AWS Networking Specialty flashcards
AWS Networking Specialty · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- VPC peering transitivity
- VPC peering is non-transitive: if VPC A peers with B and B peers with C, A cannot reach C through B. Use Transit Gateway for transitive routing.
- Transit Gateway
- A regional hub that connects VPCs, VPNs, and Direct Connect gateways with transitive routing. It supports thousands of attachments and per-attachment route tables.
- Direct Connect gateway
- A global gateway that lets one private virtual interface reach VPCs in multiple regions within the same AWS partition, avoiding multiple DX connections.
- Longest prefix match
- Route selection prefers the most specific route. A /24 route wins over a /16 route when both match the destination address, regardless of route type.
- Subnet reserved addresses
- Each subnet reserves five addresses: network address, VPC router, DNS resolver, future use, and broadcast. A /28 subnet therefore has 11 usable addresses.
- VPC CIDR limits
- A VPC CIDR block must be between /16 and /28. Subnets must be at least /28 and must fall entirely within the VPC CIDR range.
- PrivateLink
- Interface VPC endpoints expose a service privately through ENIs. PrivateLink allows access without CIDR overlap or VPC peering and keeps traffic on the AWS network.
- NAT gateway
- A managed NAT service in a public subnet that allows private subnet outbound internet access. It supports about 55,000 simultaneous connections per destination.
- Security group statefulness
- Security groups are stateful and allow-only. Return traffic for an allowed connection is automatically permitted, and no explicit deny rules exist.
- Network ACL evaluation
- NACLs are stateless and evaluated in numbered order, lowest first, with an implicit deny at the end. Inbound and outbound rules are evaluated independently.
- Gateway VPC endpoint
- A gateway endpoint for S3 or DynamoDB uses a route table prefix list. It does not use an ENI and does not support access from on-premises networks.
- Route 53 Resolver inbound endpoint
- An inbound endpoint creates ENIs that let on-premises DNS servers query Route 53 Resolver for AWS-hosted names, enabling hybrid DNS resolution.
- Transit Gateway Connect
- A TGW attachment that uses GRE and BGP to connect SD-WAN appliances. It avoids separate VPN tunnels and supports higher bandwidth than Site-to-Site VPN.
- NLB cross-zone balancing
- Network Load Balancer cross-zone load balancing is disabled by default. Enabling it distributes traffic across all registered targets in all enabled Availability Zones.
- Route 53 alias record
- An alias record points to an AWS resource such as CloudFront or ALB. It can be used at the zone apex and incurs no charge for queries.
- VPC Flow Logs
- Flow logs capture IP traffic metadata at VPC, subnet, or ENI level. They record ACCEPT and REJECT actions but not packet payloads or DNS names.
- Reachability Analyzer
- A tool that tests whether a path exists between a source and destination without sending traffic. It reports the blocking component, such as a route or security group.
- NAT gateway port exhaustion
- The ErrorPortAllocation metric rises when a NAT gateway runs out of ports. Adding NAT gateways or reducing connection churn resolves the issue.
- Network Firewall
- A managed stateful firewall with Suricata-compatible rules, domain lists, and IDS/IPS. It is deployed per Availability Zone in dedicated firewall subnets.
- Traffic Mirroring
- A feature that copies ENI traffic to a target for inspection. It does not block traffic and adds no inline latency to the original path.
- Transit Gateway Network Manager
- A service that visualizes global network topology across TGW, DX gateways, and VPN attachments and reports route and tunnel events.
- Flow log NODATA record
- A NODATA record appears when no traffic matches the flow log during the aggregation interval. SKIPDATA appears when records are dropped due to capacity.
- CloudWatch Network Monitor
- A feature that measures packet loss and latency from source subnets to specified destinations, helping detect degraded hybrid or internet paths.
- Shield Advanced
- A paid DDoS protection tier that adds enhanced detection, cost protection, 24/7 DDoS Response Team access, and WAF integration beyond Shield Standard.
- AWS WAF rate-based rule
- A rule that counts requests from a single IP over a five-minute window and blocks or challenges the source when the threshold is exceeded.
- Direct Connect MACsec
- MACsec provides layer 2 encryption on supported Direct Connect links. Direct Connect traffic is otherwise unencrypted, so use a VPN over DX for IPsec.
- VPC endpoint policy
- A resource policy on an interface or gateway endpoint that restricts which principals, resources, and source VPCs can use the endpoint.
- Security group referencing
- A rule can use another security group as its source, allowing traffic only from resources in that group instead of a broad CIDR range.
- AWS Firewall Manager
- A central service that deploys WAF rules, Shield Advanced protections, and security group policies across accounts in an AWS Organization.
- Config conformance pack
- A collection of AWS Config managed and custom rules that evaluates resources against a compliance framework and reports aggregated compliance status.
- Service control policy
- An organization policy that sets the maximum permissions for accounts. It can deny creating internet gateways or public subnets in selected accounts.
- GuardDuty network findings
- GuardDuty detects threats using VPC Flow Logs, DNS logs, and CloudTrail. Findings such as SSH brute force do not require packet capture agents.