Networking and Content Delivery practice questions

Answer: A) Change the distribution's price class to Price Class 100

Price classes limit which edge locations CloudFront uses to lower cost, and viewers in excluded regions are still served from the nearest included location. Geographic restrictions block viewers outright, so they do not meet the access requirement.

• ACorrect. Price Class 100 uses only edge locations in the USA, Canada, Europe and Israel, the lowest-cost set of edge locations. Viewers outside those areas are still served, from the lowest-latency edge location within the price class, so they may see slower performance but keep access.
• BIncorrect. Price Class 200 adds many higher-cost locations, such as Japan, Singapore, India, South Africa and the Middle East, on top of Price Class 100. It saves less than Price Class 100 does, so it is not the largest reduction.
• CIncorrect. A geographic allow list makes CloudFront return HTTP 403 to viewers in countries that are not on the list. Viewers in Asia and South America would be blocked, which breaks the requirement that they can still get the content.
• DIncorrect. A block list denies access to viewers in the listed countries, which breaks the access requirement. Keeping Price Class All also leaves every edge location in use, so it does not reduce cost.

Answer: A) Gateway Load Balancer, with a Gateway Load Balancer endpoint as the route table next hop

Gateway Load Balancers exist to deploy and scale inline virtual appliances such as firewalls and IDS/IPS. They use GENEVE and Gateway Load Balancer endpoints that you set as next hops in route tables. ALB, NLB, and CLB send traffic to targets as the final destination.

• ACorrect. A Gateway Load Balancer works at Layer 3 and listens for all IP packets on all ports. It exchanges traffic with the registered appliances using GENEVE on port 6081 and keeps flow stickiness. Route tables send traffic to a Gateway Load Balancer endpoint, so the appliances sit inline without changing the traffic's destination.
• BIncorrect. A Network Load Balancer is a Layer 4 load balancer that ends traffic at its own listeners and sends it to targets as the final destination. It can't act as a transparent bump-in-the-wire that returns inspected traffic to its original path.
• CIncorrect. An Application Load Balancer routes HTTP/HTTPS requests at Layer 7 to application targets. It doesn't handle all IP traffic, and it can't insert appliances transparently into the network path.
• DIncorrect. A Classic Load Balancer is the previous-generation load balancer for sending traffic to backend instances. It can't act as a transparent gateway that inspects traffic and then forwards it on to its intended destination.

Answer: A) Create a link aggregation group (LAG) that contains the four dedicated connections

A Direct Connect LAG uses LACP to bundle dedicated connections of the same bandwidth at the same endpoint into one active/active managed connection, so a single set of virtual interfaces uses the combined capacity.

• ACorrect. A LAG uses LACP to combine several dedicated connections at a single Direct Connect endpoint into one managed connection. The connections run active/active, and configuration applies to the whole group. The four connections meet the LAG rules: they are dedicated, have the same bandwidth, terminate at the same endpoint, and stay within the limit of four connections below 100 Gbps.
• BIncorrect. A Direct Connect gateway connects virtual interfaces to virtual private gateways or transit gateways, including across Regions. It does not combine physical connections into one logical connection, so each connection would still need its own virtual interfaces.
• CIncorrect. ECMP over a transit gateway spreads traffic across several VPN tunnels. It does not combine dedicated Direct Connect connections into a single managed connection with one set of virtual interfaces.
• DIncorrect. SiteLink sends traffic between Direct Connect locations over the AWS network without going through a Region. It does not bundle several physical connections at one endpoint into a single logical connection.

Answer: A) AWS Direct Connect, with a private virtual interface to the VPC

AWS Direct Connect provides a private connection that bypasses internet service providers. A company can set it up through its own colocation or through an APN Direct Connect partner. VPN options, including accelerated VPN and Client VPN, still send traffic over the internet.

• ACorrect. Direct Connect links the company's network to a Direct Connect location over Ethernet fiber, bypassing internet service providers. A company can do this through its own colocation or through an APN Direct Connect partner. A private virtual interface gives access to the VPC.
• BIncorrect. An accelerated VPN uses AWS Global Accelerator to send traffic to the nearest AWS edge location, which improves the network path. Traffic from the customer gateway to that edge location still crosses the internet. It is not a private circuit that bypasses internet providers.
• CIncorrect. Client VPN is a managed, client-based VPN. Users connect with OpenVPN-based clients over the internet. It does not provide a private circuit between networks.
• DIncorrect. Adding another Site-to-Site VPN connection still sends encrypted traffic over the public internet. It does not give the consistent performance of a dedicated private connection.

Answer: A) Associate an AWS WAF web ACL that has SQL injection and XSS match rules with the ALB

AWS WAF is the AWS service that inspects HTTP(S) request content for an ALB. Its SQL injection and XSS match statements can block these attacks before the requests reach the targets.

• ACorrect. AWS WAF can protect an Application Load Balancer and inspects components of each HTTP(S) request, such as the query string or body. SQL injection and cross-site scripting attack match statements detect malicious SQL code and scripts, and matching requests can be blocked.
• BIncorrect. Shield Advanced focuses on DDoS detection and mitigation. Blocking SQL injection and XSS patterns in request content requires AWS WAF rule statements.
• CIncorrect. Network ACLs are stateless subnet-level filters that match on protocol, port, and CIDR range. They can't inspect HTTP query strings or bodies, and the attackers' IP addresses keep changing.
• DIncorrect. GuardDuty detects threats and produces findings, but it doesn't inspect or block individual HTTP requests going to an ALB.

