ENI (Elastic Network Interface) quiz · Level 0

Question 1What does a security group attach to?

A network interface (ENI): the one on an EC2 instance, a Fargate task or a VPC-attached Lambda function.Correct. Security groups filter traffic at the network card, not at the subnet.A subnet.Not this one. Subnets don't take security groups. (Network ACLs attach to subnets, in Level 1.)The whole VPC.Not this one. Each network interface has its own security groups.A route table.Not this one. Route tables decide where traffic goes. They hold no rules about who may connect.

Learn it: ENI (Elastic Network Interface) · Security group

Question 2Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?

Add a NAT gateway in a public subnet, and route the private subnets' internet traffic (0.0.0.0/0) to it.Correct. A VPC-attached Lambda function can only reach what its subnet can reach. A NAT gateway lets it call out to public AWS endpoints such as SQS, while nothing can call in. (A VPC endpoint is another fix, in a later level.)Move the function's network interfaces to a public subnet.Not this one. Lambda's network interfaces never get a public IP, so a public subnet doesn't help. This is a classic exam trap.Add an outbound rule for port 443 to the function's security group.Not this one. Security groups allow all outbound traffic by default, and a timeout means there's no route out at all. An outbound rule can't create a route.Add sqs:SendMessage to the function's execution role again.Not this one. IAM already allows it. A permission problem shows up as AccessDenied, not as a timeout.

Learn it: NAT gateway · Lambda · IAM policy · ENI

Question 3What does each Fargate task get in Todo.io's VPC?

Its own network interface, with a private IP address and its own security groups.Correct. So each task can be allowed or blocked on its own, like an EC2 instance.Nothing. Fargate tasks run outside the VPC.Not this one. Fargate tasks run inside your subnets.A share of the host server's IP address.Not this one. On Fargate there is no host of yours; each task has its own ENI.A public IP address, always.Not this one. A public IP is optional, and in a private subnet it would be useless.

Learn it: ECS and Fargate · ENI

Question 4What does "ENI (Elastic Network Interface)" mean?

A virtual network card that gives something an address in a subnet.Correct. Think of it as: A phone line installed in a particular room.A firewall attached to a network card, listing what traffic is allowed in and out.Not this one. That describes Security group.Lets things in private subnets reach out to the internet, while nothing can reach in.Not this one. That describes NAT gateway.An address the whole internet can reach.Not this one. That describes Public IP address.

Learn it: ENI (Elastic Network Interface)

Question 5Which term is this? "A virtual network card that gives something an address in a subnet."

ENI (Elastic Network Interface)Correct. Yes. Think of it as: A phone line installed in a particular room.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out.NAT gatewayNot this one. NAT gateway is: Lets things in private subnets reach out to the internet, while nothing can reach in.Public IP addressNot this one. Public IP address is: An address the whole internet can reach.

Learn it: ENI (Elastic Network Interface)

Question 6Which AWS term is described by this analogy? "A phone line installed in a particular room."

ENI (Elastic Network Interface)Correct. Yes: A virtual network card that gives something an address in a subnet.Security groupNot this one. Security group is: A firewall attached to a network card, listing what traffic is allowed in and out. Its analogy: A bouncer standing at one particular door, holding a guest list.NAT gatewayNot this one. NAT gateway is: Lets things in private subnets reach out to the internet, while nothing can reach in. Its analogy: A one-way turnstile at the gate. Staff can go out, strangers can't walk in.Public IP addressNot this one. Public IP address is: An address the whole internet can reach. Its analogy: A street address printed on the outside of the building.

Learn it: ENI (Elastic Network Interface)

ENI (Elastic Network Interface)

Worth another look

Your weak spots

Services

Concepts