201 thoughts on “AWS Virtual Private Cloud – VPC”

1. Hi Jayendra,

   Your site seems to be a very good source of information for people working on AWS. I believe the sample questions are for AWS Architect Associate Exam. I found few of the answers a bit different that it should have been. Can you help me some explanation.

   For e.g. the 1st question on this page :

   You have a business-to-business web application running in a VPC consisting of an Elastic Load Balancer (ELB), web servers, application servers and a database. Your web application should only accept traffic from predefined customer IP addresses. Which two options meet this security requirement? Choose 2 answers

   I believe the answer should have been B and C.

   Option D seems wrong because if I configure NACL to restrict inbound connection from ELB then how the request will go from ELB to instances. Same case for option A too.

   Please correct me if I am wrong.

   1. Hi GP
      Thanks for the feedback. You are correct. It should not be NACL cause even through NACL can be configured to allow web traffic from Customer IPs it should still allow Outbound traffic on ephermal ports.. A is wrong as the web servers do not accept traffic from Customers but from the ELB. So it should be using X-Forward-for which can give you the actual customer IP address and Security groups with just the customer IP address and deny all outdound as it is stateful.

      1. Hello, I have been studying this question and going back and forth on if A or C is more correct.

         I think C is wrong. C uses security group at the ELB level to restrict inbound traffic, it is a better solution. BUT DENY all outbound traffic will not allow ELB to send traffic to the Webserver listener. From AWS document “Be sure to review the security group rules to ensure that they allow traffic on the listener and health check ports for the new load balancer.” 
         http://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-groups.html .

         A is not the best answer but it is not wrong. If the web traffic is passing through the ELB, then web server VPC security group should only allow the ELB as inbound. This configuration is allowing Web servers directly receiving traffic from customer by-pass the ELB.

         1. ELB is open to all and passing the Client IP address to the instances behind it which can then check the client IP address.
            With A, you can’t add IPs to the instances can instance will have only the ELB IP address as the origin of the request

            1. C. ELB security groups to allow traffic from your customers’ IPs and deny all outbound traffic.
               SGs are stateless and also SGs only “Allow” don’t “Deny”

            2. SGs are stateless (I meant that in my comment)

            3. Added the reason for the answer selection. SG are stateful.
               Also as the Web Server are behind ELB the only way to restrict is either at ELB or use custom filter on Web Server

2. Hi Jayendra,

   Would you able to help to ans this question? I believe B and E , please suggest. Thank you.

   A company has configured and peered two VPCs: VPC-1 and VPC-2. VPC-1 contains only
   private subnets, and VPC-2 contains only public subnets. The company uses a single AWS
   Direct Connect connection and private virtual interface to connect their on-premises
   network with VPC-1. Which two methods increases the fault tolerance of the connection to
   VPC-1? Choose 2 answers

   A. Establish a hardware VPN over the internet between VPC-2 ana the on-premises
   network.

   B. Establish a hardware VPN over the internet between VPC-1 and the on-premises
   network.

   C. Establish a new AWS Direct Connect connection and private virtual interface in the
   same region as VPC-2.

   D. Establish a new AWS Direct Connect connection and private virtual interface in adifferent AWS region than VPC-1.

   E. Establish a new AWS Direct Connect connection and private virtual interface in the
   same AWS region as VPC-1

   1. I got the same question in the SA Exam. B is for sure the answer as establishing a VPN connection to the same VPC is the recommended solution.. However, I was not able to get to the other correct option and marked E as the second answer by the process of elimination. Direct Connect does not work across region so eliminating D. Also Direct Connect does not work with VPC Peering so eliminating VPC-2 options A & C.

      1. why cant it be C
         http://www.slideshare.net/AmazonWebServices/arc402-double-redundancy-with-aws-direct-connect
         only catch is direct connect will have to go through a different co-location facilty as mentioned in the slide 15

         1. C is with a different VPC i.e. VPC 2 which is peering with VPC 1 but peering will not allow you to access VPC 1 resources.

            1. Right Jayendra…C is with different VPC…so C is not correct answer..

               Which two methods increases the fault tolerance of the connection to
               VPC-1?..I think only two option is correct..B and E.

            2. Yup … only B & E mentioned @ Direct Connect Blog Post

3. Hi Jayendra,

   For question number 2 , I believe the answer should be Destination : 20.0.0.0/16 and Target : Local which is not available of any option. Destination should be CIDR of VPC not CIDR of private subnet. You can not add the CIRD of private subnet where target is ‘Local’.

   Please correct me if I am wrong.

   Thanks.

   with regards,

   Tarun

   1. Good catch, the CIDR block should be VPC CIDR block 20.0.0.0/16 with local as the target.
      “Every route table contains a local route that enables communication within a VPC. You cannot modify or delete this route”
      Corrected the answer.

