Validation Quiz - MODULE 5
This 30-question quiz allows you to validate your knowledge of Amazon VPC before moving on to the practical lab.
Question 1
What does VPC stand for in Amazon VPC?
A) Virtual Private Connection
B) Virtual Private Cloud
C) Virtual Public Cloud
D) Virtual Protected Cluster
See the answer
Answer: B
VPC stands for Virtual Private Cloud. It is a logically isolated virtual network in the AWS cloud, dedicated to your account. You have full control over the network environment: IP address range, subnets, routing tables, and gateways.
Question 2
What is the maximum CIDR range for an AWS VPC?
A) /16 (65,536 addresses)
B) /8 (16 million addresses)
C) /24 (256 addresses)
D) /28 (16 addresses)
See the answer
Answer: A
A VPC can have a primary CIDR range between /16 (65,536 addresses) and /28 (16 addresses). The /16 range is the largest allowed. You can add secondary CIDRs up to 5 blocks per VPC.
Question 3
What is the minimum CIDR range for an AWS VPC?
A) /16
B) /24
C) /28 (16 addresses)
D) /32
See the answer
Answer: C
The minimum range is /28 which provides 16 IP addresses. However, AWS reserves 5 addresses per subnet, so a /28 offers only 11 usable addresses. In practice, larger ranges are recommended.
Question 4
How many IP addresses does AWS reserve in each subnet?
A) 3
B) 5
C) 10
D) 0
See the answer
Answer: B
AWS reserves 5 IP addresses in each subnet: the first (network address), the second (VPC router), the third (AWS DNS), the fourth (future reserved), and the last (broadcast). A /24 thus has 251 usable addresses, not 256.
Question 5
What is a public subnet in AWS?
A) A subnet accessible from the Internet without restriction
B) A subnet whose routing table has a route to an Internet Gateway
C) A subnet without Security Groups
D) A subnet in multiple AZs
See the answer
Answer: B
A subnet is considered public if it has a route in its routing table to an Internet Gateway (0.0.0.0/0 -> igw-xxx). Instances in this subnet can have a public IP and communicate directly with the Internet.
Question 6
What is a private subnet?
A) An encrypted subnet
B) A subnet without a route to an Internet Gateway
C) A subnet with a password
D) A subnet without instances
See the answer
Answer: B
A private subnet does not have a route to an Internet Gateway. Instances cannot be reached directly from the Internet. To access the Internet (updates, APIs), they use a NAT Gateway located in a public subnet.
Question 7
What is an Internet Gateway (IGW)?
A) A firewall
B) A VPC component that enables communication between the VPC and the Internet
C) A DNS server
D) A load balancer
See the answer
Answer: B
The Internet Gateway is a horizontally scalable, redundant, and highly available VPC component that enables bidirectional communication between VPC instances and the Internet. It performs address translation (NAT) for instances with public IPs.
Question 8
How many Internet Gateways can be attached to a VPC?
A) As many as you want
B) Only one
C) One per subnet
D) One per AZ
See the answer
Answer: B
Only one Internet Gateway can be attached to a VPC. The IGW is highly available and scalable by design, so one is sufficient for the entire VPC. There is no bandwidth limit.
Question 9
What is a NAT Gateway?
A) A service that allows private instances to access the Internet without being accessible from the Internet
B) A type of subnet
C) A firewall
D) A DNS service
See the answer
Answer: A
The NAT Gateway allows instances in private subnets to initiate outbound connections to the Internet (for updates, external APIs) while blocking unsolicited inbound connections from the Internet.
Question 10
In what type of subnet should a NAT Gateway be placed?
A) Private subnet
B) Public subnet
C) Any
D) In a separate VPC
See the answer
Answer: B
The NAT Gateway should be placed in a public subnet because it needs a route to the Internet Gateway to forward traffic to the Internet. It requires an Elastic IP to function.
Question 11
What is an Elastic IP?
A) A dynamic IP address
B) A static public IPv4 address allocated to your AWS account
C) A private IP address
D) An IPv6 address
See the answer
Answer: B
An Elastic IP is a static public IPv4 address that you can allocate to your account and associate with an instance or a NAT Gateway. It remains the same until you release it, unlike dynamic public IPs.
