Networking and Content Delivery practice questions

Answer: A) The load balancer's connection idle timeout attribute

The ALB closes connections that stay idle longer than the connection idle timeout, which defaults to 60 seconds. Increasing this attribute (up to 4000 seconds) keeps quiet WebSocket sessions open.

• ACorrect. The connection idle timeout is how long a client or target connection can stay inactive, with no data sent or received, before the ALB closes it. The default is 60 seconds, and you can set it from 1 to 4000 seconds. Raising it stops quiet WebSocket sessions from being dropped.
• BIncorrect. The keepalive duration sets the maximum total lifetime of a persistent client connection, and it keeps counting even when there is no traffic. Its default is 3600 seconds and its minimum is 60 seconds, so it does not explain sessions dropping after one idle minute.
• CIncorrect. Deregistration delay only controls how long in-flight requests get to finish while a target is being deregistered. It does not control how long an idle connection stays open.
• DIncorrect. Stickiness duration controls how long the ALB keeps sending a client to the same target, based on a cookie. It does not decide when the ALB closes an idle connection.

Answer: A) A Route 53 alias record of type A that targets the ALB's DNS name

CNAME records aren't allowed at the zone apex. A Route 53 alias record of type A (or AAAA) can point example.com at an ALB and follows changes to the ALB's IP addresses automatically.

• ACorrect. You can create alias records at the zone apex, and they can target an Elastic Load Balancing load balancer. Route 53 follows changes to the ALB's IP addresses on its own, and it doesn't charge for alias queries to AWS resources.
• BIncorrect. You can't create a CNAME record with the same name as the hosted zone (the zone apex).
• CIncorrect. ALB IP addresses can change. A static A record wouldn't follow those changes, so users would be sent to stale addresses.
• DIncorrect. Route 53 doesn't support CNAME records at the zone apex, even as alias records. The alias must use a type such as A or AAAA.

Answer: A) Create a NAT gateway in a public subnet in each AZ, and give each AZ's private subnets a route table that points 0.0.0.0/0 to the NAT gateway in the same AZ

A zonal NAT gateway lives in one AZ, so a shared gateway is a single point of failure for every AZ that uses it. Put a NAT gateway in each AZ and route each AZ's private subnets to their local gateway.

• ACorrect. Each zonal NAT gateway is created in one AZ and has redundancy only inside that zone. AWS recommends creating a NAT gateway in each AZ and routing resources to the NAT gateway in their own AZ, so one AZ failure doesn't cut internet access for the others.
• BIncorrect. Extra IPv4 addresses on a NAT gateway raise the limit on simultaneous connections to each destination. They don't move the NAT gateway out of AZ-1 or protect it from an outage in that AZ.
• CIncorrect. Both NAT gateways would be in AZ-1. An outage in that AZ would still take away internet access for resources in every AZ.
• DIncorrect. You can't associate a security group with a NAT gateway. Traffic filtering also does nothing about the gateway depending on a single AZ.

Answer: A) Register the transit gateways in a global network and use the AWS Network Manager dashboards

Registering transit gateways in a global network gives the AWS Network Manager dashboards: geography, topology tree, VPN and Connect peer status, events, and monitoring across Regions and accounts.

• ACorrect. AWS Global Networks for Transit Gateways, viewed through the AWS Network Manager console, centrally manages transit gateway networks across accounts, Regions, and on-premises locations. Its dashboards include a geography map (VPN, Direct Connect, Connect peers, sites, devices), a topology tree, VPN and Connect peer status, events, and CloudWatch traffic metrics.
• BIncorrect. Reachability Analyzer checks whether a path exists between a specific source and destination. It doesn't provide an ongoing map, topology, or health dashboard for the whole network.
• CIncorrect. Flow logs record IP traffic for analysis. They don't give a visual topology or geographic view of transit gateways, Direct Connect, and SD-WAN connections.
• DIncorrect. AWS Config tracks resource configurations and compliance. It doesn't draw a network topology or show VPN and Connect peer status alongside traffic metrics.

Answer: A) Create an egress-only internet gateway and add a ::/0 route to it in the subnet's route table

For outbound-only IPv6 access to the internet, route ::/0 to an egress-only internet gateway. It is stateful and blocks connections started from the internet. NAT gateways with NAT64 only translate IPv6 traffic to IPv4 destinations.

• ACorrect. An egress-only internet gateway is a stateful, IPv6-only VPC component. It allows outbound IPv6 traffic from instances to the internet and sends responses back, but it prevents the internet from starting IPv6 connections to the instances. You use it by adding a ::/0 route that points to it.
• BIncorrect. NAT64 with DNS64 translates IPv6 traffic to IPv4 so that IPv6-only workloads can reach IPv4-only services. It does not provide a path from IPv6 to IPv6 destinations. The AWS walkthrough still routes ::/0 to an egress-only internet gateway or an internet gateway for native IPv6 traffic.
• CIncorrect. IPv6 addresses are public. AWS notes that pointing ::/0 to an internet gateway allows external IPv6 hosts to start connections to the instances, so this path does not block inbound connections.
• DIncorrect. Gateway VPC endpoints give private access only to supported AWS services (Amazon S3 and DynamoDB). They do not provide general outbound access to third-party APIs on the internet.

