Luyện thi AWS Advanced Networking Specialty

Global Accelerator uses AWS edge locations and the global backbone to route user traffic to healthy application endpoints. It is not DNS storage, a VPN, or a firewall.

Transit Gateway centralizes routing between many VPCs and on-premises networks. It is not a server, database, or CDN.

VPC sharing lets multiple accounts use subnets owned by one account, which simplifies network architecture. Public access, VPNs, and cloning are different.

VPC endpoints connect a VPC privately to AWS services without internet transit. Internet gateways, route tables, and security groups are different components.

PrivateLink lets you expose or consume services using private IPs. Public hosting, DNS, and load balancing are separate functions.

Gateway Load Balancer sends traffic through third-party appliances such as firewalls and intrusion detection systems. It is not a database or DNS service.

Route 53 Resolver provides DNS resolution between VPCs and on-premises networks. VPNs, subnets, and NAT are not DNS resolvers.

Outposts brings AWS hardware and services to customer locations. CDN edges, databases, and DNS zones are different.

VPC Lattice provides service-to-service connectivity, routing, and policy management. DNS records, load balancers, and VPNs are individual components.

Transit Gateway provides hub routing, PrivateLink exposes services privately, Gateway Load Balancer routes appliance traffic, and VPC Lattice manages service-to-service communication.

Route tables contain routes that tell subnets how to reach destinations. They do not control instance deletion, logins, or encryption.

An internet gateway enables bidirectional internet communication for a VPC. Firewalls, DNS, and VPN tunnels are different.

NAT gateways allow private instances to initiate outbound traffic while blocking unsolicited inbound traffic. They are not DNS or load balancing services.

Egress-only internet gateways let IPv6 resources reach the internet without allowing inbound IPv6 traffic. They are not DNS or blocking gateways.

VPC peering connects two VPCs privately using AWS networking. It is not a public route, VPN, or NAT service.

Prefix lists group CIDRs so rules and routes can reference them by name. DNS records, subnets, and VPNs are different.

Network ACLs filter traffic at the subnet level and are stateless. Security groups are stateful instance firewalls, and DNS or routing are different.

Subnets divide a VPC into IP ranges used by resources. DNS zones, load balancers, and VPNs are not subnets.

Associations bind subnets to route tables so traffic is directed correctly. Firewall rules, DNS records, and VPN attachments are different.

Internet gateways provide public access, NAT gateways provide outbound access, route tables direct traffic, and network ACLs filter subnet traffic.

Direct Connect uses dedicated network connections to reach AWS privately. It is not internet routing, VPN, or DNS.

Direct Connect Gateways let one Direct Connect connection reach multiple VPCs in different accounts and Regions. NAT, DNS, and load balancing are different.

Site-to-Site VPN creates IPsec tunnels over the internet. Physical lines, DNS, and CDNs are different.

Client VPN connects individual users to AWS and on-premises resources. Site-to-site tunnels, DNS, and transit gateways are different.

A virtual private gateway terminates VPN or Direct Connect connections for a VPC. Subnets, firewalls, and DNS records are not concentrators.

Border Gateway Protocol exchanges network routes between on-premises routers and AWS. It is not SQL, DNS, or firewall rules.

IPsec tunnels encrypt traffic between endpoints. Physical cables, DNS queries, and storage buckets are different.

VPN CloudHub uses a virtual private gateway to connect branch sites through encrypted tunnels. It is not DNS, load balancing, or a database.

VPN attachments connect Site-to-Site VPNs to a transit gateway for centralized routing. Firewalls, NAT, and DNS are different.

Direct Connect provides private physical lines, Site-to-Site VPN provides encrypted tunnels, Client VPN serves remote users, and Direct Connect Gateway enables multi-VPC access.

Security groups filter traffic at the resource level and are stateful. Network ACLs are stateless subnet firewalls, and DNS or routes are different.

Network Firewall inspects and filters traffic entering or leaving a VPC. Load balancers, DNS, and CDNs are different.

AWS WAF filters HTTP and HTTPS requests based on rules. Network ACLs, VPNs, and DNS zones are not web firewalls.

Shield Advanced protects applications against larger and more sophisticated DDoS attacks. It is not a password manager, DNS, or firewall appliance.

Flow Logs capture metadata about accepted and rejected traffic. Application logs, DNS records, and backups are different.

Traffic Mirroring duplicates packets and sends them to monitoring appliances. Encryption, DNS, and backups are different.

Firewall Manager applies security policies across accounts in an organization. DNS, load balancing, and VPNs are different.

Rule groups define traffic matching and action logic for Network Firewall. Route tables, DNS zones, and security groups are different.

Security group references let rules use another group as a source or destination, simplifying changes. They are not about deletion, DNS, or encryption.

Security groups protect resources, Network Firewall protects VPC traffic, AWS WAF protects web applications, and Shield Advanced defends against DDoS.

CloudFront caches and delivers content from edge locations. DNS, VPN, and databases are different services.

Latency routing sends users to the endpoint with the lowest measured latency. Country, weight, and random routing are different policies.

Weighted routing sends a defined percentage of traffic to each endpoint. Latency, geolocation, and failover policies are different.

Failover routing shifts traffic to a secondary endpoint when the primary fails a health check. Latency, geolocation, and weighted are different.

Geolocation routing sends users to endpoints based on where requests originate. Latency, weighted, and protocol-based routing are different.

Signed URLs restrict access to CloudFront content for a limited time. DNS records, firewall rules, and VPN profiles are different.

Origins hold the original content that CloudFront distributes, such as S3 or an HTTP server. Edges, DNS zones, and load balancers are not origins.

Global Accelerator uses edge locations to optimize TCP and UDP traffic to applications. Object storage, DNS-only, and web filtering are different.

Origin failover uses an origin group and health checks to serve from a secondary origin. DNS records, VPNs, and subnets are different.

CloudFront delivers content, latency routing chooses the fastest Region, weighted routing splits traffic, and failover routing handles availability.

Reachability Analyzer verifies network paths between resources. DNS, firewalls, and VPNs are different.

Network Access Analyzer identifies reachable paths that may be unintended. Load balancers, DNS, and subnets are not analyzers.

Network Manager provides a central view of transit gateway networks and connections. Firewalls, databases, and CDNs are different.

IPAM helps allocate, track, and monitor IP addresses across accounts. DNS, load balancing, and VPNs are different.

Internet Monitor measures availability and performance from client locations to AWS applications. DNS zones, firewalls, and NAT are different.

AWS Config tracks configuration changes and evaluates compliance rules for resources including networking. Routing, storage, and encryption are different.

CloudTrail logs API calls, including changes to network resources. Filtering, DNS, and content delivery are other services.

CloudWatch metrics measure values such as bytes in, bytes out, and packets. Logs, DNS records, and security rules are different data types.

Packet capture records traffic for forensic and performance analysis. Blocking, DNS resolution, and IP assignment are different.

Reachability Analyzer tests paths, Network Manager visualizes networks, VPC IPAM plans addresses, and Internet Monitor tracks internet performance.