CertiName the client path
- CloudFront caches HTTP
- Global Accelerator two static IPs, TCP/UDP
- Application Load Balancer host and path
- Network Load Balancer layer 4 and a static address
Study guide · Flashcards & memory notes
AWS Networking Flashcards & Memory Notes
50 recall cards for the distinctions ANS-C01 keeps testing: which edge service owns the client, which virtual interface lands where, and which hop is actually encrypted.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Design
The client path, the name, and the hub.
1.1What does CloudFront add that Global Accelerator does not?
Caching at the edge, plus HTTP behavior such as a cache policy or a WAF web ACL. Global Accelerator does not store objects.
1.2What does Global Accelerator provide for a non-HTTP service?
Two static anycast IP addresses and a TCP or UDP path. It is not a cache. CloudFront is the cache.
1.3Which DNS record can sit at the zone apex?
An alias record. A CNAME cannot sit at the apex.
1.4Who can resolve a private hosted zone?
VPCs associated with that zone. A public hosted zone is the name the internet can resolve.
1.5Which resolver endpoint does an on-premises resolver query?
The inbound endpoint. The outbound endpoint is how the VPC reaches on-premises DNS.
1.6What sends VPC queries to an on-premises resolver?
An outbound endpoint plus a forwarding rule. An inbound endpoint faces the other direction.
1.7When do you choose an Application Load Balancer?
Layer 7 HTTP routing by host or path, TLS termination, and a cookie for stickiness. A Network Load Balancer is layer 4.
1.8When do you choose a Network Load Balancer?
TCP, UDP, or TLS, a static address per Availability Zone, and client-IP preservation for instance targets. It does not route by URL path.
1.9What encapsulation does a Gateway Load Balancer use toward an appliance?
GENEVE. The appliance is not a normal HTTP target.
1.10What do VPC Flow Logs contain?
Accepted and rejected traffic metadata. They do not contain the packet payload.
1.11What copies packets to an inspection appliance?
VPC Traffic Mirroring. Flow logs only record metadata. Reachability Analyzer does not send packets.
1.12Does Reachability Analyzer send traffic?
No. It evaluates the configured route, security group, and network ACL path. A packet capture is Traffic Mirroring.
1.13Is Direct Connect encrypted by default?
No. Add MACsec on a supported dedicated connection, or a VPN, when encryption is required. A private virtual interface is private addressing, not encryption.
1.14Is VPC peering transitive?
No. A peer is not a path to a third VPC, the internet, or Direct Connect. Transit Gateway is the hub.
1.15What connects two networks whose CIDR blocks overlap?
PrivateLink, or NAT between them. Peering rejects the overlap. Those VPCs also cannot attach to the same transit gateway.
Deck 2 · Implementation
Virtual interfaces, attachments, and templates.
2.1Which virtual interface reaches a virtual private gateway?
A private virtual interface. A transit virtual interface is for a transit gateway. A public virtual interface is for public AWS addresses.
2.2Which virtual interface reaches a transit gateway?
A transit virtual interface, through a Direct Connect gateway associated with that transit gateway. A private virtual interface does not land on the transit gateway.
2.3Which virtual interface reaches public AWS service addresses?
A public virtual interface. It does not deliver traffic into a private VPC CIDR.
2.4What does BGP community 7224:7300 mean?
High local preference for traffic AWS sends toward your prefix. 7224:7100 is low. 7224:7200 is medium. Your router’s local preference chooses the path toward AWS.
2.5What does a Site-to-Site VPN require for device failure?
Two tunnels, and a second connection when the on-premises device itself must fail over. One tunnel is not the highly available design.
2.6What is Transit Gateway Connect?
A GRE and BGP attachment for an SD-WAN appliance. It is not IPsec. Site-to-Site VPN is the IPsec attachment.
2.7What does appliance mode change?
Return traffic through a stateful firewall stays in the same Availability Zone. Without it, the transit gateway can pin the two directions to different zones and the firewall drops the flow.
2.8How do you share a transit gateway with another account?
AWS RAM, then an attachment in that account. A bucket policy does not share a transit gateway. VPC sharing shares a subnet, not the hub.
2.9What backs a PrivateLink endpoint service for an application?
A Network Load Balancer. A Gateway Load Balancer backs an appliance service. The consumer creates an interface endpoint.
2.10Where do you place a Route 53 Resolver inbound endpoint?
In at least two subnets, and you allow the on-premises resolvers in its security group. One Availability Zone is a single failure for name resolution.
2.11Why avoid hardcoding us-east-1a in a shared template?
The Availability Zone name maps to a different AZ ID in each account. Use the AZ ID, such as use1-az1, when placement must match.
2.12What pages you when a VPN tunnel goes down?
An EventBridge rule on the state change, aimed at a notification. A dashboard does not page anyone. BGP is what fails the traffic over.
2.13What is the target type for a Fargate task behind a load balancer?
IP, because the task has its own address. Instance target type fits a node that receives the traffic, not an address the node does not own.
Deck 3 · Operations
The route that won, the packet that did not fit, and the bill.
3.1What beats a higher BGP community?
A longer prefix. Longest match is decided before the community on a shorter prefix. Advertise the same prefix length when you want the community to choose.
