VPC (Virtual Private Cloud) quiz · Level 0

Question 1A brand-new AWS account wants to launch an EC2 instance right away, without designing a network. Where can it go?

Into the default VPC that every account has in each Region, which already has public subnets.Correct. The default VPC lets you start straight away. Level 1 replaces it with a designed one.Nowhere, until a VPC has been created by hand.Not this one. Every account already has a default VPC in each Region.Outside any VPC, directly on the internet.Not this one. EC2 instances always live in a VPC.Only into us-east-1, where the account was created.Not this one. There is a default VPC in every Region.

Learn it: VPC (Virtual Private Cloud)

Question 2Where does Todo.io's public API Gateway endpoint run, relative to its VPC?

Outside the VPC, as a managed AWS service with its own public endpoint.Correct. Like DynamoDB and SQS, it is a public AWS service. It doesn't need your subnets or a NAT gateway.Inside one of the VPC's public subnets.Not this one. API Gateway doesn't run in your subnets.Inside a private subnet, reached through a NAT gateway.Not this one. NAT is for things inside the VPC calling out, not for a public front door.On an EC2 instance that Todo.io launches.Not this one. It is fully managed; there is no instance to launch.

Learn it: API Gateway · VPC (Virtual Private Cloud)

Question 3Unlike DynamoDB, where does an Amazon RDS database run?

Inside your VPC, in your subnets, with security groups deciding who can connect.Correct. DynamoDB is reached through a public AWS endpoint instead.Outside the VPC, behind a public AWS endpoint.Not this one. That describes DynamoDB.Only in your own data centre.Not this one. RDS runs in AWS.Inside the Lambda function that uses it.Not this one. Databases run on their own; functions connect to them.

Learn it: RDS (Relational Database Service) · VPC (Virtual Private Cloud)

Question 4Todo.io's app on EC2, in a public subnet, calls DynamoDB. Which way does the request travel?

Out through the internet gateway to DynamoDB's public AWS endpoint.Correct. DynamoDB isn't inside your VPC. A gateway endpoint (Level 1) can keep this traffic off the internet.Straight to the table inside the VPC.Not this one. Tables don't live in your VPC.Through the RDS database.Not this one. RDS and DynamoDB are unrelated.Through an SQS queue.Not this one. Queues pass messages between your own components.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · Internet gateway

Question 5Todo.io wants traffic from its VPC to DynamoDB to stay off the internet, without paying extra for it. What should it add?

A VPC gateway endpoint for DynamoDB.Correct. Gateway endpoints (for DynamoDB and S3) add a route to the service that never leaves AWS, and cost nothing.A NAT gateway.Not this one. A NAT gateway costs per hour and per GB, and the traffic still goes out to the public endpoint.A public IP on every instance.Not this one. That puts more traffic on the internet, not less.Move the table into the VPC.Not this one. DynamoDB tables can't be placed in a VPC.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · NAT gateway

Question 6Is Amazon S3 inside Todo.io's VPC?

No. S3 is a public AWS service; traffic reaches it through the internet gateway, a NAT gateway or a gateway endpoint.Correct. Like DynamoDB and SQS, S3 sits outside every customer VPC.Yes. Each subnet has its own copy of every bucket.Not this one. Buckets live in a Region, not in subnets.Only in private subnets.Not this one. S3 isn't in any of your subnets.Only Lambda can reach S3.Not this one. Anything with permission and a network path can.

Learn it: VPC (Virtual Private Cloud) · S3

Question 7An EC2 instance in a public subnet sends its log lines to CloudWatch Logs. Which way do they travel?

Out through the internet gateway to CloudWatch Logs' public AWS endpoint.Correct. Like SQS and DynamoDB, CloudWatch Logs is a public AWS service, not something inside the VPC.They stay inside the VPC; CloudWatch Logs runs in every subnet.Not this one. It runs outside every customer VPC.Through the RDS database.Not this one. Logs don't pass through databases.Through an SQS queue.Not this one. The agent sends straight to CloudWatch Logs.

Learn it: VPC (Virtual Private Cloud) · CloudWatch Logs

Question 8What does "VPC (Virtual Private Cloud)" mean?

Your own private network inside an AWS Region.Correct. Think of it as: A fenced-off private estate inside the city.A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Not this one. That describes Region.A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: VPC (Virtual Private Cloud)

Question 9Which term is this? "Your own private network inside an AWS Region."

VPC (Virtual Private Cloud)Correct. Yes. Think of it as: A fenced-off private estate inside the city.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: VPC (Virtual Private Cloud)

Question 10Which AWS term is described by this analogy? "A fenced-off private estate inside the city."

VPC (Virtual Private Cloud)Correct. Yes: Your own private network inside an AWS Region.RegionNot this one. Region is: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia). Its analogy: A city where AWS has its buildings.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: VPC (Virtual Private Cloud)

VPC (Virtual Private Cloud)

Worth another look

Your weak spots

Services

Concepts