Question 12
When is an Elastic IP charged?
A) Never
B) Always
C) When it is not associated with a running instance or a NAT Gateway
D) Only the first month
See the answer
Answer: C
Elastic IPs are free when associated with a running EC2 instance or a NAT Gateway. They are charged when allocated but not associated, or associated with a stopped instance. AWS charges unused IPs to encourage their release.
Question 13
What is a routing table?
A) A list of DNS servers
B) A set of rules that determine where to direct network traffic
C) A list of Security Groups
D) A connection log
See the answer
Answer: B
A routing table contains rules (routes) that determine where to direct outbound traffic from a subnet. Each subnet must be associated with exactly one routing table. A table can be associated with multiple subnets.
Question 14
Which route allows a subnet to access the Internet via an IGW?
A) 0.0.0.0/0 -> local
B) 0.0.0.0/0 -> igw-xxx
C) 10.0.0.0/16 -> igw-xxx
D) 0.0.0.0/0 -> nat-xxx
See the answer
Answer: B
The route 0.0.0.0/0 -> igw-xxx means "all non-local traffic goes to the Internet Gateway". 0.0.0.0/0 represents all IP addresses (Internet). The "local" route is for internal VPC traffic.
Question 15
Which route allows a private subnet to access the Internet via a NAT Gateway?
A) 0.0.0.0/0 -> local
B) 0.0.0.0/0 -> igw-xxx
C) 0.0.0.0/0 -> nat-xxx
D) 10.0.0.0/8 -> nat-xxx
See the answer
Answer: C
For a private subnet, the route 0.0.0.0/0 -> nat-xxx directs Internet traffic to the NAT Gateway. The NAT Gateway then forwards it to the IGW. This allows outbound access without direct inbound access.
Question 16
What is the "local" route in a routing table?
A) A route to localhost
B) An automatic route allowing communication within the VPC
C) A route to the NAT Gateway
D) An optional route
See the answer
Answer: B
The "local" route (e.g., 10.0.0.0/16 -> local) is automatically created and cannot be deleted. It allows VPC resources to communicate with each other. All traffic destined for the VPC's CIDR stays within the VPC.
Question 17
What does CIDR stand for?
A) Cloud Internet Domain Routing
B) Classless Inter-Domain Routing
C) Centralized IP Distribution Registry
D) Cloud Infrastructure Data Resource
See the answer
Answer: B
CIDR stands for Classless Inter-Domain Routing. It is a method of allocating IP addresses and routing that replaces the old class-based system (A, B, C). The CIDR notation (e.g., 10.0.0.0/16) indicates the base address and the number of bits in the mask.
Question 18
How many IP addresses does a /24 block contain?
A) 24
B) 128
C) 256
D) 512
See the answer
Answer: C
A /24 has 32-24=8 bits for hosts, which is 2^8 = 256 addresses. With the 5 addresses reserved by AWS, this gives 251 usable addresses. /24 is a common size for subnets.
Question 19
How many IP addresses does a /16 block contain?
A) 256
B) 1,024
C) 65,536
D) 16,384
See the answer
Answer: C
A /16 has 32-16=16 bits for hosts, which is 2^16 = 65,536 addresses. This is the maximum size for an AWS VPC. A /16 can be subdivided into 256 /24 subnets.
Question 20
Which IP address range is reserved for private networks (RFC 1918)?
A) 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
B) Only 192.168.0.0/16
C) 0.0.0.0/0
D) 8.8.8.0/24
See the answer
Answer: A
The three RFC 1918 ranges for private networks are: 10.0.0.0/8 (10.0.0.0 - 10.255.255.255), 172.16.0.0/12 (172.16.0.0 - 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 - 192.168.255.255). These addresses are not routable on the public Internet.
Question 21
Can a VPC span multiple availability zones?
A) No, a VPC is limited to a single AZ
B) Yes, a VPC can span all AZs in a region
C) Yes, a VPC can span multiple regions
D) No, you need a VPC per AZ
See the answer
Answer: B
A VPC spans all availability zones in a region. However, each subnet is limited to a single AZ. For high availability, create subnets in multiple AZs within the same VPC.
Question 22
Can a subnet span multiple availability zones?
