Subnet quiz · Level 0 · Todo.io Learns AWS

Question 1A teammate says a subnet is public because the instances in it have public IP addresses. What actually makes a subnet public?

Its route table sends traffic for 0.0.0.0/0 to an internet gateway.Correct. That route is the only thing that makes a subnet public. Without it, even an instance with a public IP has no path to the internet.The instances in it have public IP addresses.Not this one. A public IP is needed to be reached from the internet, but it doesn't make the subnet public. With no route to an internet gateway, the address leads nowhere.Its security group allows inbound traffic from 0.0.0.0/0.Not this one. Security groups filter traffic at a network card. They don't create a path to the internet, and they belong to network interfaces, not to subnets.It was created with the "public" subnet type.Not this one. There is no such setting. "Public" and "private" are names for what the route table does.

Learn it: Subnet · Internet gateway

Question 2Todo.io's app servers all sit in one subnet. Which Availability Zones does that subnet cover?

Exactly one. A subnet lives in a single Availability Zone.Correct. So everything in one subnet goes down if that AZ does. Surviving an AZ failure needs subnets in more than one.Every Availability Zone in the Region.Not this one. That is true of a VPC, not of a subnet.Two, for redundancy.Not this one. Redundancy comes from using several subnets in different AZs.None. Subnets aren't tied to Availability Zones.Not this one. Each subnet is created in one AZ and stays there.

Learn it: Subnet · Region

Question 3Where should Todo.io place its MySQL database inside the VPC?

In a private subnet, with a security group that only lets the app servers in.Correct. With no route to the internet gateway, nothing on the internet can even try to connect. The security group then narrows it to the app.In a public subnet, with a public IP, so the app can find it.Not this one. The app reaches it by private IP. A public IP only adds exposure.In a public subnet with no security group.Not this one. Every network interface has a security group, and a database should never face the internet.Outside the VPC, on the internet.Not this one. RDS databases always run inside a VPC.

Learn it: Subnet · Security group

Question 4An EC2 instance sits in a private subnet with no NAT gateway. It needs to download a software update from the internet. What happens?

The download fails: the subnet has no route out. A NAT gateway in a public subnet would give it one.Correct. Private means no route to the internet gateway. A NAT gateway lets it call out while nothing calls in.It works, because security groups allow all outbound traffic by default.Not this one. Security groups allow it, but there is no route for the traffic to take.It works if the instance has a public IP.Not this one. In a private subnet a public IP leads nowhere: there is still no route to the internet gateway.It works through the internet gateway automatically.Not this one. Only subnets whose route table points to the internet gateway use it.

Learn it: NAT gateway · Subnet

Question 5Todo.io is creating a single-AZ RDS database, but its DB subnet group must include subnets in at least two Availability Zones. Why?

So a standby in another Availability Zone can be added later without rebuilding.Correct. RDS insists on two AZs up front, even if you only use one today.Because the data is split across both AZs.Not this one. A single-AZ database keeps its data in one AZ.Because it is cheaper.Not this one. The subnet group costs nothing either way.So the database gets a public IP.Not this one. Public access is a separate setting, and a bad idea here.

Learn it: RDS (Relational Database Service) · Subnet

Question 6What does "Subnet" mean?

A slice of a VPC's addresses that lives in one Availability Zone.Correct. Think of it as: One street on the estate.Your own private network inside an AWS Region.Not this one. That describes VPC (Virtual Private Cloud).The VPC's door to the public internet.Not this one. That describes Internet gateway.A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Not this one. That describes Region.

Learn it: Subnet

Question 7Which term is this? "A slice of a VPC's addresses that lives in one Availability Zone."

SubnetCorrect. Yes. Think of it as: One street on the estate.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).

Learn it: Subnet

Question 8Which AWS term is described by this analogy? "One street on the estate."

SubnetCorrect. Yes: A slice of a VPC's addresses that lives in one Availability Zone.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region. Its analogy: A fenced-off private estate inside the city.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia). Its analogy: A city where AWS has its buildings.

Learn it: Subnet

Subnet

Worth another look

Your weak spots

Services

Concepts