ExamPark
Course menuCLF-C02

Exams / CLF-C02 / Study guide / Networking

Networking: CLF-C02 study notes and practice questions

What to know about Networking for the CLF-C02 exam, from the Cloud Technology and Services domain (34% of the exam guide), then 3 free questions to test it. Part of the CLF-C02 study guide.

Last verified against current AWS documentation ·How we write our questions

What to know for the exam

Networking questions at this level ask what each piece of a network does and how to connect to AWS.

Inside a VPC

Component Job
Amazon VPC A logically isolated private network in an AWS Region
Subnet A range of addresses in one Availability Zone; public subnets route to the internet, private subnets don’t
Internet gateway Connects a VPC to the internet
NAT gateway Lets instances in private subnets reach the internet for updates, while blocking incoming connections
Route table Decides where network traffic goes
Security group Stateful firewall for instances; allow rules only
Network ACL Stateless firewall for subnets; allow and deny rules
VPC endpoint Private connection to AWS services without going over the internet
VPC peering / Transit Gateway Connect VPCs to each other

Connecting users and offices

Service Job
Amazon Route 53 DNS: register domains, route users to resources, health checks
Amazon CloudFront Content delivery network with edge locations worldwide
AWS Global Accelerator Improves performance for global users over the AWS network, with static IP addresses
AWS Site-to-Site VPN Encrypted connection from an office to a VPC over the internet; quick to set up
AWS Direct Connect Dedicated private connection from a data center to AWS; consistent performance
AWS Client VPN Remote users connect securely to AWS or office networks

Common traps

  • VPN vs Direct Connect. VPN goes over the internet and is fast to set up; Direct Connect is private and consistent but takes longer to set up.
  • Internet gateway vs NAT gateway. An internet gateway allows both directions for public subnets; a NAT gateway allows outbound-only for private subnets.
  • Security group vs network ACL. Instance-level and stateful vs subnet-level and stateless.

Try the 3 practice questions

Practice NetworkingTake the free practice exam

Question 1

Easier · choose 2 ·Link to this question (question 1)

A start-up is launching a website on two web servers in different Availability Zones.

It wants to buy its domain name from AWS, and to stop sending visitors to a server that has failed.

Which TWO tasks can Amazon Route 53 perform for it? (Choose two.)

Choose two answers.

  1. A. Caching the website's images at edge locations near visitors
  2. B. Registering the start-up's own domain name with AWS
  3. C. Filtering web requests that contain SQL injection attempts
  4. D. Encrypting the data stored in the website's database
  5. E. Checking server health and routing visitors away from failed servers
Show the answer and explanation

Answers: B, E

  • A. Wrong: Caching content at edge locations is the job of Amazon CloudFront, not Route 53. Route 53 answers DNS queries and does not store copies of website content.
  • B. Right: Route 53 includes domain registration, so the start-up can buy and manage its domain name in the same place as its DNS records. Learn more: Amazon Route 53 overview (opens in a new tab)
  • C. Wrong: Filtering requests for SQL injection is done by AWS WAF. Route 53 directs DNS queries and does not inspect the contents of web requests.
  • D. Wrong: Encryption of stored data is set on the database service, using AWS KMS keys. Route 53 handles DNS and has no role in encrypting database storage.
  • E. Right: Route 53 health checks send requests to endpoints and stop returning records for servers that fail, so visitors reach healthy servers. Learn more: Health checks in simple Route 53 configurations (opens in a new tab)

Explanation

Route 53 is AWS's DNS service. It can register domain names and use health checks to route traffic only to healthy resources. CloudFront caches content, WAF filters web requests, and encryption at rest is a database setting, so those options describe other services.

Study

Question 2

Medium ·Link to this question (question 2)

A retailer needs a private, encrypted connection from its branch office network to a VPC.

It wants to use its existing internet connection, and it does not want to order a dedicated private line.

Which service should it use?

Choose one answer.

  1. A. AWS Site-to-Site VPN, which creates encrypted tunnels over the internet
  2. B. AWS Direct Connect, a dedicated private network connection into AWS
  3. C. An internet gateway, which lets the VPC send traffic to the internet
  4. D. VPC peering, which connects two VPCs privately
Show the answer and explanation

Answer: A

Explanation

Site-to-Site VPN connects an on-premises network to a VPC through encrypted tunnels over the internet, which meets the requirements. Direct Connect needs a dedicated line the retailer does not want, and an internet gateway or VPC peering does not connect a branch network securely.

Study

Question 3

Medium ·Link to this question (question 3)

A company runs software-update servers in private subnets of its VPC.

The servers must download patches from the internet, but no one on the internet may be able to start a connection to them.

Which setup meets both requirements?

Choose one answer.

  1. A. Attach an Elastic IP address to each server, a static public IPv4 address
  2. B. Move the servers to a public subnet, with public IP addresses for each server
  3. C. Route private subnet traffic through a NAT gateway in a public subnet
  4. D. Create a VPC peering connection to a second VPC in the same account
Show the answer and explanation

Answer: C

  • A. Wrong: An Elastic IP address makes a server reachable from the internet, so outside parties could start connections to it. That breaks the company's rule.
  • B. Wrong: Public IP addresses make the servers reachable from the internet, so the inbound rule is broken. Patches could download, but the servers would be exposed.
  • C. Right: A NAT gateway lets instances in private subnets start outbound connections to the internet for patches. Connections cannot be started from the internet toward the instances through it. Learn more: NAT gateways (opens in a new tab)
  • D. Wrong: VPC peering connects two VPCs privately. It gives the servers no path to the internet, so the patches still cannot download.

Explanation

A NAT gateway in a public subnet gives private instances outbound-only internet access, so they can download patches while no internet host can start a connection to them. Public addressing exposes the servers, and peering provides no internet route.

Study

Want more on Networking? The 5 full-length practice sets have 13 more Networking questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets

Study Networking

More Cloud Technology and Services topics