A) Yes
B) No, a subnet is limited to a single AZ
C) Only public subnets
D) Only private subnets
See the answer
Answer: B
A subnet is always limited to a single availability zone. To have resources in multiple AZs, create a subnet in each AZ. This is a best practice for high availability.
Question 23
What is the default VPC?
A) A VPC you must create manually
B) A VPC automatically created by AWS in each region with public subnets
C) A VPC without an Internet Gateway
D) A premium paid VPC
See the answer
Answer: B
AWS automatically creates a default VPC in each region for new accounts. It includes one public subnet per AZ, an attached IGW, a routing table with a route to the IGW, and instances launched in it automatically get a public IP.
Question 24
Can the default VPC be deleted?
A) No, it's impossible
B) Yes, and it can be recreated via the console
C) Yes, but it's irreversible
D) Only via AWS support
See the answer
Answer: B
The default VPC can be deleted. If needed, it can be recreated via the AWS console or CLI with the command aws ec2 create-default-vpc. However, it is often preferable to create custom VPCs for production.
Question 25
Which AWS CLI command creates a VPC?
A) aws vpc create --cidr 10.0.0.0/16
B) aws ec2 create-vpc --cidr-block 10.0.0.0/16
C) aws network create-vpc --cidr 10.0.0.0/16
D) aws ec2 new-vpc --cidr 10.0.0.0/16
See the answer
Answer: B
The command is aws ec2 create-vpc --cidr-block 10.0.0.0/16. VPC resources are managed via EC2 commands in the AWS API. You can add --tag-specifications to name the VPC at creation.
Question 26
Which AWS CLI command creates a subnet?
A) aws ec2 create-subnet --vpc-id vpc-xxx --cidr-block 10.0.1.0/24
B) aws vpc create-subnet --cidr 10.0.1.0/24
C) aws network add-subnet --vpc vpc-xxx
D) aws ec2 new-subnet --vpc vpc-xxx
See the answer
Answer: A
The command is aws ec2 create-subnet --vpc-id vpc-xxx --cidr-block 10.0.1.0/24. You can specify the AZ with --availability-zone. The subnet's CIDR must be a subset of the VPC's CIDR.
Question 27
Why is it recommended to plan CIDR ranges before creating a VPC?
A) For security reasons
B) To avoid overlaps with other VPCs or on-premises networks during future connections
C) Because it's mandatory
D) To reduce costs
See the answer
Answer: B
CIDR planning avoids IP address overlaps that would prevent VPC peering or VPN connections with on-premises networks. Once the VPC is created, the primary CIDR cannot be changed. Plan for future needs.
Question 28
What is VPC Peering?
A) A connection between two VPCs allowing private traffic routing
B) A type of subnet
C) An Internet connection
D) A DNS service
See the answer
Answer: A
VPC Peering is a network connection between two VPCs that allows routing traffic between them using private IP addresses. VPCs can be in the same account, different accounts, or even different regions.
Question 29
Is VPC Peering transitive?
A) Yes, traffic automatically passes between all peered VPCs
B) No, an explicit peering connection must be established between each pair of VPCs
C) Only in the same region
D) Only for public subnets
See the answer
Answer: B
VPC Peering is not transitive. If VPC-A is peered with VPC-B, and VPC-B with VPC-C, traffic cannot transit from VPC-A to VPC-C via VPC-B. A direct peering connection A-C is needed for them to communicate.
Question 30
What is the difference between a Gateway and an Interface VPC endpoint?
A) No difference
B) Gateway is for S3 and DynamoDB (free), Interface is for other services (paid)
C) Interface is faster
D) Gateway requires a NAT Gateway
See the answer
Answer: B
Gateway endpoints (free) are only for S3 and DynamoDB, they are added as a route in the routing table. Interface endpoints (paid) use ENIs with private IPs and work with most AWS services. They allow access to AWS services without going through the Internet.
Result
Count your correct answers:
- 27-30: Excellent - You master VPC concepts
- 22-26: Good - Some points to review
- 17-21: Average - Review the course before the lab
- Less than 17: Insufficient - Go through the course from the beginning
Proceed to the VPC Schema Lab once you have achieved at least 22 correct answers.