4. Hi Jay,
   Regarding question no 8; shouldn’t it be C.
   According to aws-
   “When you create each subnet, you provide the VPC ID and the CIDR block you want for the subnet. After you create a subnet, you can’t change its CIDR block”

   1. Thanks Vivek, #C is correct as After you create a subnet, its CIDR block cannot be changed through any means and has to be deleted and recreated.

   2. the question is “How can the user create the second subnet?”
      so the answer is about the second subnet being attempted. not the first one.

   3. Question 25: Which two components provide connectivity with external networks?
      “When attached to an Amazon VPC”

      This would be tricky. All of them are valid.

      1. Que 25. I think it is mentioned that “with externak network” so C&D correct.. because other two i.e. A&B provide connection to reach C&D…

      2. NAT still requires IGW for allowing instances in Private subnet to connect to Internet also it is not attached to VPC
         Also, EIP, IGW, VGW are all attached to a VPC, however EIP does not provide connectivity and a public IP address can be used as well.

5. Question(24)
   can you check this one again , i believe it should be (C) Destination: 20.0.1.0/16 and Target: vgw-12345 as when destination is VPN then will be sent to the VPN Gateway.

   1. D is the right answer as it needs to reach out to all the destination through the VPN gateway.
      Refer to the Scenario

      1. Yeah you are right !
         thanks for sharing , man this blog i believe became the #1 source for anyone who wants to prepare for the AWS Certificate

6. Hi Jayandra

   I don’t understand q#5. Can you please explain ?

   Thanks
   K.Senthilkumar

   1. The Question is targeting the security group configuration for NAT. NAT is basically to allow outgoing internet access for instances in the private group. You would configure the NAT and have outbound configurations enabled for http(80)/https(443) calls usually for package downloads.
      #C is incorrect as the instance is in Public Subnet and handled through Internet Gateway and needs to configured for the instance.

      1. Thanks a lot for the blog post. These are really very helpful. For NAT only outbound rule is required no inbound rules, as its for traffic to go out to Internet, not come in. So no inbound rule should be required. Even answer A should not be required along with C. What do you say?

         1. NAT should allow inbound from the instances from the private subnet instances. So A is required.

      2. Pls help me to understand Q – 5. A user has created a VPC with public and private subnets using the VPC wizard. Which of the below mentioned statements is true in this scenario?

         I think C option should be correct But it shows option B is correct.

         1. With VPC wizard, with public and private subnets it used to create NAT instance, and you did not did need to create NAT instance.

7. Pls elaborate que #20 answer….

   1. VPC with Public and Private subnet created with Wizard used to create a NAT instance and hence it was not allowed to delete the VPC as it needs to be empty. The scenarios are bit changed now with the introduction of NAT Gateway. Refer Scenario 2

      1. >>VPC with Public and Private subnet created with Wizard used to create a NAT gateway
         did you meant to say ‘used to create a NAT *instance*’?

         1. Yup the older Nat instance, edited the reply.

8. Currently it is allowing to delete Custom VPC with Public and Private subnet with not instance and with NAT Gateway…
   In Question, if we consider, there are Public and Private subnets and assume that no NAT gateway created, that means NAT instance is created to connect for internet for public subnet, if so than it will not allow us to delete custom vpc….
   pls correct me if wrong…

   1. Correct, as previously NAT Gateway, which was introduced recently and is a managed service by AWS, did not exist and you had to create a NAT instance, which is basically a EC2 instance only. In that case, AWS did not allow you to delete the VPC.

      1. So here as mentioned VPC was created with wizard and no instance is there, so it should allow to delete VPC..as i have checked….
         So, “C” is the right answer… “It will terminate the VPC along with all the instances launched by the wizard”

         pls suggest…

         1. As mentioned the questions refers to previous implementation and is outdated, but AWS exam as not updated with the new features as far as i have experienced.
            When creating a VPC using Wizard, previously, an NAT instance was created by AWS.
            So previously, as it was a normal EC2 instance AWS did not allow to delete the VPC.
            With the introduction of NAT Gateway, AWS creates a managed NAT gateway and deletes it when you delete a VPC.

            1. Hi Jayendra

               Is the NAT gateway deleted or detached on VPC deletion?

            2. You need to delete the Gateways and Instances, without which it will not allow you delete the VPC.
               Refer VPC Delete

9. Ok.
   . thank you for giving such gr8 gt8 gr8 !!! Material…. and help….

10. Hi Jayendra,

    Question 6:
    A user has created a VPC with CIDR 20.0.0.0/24. The user has used all the IPs of CIDR and wants to increase the size of the VPC. The user has two subnets: public (20.0.0.0/28. and private (20.0.1.0/28

    Since VPC CIDR is 20.0.0.0/24, private subnet 20.0.1.0/28 cannot be part of the VPC, right? Network part of the VPC is “20.0.0”, so 20.0.1 is not part of VPC.

    Did you meant to say the subnets CIDR are 20.0.0.0/25 are 20.0.0.128/25?

