1. Home
2. All questions
3. Networking

AWS Certified Solutions Architect study material: Networking

90 questions of the 500 in the AWS Certified Solutions Architect – Associate quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 5. A VPC interface endpoint is created without an endpoint policy attached. What access does it permit?
2. 26. An instance's security group allows outbound HTTPS but has no inbound rule for the returning traffic. Can the instance receive the response?
3. 27. Which two statements correctly describe network ACLs in a VPC? Choose two.
4. 36. A workload in a private subnet must call an AWS service without any traffic reaching an internet gateway. Which approach meets the requirement?
5. 50. Which open source intrusion prevention system provides stateful inspection in AWS Network Firewall?
6. 66. How is traffic protected on an inter-Region VPC peering connection?
7. 67. Which protocol does AWS Site-to-Site VPN use to secure the connection between an on-premises network and a VPC?
8. 69. A subnet must be reachable only from other resources in the same VPC, with no route anywhere else. What is this called?
9. 97. A security group is created in one VPC and must also protect resources in another VPC in the same Region. What makes that possible?
10. 98. Which naming rule applies to a security group?
11. 116. Which two kinds of traffic can AWS Network Firewall inspect? Choose two.
12. 117. Which two controls can AWS Network Firewall apply to outbound VPC traffic? Choose two.
13. 141. What does an inbound security group rule specify?
14. 169. How does CloudFront origin failover differ from a Region-level failover?
15. 211. Which two things can a Route 53 health check monitor? Choose two.
16. 212. Which Route 53 routing policy arranges active-passive failover between a primary resource and a standby?
17. 213. How many healthy records does a Route 53 multivalue answer routing policy return?
18. 214. How does an operator learn immediately that a Route 53 health check has changed status?
19. 215. Which two endpoint types can sit behind a standard AWS Global Accelerator? Choose two.
20. 216. A team disables a Global Accelerator to save cost and later deletes it. What happens to its static IP addresses?
21. 217. Why does a VPC peering connection introduce no single point of failure?
22. 218. How many tunnels does a single AWS Site-to-Site VPN connection provide?
23. 226. Which Elastic Load Balancing component decides how a request reaches the registered targets?
24. 227. Which two statements about Application Load Balancer listener rules are correct? Choose two.
25. 228. At what level are Elastic Load Balancing health checks configured?
26. 229. A Network Load Balancer has two Availability Zones enabled but traffic is uneven because one zone holds fewer targets. What setting evens it out?
27. 230. What does enabling an Availability Zone on a load balancer create?
28. 231. A target must receive traffic from two different applications with different health requirements. What makes this possible?
29. 237. Besides lowering latency, what does caching objects at many CloudFront edge locations achieve?
30. 238. How quickly does Global Accelerator react to an endpoint becoming unhealthy?
31. 265. Why is changing Route 53 weighted routing weights a weaker failover mechanism than routing controls?
32. 266. Adjusting Global Accelerator traffic dials to shift traffic during a failover has which characteristic?
33. 336. What is a VPC?
34. 337. Can a subnet span two Availability Zones?
35. 338. Which two components does a default VPC provide that a newly created VPC does not? Choose two.
36. 339. An EC2 instance is launched into a nondefault subnet with no public IPv4 address assigned. What connectivity does it have?
37. 340. A subnet is created but never explicitly associated with a route table. Which table governs its traffic?
38. 341. Which two elements make up a route in a VPC route table? Choose two.
39. 342. A private NAT gateway's route is pointed at the VPC's internet gateway. What happens to that traffic?
40. 343. Which two statements about a public NAT gateway are correct? Choose two.
41. 344. Which device provides outbound-only internet access for instances using IPv6?
42. 345. From where must a connection through a NAT gateway be initiated?
43. 346. At which OSI layer does an Application Load Balancer operate?
44. 347. Which two protocols can a Network Load Balancer target group use? Choose two.
45. 348. Which Route 53 routing policy sends users to the AWS Region that answers them fastest?
46. 349. How does geoproximity routing differ from geolocation routing in Route 53?
47. 350. Which Route 53 routing policy uses the IP addresses that traffic originates from?
48. 351. Which two attachments can be made to an AWS Transit Gateway? Choose two.
49. 352. Two VPCs in different AWS Regions are peered. How do resources in them communicate?
50. 353. Which Direct Connect virtual interface type reaches a customer's own VPC?
51. 354. Which two requirements must a customer network meet to use Direct Connect? Choose two.
52. 355. A single Direct Connect connection is established in a public Region. Which AWS services can it reach?
53. 356. What must be true of a subnet for it to be called a public subnet?
54. 357. Which two subnet types have no route to an internet gateway? Choose two.
55. 358. A VPC has an IPv6 CIDR block and instances with IPv6 addresses, but IPv6 traffic is not leaving the VPC. What is the likely cause?
56. 359. What addresses do resources in an IPv6-only subnet receive for reaching services available only inside the VPC?
57. 360. What must a VPC carry before a dual-stack subnet can be created in it?
58. 361. How many network ACLs can a subnet be associated with at one time?
59. 362. Traffic goes from a private subnet through a NAT gateway to a public AWS service endpoint. Where does that traffic travel?
60. 363. How does a NAT gateway handle the source address of an instance's outbound packet?
61. 364. Which two things does a private NAT gateway differ on compared with a public one? Choose two.
62. 365. What is a CloudFront distribution?
63. 366. Which two can serve as a CloudFront origin? Choose two.
64. 367. What are CloudFront edge locations?
65. 368. Which two advantages does Global Accelerator hold over DNS-based failover? Choose two.
66. 369. How many static IP addresses does Global Accelerator provide for a dual-stack accelerator?
67. 370. Which Global Accelerator type maps particular users to one specific destination among many?
68. 371. A company must keep its existing public IPv4 addresses when adopting Global Accelerator. Is this possible?
69. 372. How does S3 Transfer Acceleration speed up a long-distance upload?
70. 373. Which three functions can Route 53 perform, in any combination?
71. 374. Which Route 53 routing policy suits one web server serving a single site?
72. 375. Which frame sizes does AWS Direct Connect accept at the link layer?
73. 376. Which transceiver does a 100 gigabit Direct Connect connection require?
74. 377. How can public AWS service IPv6 addresses be reached over Direct Connect?
75. 378. Which two routes to a Direct Connect connection does AWS describe? Choose two.
76. 379. How do instances in an AWS Outposts subnet communicate with instances in the parent Region?
77. 380. Which connection does AWS Outposts not allow within the same VPC?
78. 381. A default VPC exists in the Region and an instance is launched without naming a subnet. What happens?
79. 382. What term describes a subnet created inside a VPC that the customer built themselves?
80. 383. Which component lets EC2 instances reach the internet through the Amazon EC2 network edge?
81. 384. Which two things must be in place to give an instance in a nondefault subnet internet access? Choose two.
82. 385. What does a NAT device do for instances in a private subnet?
83. 386. What is the role of a VPC route table?
84. 387. On what basis does a VPC route table choose a target for a packet?
85. 388. What does an IPv4-only subnet mean for the resources inside it?
86. 389. Which step is part of building a VPC?
87. 390. Which AWS service acts as a transit hub joining many VPCs and on-premises networks from one place?
88. 463. How does routing a request across the AWS backbone improve CloudFront performance?
89. 464. A user requests an object that is not cached at the nearest CloudFront edge location. What happens?
90. 489. How is an interface VPC endpoint charged?