Answer: A) Create a NAT gateway in a public subnet in each AZ, and give each AZ's private subnets a route table that points 0.0.0.0/0 to the NAT gateway in the same AZ

A zonal NAT gateway lives in one AZ, so a shared gateway is a single point of failure for every AZ that uses it. Put a NAT gateway in each AZ and route each AZ's private subnets to their local gateway.

• ACorrect. Each zonal NAT gateway is created in one AZ and has redundancy only inside that zone. AWS recommends creating a NAT gateway in each AZ and routing resources to the NAT gateway in their own AZ, so one AZ failure doesn't cut internet access for the others.
• BIncorrect. Extra IPv4 addresses on a NAT gateway raise the limit on simultaneous connections to each destination. They don't move the NAT gateway out of AZ-1 or protect it from an outage in that AZ.
• CIncorrect. Both NAT gateways would be in AZ-1. An outage in that AZ would still take away internet access for resources in every AZ.
• DIncorrect. You can't associate a security group with a NAT gateway. Traffic filtering also does nothing about the gateway depending on a single AZ.

Answer: A) A subnet whose route table sends 0.0.0.0/0 to an internet gateway attached to the VPC

A subnet's type depends on its routing. Only a subnet with a direct route to an internet gateway is public, and only there can instances with public IPs reach the internet directly. Routes to a NAT gateway, a virtual private gateway, or only the local route make the subnet private, VPN-only, or isolated.

• ACorrect. A subnet with a direct route to an internet gateway is a public subnet. Instances in it that have public IPv4 addresses can talk directly with the internet.
• BIncorrect. This is a private subnet. Outbound traffic goes through the NAT gateway and uses the NAT gateway's Elastic IP address, not the instances' own public IPs. The internet also cannot start connections to these instances through the NAT gateway.
• CIncorrect. This is a VPN-only subnet. Its default route leads to the on-premises network through the VPN, not to an internet gateway, so it has no direct path to the internet.
• DIncorrect. This is an isolated subnet. With no routes to destinations outside the VPC, its resources can only communicate with other resources in the same VPC, even if they have public IPs.

Answer: A) Weighted routing, with a record for each ALB and relative values that are adjusted over time

Weighted routing is the Route 53 policy that splits traffic across resources in proportions you specify, which makes it the right choice for canary rollouts. Latency, failover and multivalue answer routing have no proportional traffic control.

• ACorrect. Weighted routing sends traffic to multiple resources in proportions you set. Giving the new ALB's record a weight of 10 and the stable ALB's record a weight of 90 sends about 10% of queries to the new version. The engineer can then change the weights to shift traffic gradually.
• BIncorrect. Latency routing is for resources in multiple AWS Regions and sends users to the Region with the best latency. Both ALBs are in the same Region, and latency routing has no way to set a fixed share of traffic.
• CIncorrect. Failover routing is for active-passive setups. Route 53 sends all traffic to the primary and uses the secondary only when the primary is unhealthy, so it can't split traffic by percentage.
• DIncorrect. Multivalue answer routing returns up to eight healthy records chosen at random. The engineer has no control over what share of traffic each record gets, so it can't support a controlled canary rollout.

Answer: A) Allocate an Elastic IP address and associate it with the instance

Auto-assigned public IPv4 addresses are released when an instance is stopped or hibernated. An Elastic IP address stays allocated to the account, so it is a persistent public IPv4 address that can also be moved to another instance for failover.

• ACorrect. An Elastic IP address is a static public IPv4 address that belongs to the account until it is released, so it doesn't change when the instance is stopped and started. It can also be disassociated and associated with another instance to hide an instance failure.
• BIncorrect. Auto-assigned public IPv4 addresses come from Amazon's pool and are not tied to the account. AWS releases the address when the instance is stopped and assigns a new one when it starts, so the partner's allowlist would break every day.
• CIncorrect. AWS releases an auto-assigned public IP address when the instance is hibernated, just as it does when the instance is stopped. A new address is assigned when the instance starts again.
• DIncorrect. A secondary private IPv4 address does stay with the network interface through stop/start and can be reassigned, but private addresses can't be reached from the internet. The partner can't use it.

Answer: A) Make no change to the internet gateway, because AWS manages it as a horizontally scaled, redundant component

An internet gateway is a managed, horizontally scaled, redundant, and highly available VPC component with no availability risk or bandwidth limit. Only one can be attached per VPC, and there is nothing to resize or duplicate.

• ACorrect. AWS describes an internet gateway as a horizontally scaled, redundant, and highly available VPC component that does not cause availability risks or bandwidth constraints. There is nothing to size or duplicate.
• BIncorrect. Only one internet gateway can be attached to a VPC at a time, and a second one isn't needed because the internet gateway is already redundant and highly available.
• CIncorrect. An internet gateway has no capacity tiers or sizes to choose. It scales horizontally and imposes no bandwidth constraints on traffic.
• DIncorrect. A public NAT gateway gives instances in private subnets outbound-only access, and it sends its traffic to the internet gateway. It can't replace the internet gateway for public subnets, and inbound connections to public resources would no longer work.