Which AWS service provides a logically isolated section of the AWS Cloud in which a customer can launch resources into a virtual network that they define, including their own IP address range, subnets, and route tables?
Easy · Choose one
Explanation
Answer: B. Amazon VPC lets you provision a logically isolated virtual network in AWS. You control the IP address range (CIDR block), create subnets across Availability Zones, and configure route tables, internet gateways, NAT gateways, security groups, and network ACLs, closely mirroring a traditional on-premises network.
A. AWS Direct Connect provides a dedicated private network connection from a data center into AWS. It connects to a VPC; it is not the virtual network itself.
C. AWS Transit Gateway is a network hub that interconnects VPCs and on-premises networks. It joins networks together rather than providing the isolated network itself.
D. Amazon Route 53 is a DNS and domain registration service. It resolves names to addresses and does not define a network.
62
Which AWS service is a highly available and scalable Domain Name System (DNS) web service that can also be used to register domain names?
Easy · Choose one
Explanation
Answer: C. Amazon Route 53 is AWS's DNS web service. It translates human-readable domain names into IP addresses, supports domain registration and transfer, offers health checks, and provides several routing policies for directing users to the appropriate endpoint.
A. Elastic Load Balancing distributes traffic to targets within a Region. It is given a DNS name by AWS but is not a DNS service.
B. Amazon CloudFront is a content delivery network. It uses DNS to route users to edge locations but does not itself host DNS zones or register domains.
D. AWS Certificate Manager provisions and manages SSL/TLS certificates. It validates domain ownership but does not provide DNS hosting or registration.
63
Which AWS service is a global content delivery network that securely delivers data, videos, applications, and APIs to users with low latency by caching copies at edge locations?
Easy · Choose one
Explanation
Answer: C. Amazon CloudFront is AWS's content delivery network (CDN). It caches content at a worldwide network of edge locations so that requests are served from a nearby edge instead of the origin, which lowers latency for viewers and reduces load and data transfer cost at the origin.
A. Amazon API Gateway creates, publishes, and secures APIs. It is not a general content delivery network.
B. AWS Global Accelerator improves availability and performance by routing traffic over the AWS global network to Regional endpoints using static anycast IP addresses. It does not cache content.
D. S3 Transfer Acceleration speeds up uploads into a single S3 bucket over long distances by using edge locations. It accelerates transfers into S3 rather than delivering content broadly to end users.
64
Which Amazon VPC component must be attached to a VPC and referenced in a route table so that resources in a public subnet can send and receive traffic over the internet?
Easy · Choose one
Explanation
Answer: B. An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between resources in the VPC and the internet. A subnet becomes public when its route table sends 0.0.0.0/0 traffic to the internet gateway and the resources have public IP addresses.
A. A virtual private gateway is the AWS-side VPN endpoint for a Site-to-Site VPN connection to an on-premises network, not for general internet access.
C. A NAT gateway allows instances in private subnets to initiate outbound connections to the internet, but it does not allow inbound connections from the internet, and it still relies on an internet gateway to reach the internet.
D. A VPC endpoint provides private connectivity to supported AWS services without traversing the internet, which is the opposite of what is being asked.
65
Which statement accurately describes an Amazon VPC security group?
Intermediate · Choose one
Explanation
Answer: B. A security group acts as a virtual firewall attached to an elastic network interface, so it protects individual resources such as EC2 instances. It is stateful, which means that if inbound traffic is allowed, the corresponding response traffic is automatically permitted regardless of outbound rules. Security groups contain only allow rules; anything not explicitly allowed is implicitly denied.
A. Security groups are stateful, so return traffic is allowed automatically and no explicit return rule is needed.
C. Security groups do not operate at the subnet level, and all rules are evaluated together rather than in numbered order. Rule numbering is a network ACL characteristic.
D. That describes a network ACL, which is the stateless, subnet-level control that supports both allow and deny rules.