular door, holding a guest list."

Security groupCorrect. Yes: A firewall attached to a network card, listing what traffic is allowed in and out.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet. Its analogy: A phone line installed in a particular room.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: Security group

Question 43What does "ENI (Elastic Network Interface)" mean?

A virtual network card that gives something an address in a subnet.Correct. Think of it as: A phone line installed in a particular room.A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.Lets things in private subnets reach out to the internet, while nothing can reach in.Not this one. That describes NAT gateway.An address the whole internet can reach.Not this one. That describes Public IP address.

Learn it: ENI (Elastic Network Interface)

Question 44Which term is this? "A virtual network card that gives something an address in a subnet."

ENI (Elastic Network Interface)Correct. Yes. Think of it as: A phone line installed in a particular room.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.NAT gatewayNot this one. NAT gateway is: Lets things in private subnets reach out to the internet, while nothing can reach in.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.

Learn it: ENI (Elastic Network Interface)

Question 45Which AWS term is described by this analogy? "A phone line installed in a particular room."

ENI (Elastic Network Interface)Correct. Yes: A virtual network card that gives something an address in a subnet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.NAT gatewayNot this one. NAT gateway is: Lets things in private subnets reach out to the internet, while nothing can reach in. Its analogy: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.

Learn it: ENI (Elastic Network Interface)

Question 46What does "NAT gateway" mean?

Lets things in private subnets reach out to the internet, while nothing can reach in.Correct. Think of it as: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.A virtual network card that gives something an address in a subnet.Not this one. That describes ENI (Elastic Network Interface).A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.An address the whole internet can reach.Not this one. That describes Public IP address.

Learn it: NAT gateway

Question 47Which term is this? "Lets things in private subnets reach out to the internet, while nothing can reach in."

NAT gatewayCorrect. Yes. Think of it as: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.

Learn it: NAT gateway

Question 48Which AWS term is described by this analogy? "A one-way turnstile at the gate. Staff can go out, strangers can't walk in."

NAT gatewayCorrect. Yes: Lets things in private subnets reach out to the internet, while nothing can reach in.ENI (Elastic Network Interface)Not this one. ENI (Elastic Network Interface) is: A virtual network card that gives something an address in a subnet. Its analogy: A phone line installed in a particular room.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.

Learn it: NAT gateway

VPC

Worth another look

Your weak spots

Services

Concepts