Answer: A) Its main route table sends 0.0.0.0/0 to an attached internet gateway, and its default subnets give public IPv4 addresses to instances at launch.

A default VPC uses 172.31.0.0/16. It has a public /20 default subnet in each AZ and an attached internet gateway, and its main route table sends 0.0.0.0/0 to that gateway. If you delete it, you can create a new default VPC yourself.

• ACorrect. AWS creates an internet gateway, attaches it to the default VPC, and adds a 0.0.0.0/0 route to the internet gateway in the main route table. Default subnets are public subnets, and MapPublicIpOnLaunch is true, so instances get public IPv4 addresses.
• BIncorrect. The default VPC uses 172.31.0.0/16. It doesn't include NAT gateways. Its subnets are public and route through an internet gateway.
• CIncorrect. If you delete the default VPC, you can create a new one yourself with the console's Create Default VPC action or the create-default-vpc command. You can't restore the original VPC that you deleted.
• DIncorrect. AWS creates a /20 default subnet in every Availability Zone in the Region, not one /24 subnet in a single zone.

Answer: A) Turn on the deletion protection attribute on the ALB

ALB deletion protection blocks every DeleteLoadBalancer attempt until the attribute is turned off. CloudFormation stack termination protection and DeletionPolicy only control CloudFormation stack operations, and EC2 termination protection only protects the instances.

• ACorrect. Deletion protection is an ALB attribute (deletion_protection.enabled). When it is on, the load balancer can't be deleted until the attribute is turned off. This applies no matter how the delete call is made, so even a user with DeleteLoadBalancer permission must first take a deliberate step.
• BIncorrect. Stack termination protection only makes attempts to delete the stack fail. It doesn't stop a user from deleting the ALB directly in the EC2 console or through the Elastic Load Balancing API.
• CIncorrect. DeletionPolicy controls what CloudFormation does with the resource when the stack is deleted or the resource is removed from the template. Retain keeps the ALB in those cases. It doesn't stop anyone from deleting the ALB directly outside CloudFormation.
• DIncorrect. EC2 termination protection stops the registered target instances from being terminated. It has no effect on whether the load balancer can be deleted.

Answer: A) Rules are checked from the lowest rule number upward, and the first rule that matches the packet is applied.

Network ACL rules are evaluated in ascending rule-number order, and the first matching rule is applied regardless of any conflicting higher-numbered rule.

• ACorrect. Network ACL rules are evaluated starting with the lowest-numbered rule. As soon as a rule matches, it is applied, even if a higher-numbered rule would say otherwise. For this reason, a deny rule for specific ports must have a lower number than a broader allow rule.
• BIncorrect. This is how IAM policies are evaluated, where an explicit deny overrides an allow. Network ACLs apply the first matching rule by rule number. If an allow rule with a lower number matches first, the packet is allowed.
• CIncorrect. Evaluation starts at the lowest rule number, not the highest. Reversing the order would change which of two conflicting rules takes effect.
• DIncorrect. This describes security groups, which contain only allow rules and check all of them. Network ACLs can contain deny rules and apply only the first matching rule by rule number.

Answer: A) An HTTPS listener forwarding to an instance target group with protocol version gRPC and a health check path in /package.service/method format

An ALB supports gRPC when the target group uses the gRPC protocol version. That needs an HTTPS listener, instance or IP targets, and a custom health check in /package.service/method format with gRPC success codes.

• ACorrect. With the gRPC protocol version, HTTPS is the only supported listener protocol and forward is the only supported rule action. Targets must be instances or IP addresses. You must give a custom health check method in /package.service/method format, along with gRPC success codes.
• BIncorrect. With the gRPC protocol version, the only supported listener protocol is HTTPS, so an HTTP listener can't be used.
• CIncorrect. A gRPC request sent to a target group with the HTTP/1.1 protocol version results in an error. The target group must use the gRPC protocol version (or HTTP/2 if the targets support gRPC).
• DIncorrect. With the gRPC protocol version, the only supported target types are instance and ip. Lambda functions can't be used as targets.

Answer: A) Turn on the access logs attribute for the ALB and specify an S3 bucket that has a bucket policy allowing log delivery

ALB access logs, which are off by default, store one entry per request in S3, including the client IP, request line and processing times. CloudTrail, VPC Flow Logs and CloudWatch metrics don't provide HTTP request-level records.

• ACorrect. ALB access logs are off by default. Once you turn them on, Elastic Load Balancing writes compressed log files to the S3 bucket you specify. Each entry describes one request, including client:port, the request line (method and URL), and the request, target and response processing times. Athena can query these files directly.
• BIncorrect. CloudTrail records API calls made to the Elastic Load Balancing service, such as changes to listeners or attributes. It doesn't record the HTTP requests that clients send through the load balancer.
• CIncorrect. Flow logs capture IP traffic metadata such as source and destination addresses, ports, protocol, packets and bytes. They don't include HTTP details such as the request URL or the load balancer's processing times.
• DIncorrect. CloudWatch metrics are aggregated statistics over a time period. They don't contain one record per request, so they can't show which client requested which URL.