3.2Why summarize on-premises routes into a transit gateway?
Route quotas, and fewer updates when one prefix flaps. Advertising every host route is how you hit the quota.
3.3What does a REJECT flow-log action mean?
A security group or network ACL denied the traffic. It is not proof of an application error. There was no payload to read.
3.4Which flow-log field shows the original client behind a NAT gateway?
pkt-srcaddr. srcaddr can show the translated address.
3.5Small pings work and large transfers fail. What do you check first?
MTU. Jumbo frames die on a path that includes a VPN. A 9001-byte packet is valid inside a VPC and is not valid through IPsec overhead.
3.6What is an Elastic Fabric Adapter for?
Tightly coupled HPC, such as MPI, in a cluster placement group. A normal web tier uses an Elastic Network Adapter.
3.7When is VPC peering the cheaper connection?
Two VPCs that only need each other, with no overlapping CIDRs and no transitive hub. A transit gateway adds attachment and data-processing charges you do not need for that pair.
3.8How do you add addresses after a VPC CIDR is full?
Add a secondary CIDR and new subnets. You do not resize the primary CIDR in place.
3.9Where do you configure multicast?
A Transit Gateway multicast domain. VPC peering does not carry multicast.
3.10What is the default for cross-zone load balancing on a Network Load Balancer?
Off. Turning it on can send flows across Availability Zones and add data-transfer charges. An Application Load Balancer has cross-zone on by default.
Deck 4 · Security
The layer that filters, the log that proves it, and the hop that encrypts.
4.1What filters an HTTP request pattern?
AWS WAF on CloudFront or an Application Load Balancer. Shield is DDoS protection. Network Firewall sits on the VPC path. WAF does not attach to a Network Load Balancer.
4.2Can a security group match a domain name?
No. Use Network Firewall or Route 53 Resolver DNS Firewall. A NAT gateway forwards the packet. It does not filter the name.
4.3How does a security group differ from a network ACL?
A security group is stateful. A network ACL is stateless and needs an explicit return match, including ephemeral ports. Both can deny traffic. Only the ACL is stateless.
4.4How do you insert a third-party firewall without giving every instance its address?
Route to a Gateway Load Balancer endpoint. A security group does not steer the VPC default route.
4.5What pushes one WAF policy to every account?
AWS Firewall Manager. A web ACL in one account does not cover the organization.
4.6What records the API call that changed a route?
AWS CloudTrail. VPC Flow Logs record traffic metadata, not the API call.
4.7How do you encrypt Direct Connect?
MACsec on a supported dedicated connection, or a VPN over the circuit. A private virtual interface is not encryption.
4.8Can you export the private key of a public ACM certificate?
No. Use AWS Private CA when you must install a certificate yourself. A public ACM certificate is for services that can use ACM directly.
4.9What does DNSSEC protect?
The authenticity of public DNS answers. It does not encrypt Direct Connect and it does not hide a private hosted zone.
4.10What does the PrivateLink consumer create?
An interface endpoint, after the provider allows the account on an endpoint service. The provider side is the Network Load Balancer, not a VPC peering connection.
4.11What sends spoke traffic through an inspection VPC?
Transit Gateway route tables. A security group in the spoke never sees traffic the route did not deliver.
4.12How does a private subnet reach S3 without a NAT gateway?
A gateway VPC endpoint in that VPC’s route table. The gateway endpoint is not reachable from on-premises. An interface endpoint is the path you can route to.
Memory notes
Groupings that make the highest-yield ANS-C01 distinctions easier to recall.
Name the virtual interface
Private VIF for a virtual private gateway. Transit VIF for a transit gateway. Public VIF for public AWS addresses. 7224:7300 is high preference back to you. 7224:7100 is low. Same prefix length, or the longer prefix wins.
Pair, hub, or endpoint
Peering is not transitive and rejects an overlap. Transit Gateway is the hub. Turn on appliance mode for a stateful firewall. PrivateLink is the overlap-safe private service. RAM shares the transit gateway or the subnet.
Read the failure
Flow logs are metadata. pkt-srcaddr is the original client. REJECT is a filter. Traffic Mirroring has the payload. Reachability Analyzer does not send packets. A ping that works and a transfer that fails is MTU.
Encrypt the hop you named
Direct Connect is not encrypted. MACsec or a VPN makes it so. WAF is HTTP. Shield is DDoS. A security group cannot match a domain. A public ACM key is not exportable. DNSSEC authenticates DNS. It does not encrypt the circuit.
Spend where the design needs it
Peer two VPCs that only need each other. Use a gateway endpoint so S3 skips the NAT gateway. One NAT gateway is one Availability Zone. EFA is for HPC. A secondary CIDR adds addresses. You do not resize the primary CIDR.
Continue the AWS Networking study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 750 passing score, domain weights, and a study plan.
Core Notes
Reference notes for the edge, DNS, hybrid routing, operations, and network security.
Flashcards & Memory Notes
50 recall cards in four decks, plus memory notes for paths, VIFs, and encryption.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Text Case Converter
Convert text between uppercase, lowercase, title case, sentence case, camelCase, and snake_case.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.