AWS SAA: Network Exam Questions
Verified Marking Scheme Current
Update (A Pass)
Min & Max VPC subnetting - Answers -min: /28
max: /16
AWS PrivateLink usecase? - Answers -AWS PrivateLink (which is also known as VPC Endpoint) is just a
highly available, scalable technology that enables you to privately connect your VPC to the AWS services
as if they were in your VPC
Can NLB be used as an AWS Global Accelerator endpoint? - Answers -Yes.
What is EFA in networking? - Answers -it is similar to ENI (Elastic Network Interface) but for high level of
inter-node communications (HPC: High power computing)
Is VPC Peering transitive? - Answers -No. Also, the route tables must be updated in each EC2.
Does VPC Peering allows cross account? - Answers -Yes. Can reference others Security group.
Personal Preference for VPC range: - Answers -10.x.y.z
Which CIDR Range to avoid that can clash with other AWS Services? - Answers -172.17.0.0/16
Cloud9 works on it.
What is Match Viewer Origin Policy in CloudFront? - Answers -Match Viewer is an Origin Protocol Policy
that configures CloudFront to communicate with your origin using HTTP or HTTPS, depending on the
protocol of the viewer request. CloudFront caches the object only once even if viewers make requests
using both HTTP and HTTPS protocols.
Is VPC Regional? - Answers -Yes.
What is the DNS Address inside a VPC? - Answers -Base IP + 2
Can CloudFront functions modify origin requests/responses? - Answers -No. They can only modify viewer
response/request. For both, use Lambda@Edge.
Lambda connects to VPC using? - Answers -ENI
CloudFront lang vs Lambda@Edge lang? - Answers -CF: Javascript
Lambda@Edge: Node js & python
Can ELB span regions? - Answers -No. Only in a region.
Command to give instances DNS Names - Answers -enableDnsHostnames
The load balancer uses which certificate? - Answers -X.509 (SSL/TLS cert)
We pay ALB for what? - Answers -Cross-AZ transfer.
, NLB: pay-what-you-use
CLB: same as ALB
Command to enable DNS resolution in VPC - Answers -enableDnsSupport
How many IP's should you reserved in VPC? - Answers -5
Base (network add)
Base+1 (VPC Router)
Base+2 (Reserved DNS)
Base+3 (for future use)
Broadcast add (last one)
Can Network ACL is used to control inbound and outbound traffic at the listener level on ALB? - Answers
-No. Network ACL is used to control inbound and outbound traffic at the subnet level only.
Every VPC has a VPC router. - Answers -<NIL>
How many IGW can a VPC have? - Answers -0 or 1
Can IGW run from a private zone? - Answers -No. Only from AWS Public Zone.
IGW for outbound only IPv6 connections? - Answers -egress-only IGW
Which services dont require VPC? - Answers -- S3
- Lambda
- DynamoDB
Can NLB have ALB as its target group? - Answers -Yes.
GLB works on which network layer? - Answers -Layer 3 - IP (network layer)
Use GENEVE protocol port no? - Answers -6081
NLB supports Private or Public IPs? - Answers -Private only. ALB supports both.
Can we attach EIP to Virtual Private Gateway (VPG: Site-to-site vpn)? - Answers -No.
Role of Bastion Host/Jumpbox. - Answers -Connections arrive here. The only way IN to a VPC.
NACL are Stateful or Stateless? - Answers -Stateless.
- for crossing subnet boundary.
Explicit Allow and Deny in? - Answers -NACL
No explicit Deny? - Answers -NACL
Security Groups are stateful or stateless? - Answers -Stateful
- attached to ENI
Implicit Deny or Allow? - Answers -SG
cannot block specific bad actors.
An allow rule cannot be overriden in SG or NACL? - Answers -SG
Verified Marking Scheme Current
Update (A Pass)
Min & Max VPC subnetting - Answers -min: /28
max: /16
AWS PrivateLink usecase? - Answers -AWS PrivateLink (which is also known as VPC Endpoint) is just a
highly available, scalable technology that enables you to privately connect your VPC to the AWS services
as if they were in your VPC
Can NLB be used as an AWS Global Accelerator endpoint? - Answers -Yes.
What is EFA in networking? - Answers -it is similar to ENI (Elastic Network Interface) but for high level of
inter-node communications (HPC: High power computing)
Is VPC Peering transitive? - Answers -No. Also, the route tables must be updated in each EC2.
Does VPC Peering allows cross account? - Answers -Yes. Can reference others Security group.
Personal Preference for VPC range: - Answers -10.x.y.z
Which CIDR Range to avoid that can clash with other AWS Services? - Answers -172.17.0.0/16
Cloud9 works on it.
What is Match Viewer Origin Policy in CloudFront? - Answers -Match Viewer is an Origin Protocol Policy
that configures CloudFront to communicate with your origin using HTTP or HTTPS, depending on the
protocol of the viewer request. CloudFront caches the object only once even if viewers make requests
using both HTTP and HTTPS protocols.
Is VPC Regional? - Answers -Yes.
What is the DNS Address inside a VPC? - Answers -Base IP + 2
Can CloudFront functions modify origin requests/responses? - Answers -No. They can only modify viewer
response/request. For both, use Lambda@Edge.
Lambda connects to VPC using? - Answers -ENI
CloudFront lang vs Lambda@Edge lang? - Answers -CF: Javascript
Lambda@Edge: Node js & python
Can ELB span regions? - Answers -No. Only in a region.
Command to give instances DNS Names - Answers -enableDnsHostnames
The load balancer uses which certificate? - Answers -X.509 (SSL/TLS cert)
We pay ALB for what? - Answers -Cross-AZ transfer.
, NLB: pay-what-you-use
CLB: same as ALB
Command to enable DNS resolution in VPC - Answers -enableDnsSupport
How many IP's should you reserved in VPC? - Answers -5
Base (network add)
Base+1 (VPC Router)
Base+2 (Reserved DNS)
Base+3 (for future use)
Broadcast add (last one)
Can Network ACL is used to control inbound and outbound traffic at the listener level on ALB? - Answers
-No. Network ACL is used to control inbound and outbound traffic at the subnet level only.
Every VPC has a VPC router. - Answers -<NIL>
How many IGW can a VPC have? - Answers -0 or 1
Can IGW run from a private zone? - Answers -No. Only from AWS Public Zone.
IGW for outbound only IPv6 connections? - Answers -egress-only IGW
Which services dont require VPC? - Answers -- S3
- Lambda
- DynamoDB
Can NLB have ALB as its target group? - Answers -Yes.
GLB works on which network layer? - Answers -Layer 3 - IP (network layer)
Use GENEVE protocol port no? - Answers -6081
NLB supports Private or Public IPs? - Answers -Private only. ALB supports both.
Can we attach EIP to Virtual Private Gateway (VPG: Site-to-site vpn)? - Answers -No.
Role of Bastion Host/Jumpbox. - Answers -Connections arrive here. The only way IN to a VPC.
NACL are Stateful or Stateless? - Answers -Stateless.
- for crossing subnet boundary.
Explicit Allow and Deny in? - Answers -NACL
No explicit Deny? - Answers -NACL
Security Groups are stateful or stateless? - Answers -Stateful
- attached to ENI
Implicit Deny or Allow? - Answers -SG
cannot block specific bad actors.
An allow rule cannot be overriden in SG or NACL? - Answers -SG