    1. Thanks Satish, yup the questions seems wrongly framed as the private subnet cannot be part of the defined VPC CIDR block. Updated the questions with the correct CIDR range.

11. Hi Jayendra,

    Many THANKS to you for publishing these useful blog posts.

    A small suggestion:
    I found questions at the end of blog post very helpful. Instead of highlighting answers in each question, may be it is useful to post the correct answers (like Q1: A, D. Q2: B, etc.) in the end. Users can do the questions and then compare their answers after doing all questions — this way they know how many correct answers they got and gauge if they are ready for the certification exam. Seeing answers while reading the question influences users’s judgement on answer choice.

    Cheers,
    Satish

    1. Actually agree on the suggestion. I was thinking of show answer button, but the main problem is the time and effort to revamp around 100 posts 🙂
       Will try to do it for new posts.

       1. Awesome! I think doing the new way for new posts should be good enough.

12. Could you please explain question 9?

    1. The question targets the communication between VPC and an On Premises Data Center, where the CIDR block should not be overlapping.

       1. To be more specific :
          20.0.54.0/24 (2^8 adderesses) has a clash with 20.0.0.0/16 (2^16 addresses) vpc

13. Hi Jayendra – Firstly, thanks for all your excellent posts. It is really a very good synopsis.

    Quick check on question no -29

    In my opinion it should be – “C” . Can you please re-confirm?

    A user has created a VPC with CIDR 20.0.0.0/24. The user has created a public subnet with CIDR 20.0.0.0/25. The user is trying to create the private subnet with CIDR 20.0.0.128/25. Which of the below mentioned statements is true in this scenario?
    a, It will not allow the user to create the private subnet due to a CIDR overlap
    b. It will allow the user to create a private subnet with CIDR as 20.0.0.128/25
    c. This statement is wrong as AWS does not allow CIDR 20.0.0.0/25
    d. It will not allow the user to create a private subnet due to a wrong CIDR range

    1. Hi Rudra,

       I will allow you to create the subnets with the CIDR block 20.0.0.0/25 as it would cover the IPs from 20.0.0.0 to 20.0.0.127.
       20.0.0.128/25 would have the IPs from 20.0.0.128 to 20.0.0.255 which is non overlapping.

14. A user has created a VPC with public and private subnets using the VPC wizard. The user has not launched any instance manually and is trying to delete the VPC. What will happen in this scenario?
    It will not allow to delete the VPC as it has subnets with route tables
    It will not allow to delete the VPC since it has a running route instance
    It will terminate the VPC along with all the instances launched by the wizard
    It will not allow to delete the VPC since it has a running NAT instance

    Question does not talk about launching of NAT instance. With this how come option D is correct answer?

    1. This is an old question before the Nat Gateway was introduce where if you created a vpc with wizard it used too create NAT instance as well. Not valid anymore.

15. Question 1:
    Correct answer is A & B. Here is my explanation for the same.

    A is obviously correct as security group can be configured to accept traffic from predefined customer IPs

    You can leverage AWS WAF to configure your webserver and filter the traffic based of HTTP header passed by load balancer. Hence #B is correct

    The security group can be configured to only allow the inbound or outbound traffic. When you allow certain inbound traffic in security group, the outbound traffic is automatically allowed because of the stateful nature. Hence #C is wrong

    In case if you deny all outbound traffic in NACL it will accept the inbound traffic but outbound hence #D is wrong.

    1. Security Group can be configured to accept traffic from predefined customer IPs, but this does not work when the instances are behind an ELB as the instances do not get the Client IPs but the ELB IP.

16. Hi, Jayendrapatil

    I am confused by Question 8:

    A user has created a VPC with the public and private subnets using the VPC wizard. The VPC has CIDR 20.0.0.0/16. The public subnet uses CIDR 20.0.1.0/24. The user is planning to host a web server in the public subnet (port 80) and a DB server in the private subnet (port 3306). The user is configuring a security group for the public subnet (WebSecGrp) and the private subnet (DBSecGrp). Which of the below mentioned entries is required in the web server security group (WebSecGrp)?
    A – Configure Destination as DB Security group ID (DbSecGrp) for port 3306 Outbound
    B – Configure port 80 for Destination 0.0.0.0/0 Outbound
    C – Configure port 3306 for source 20.0.0.0/24 InBound
    D – Configure port 80 InBound for source 20.0.0.0/16

    To me, it looks there’s nothing you need to do. Since the DB server and the WebServer is in the save VPC, they can reach each other by default. ( and by default, the outbound rule for security group is that you can reach all)

    So in this scenario, the only thing you need to remember to do with the WebSecGrp is to open the 80 (and 443 for https) to the public internet.

    1. With wizard creation, outbound is not open by default. Refer Link

       1. Thanks!

       2. Inbound and outbound is open by default.

          1. Not when you create a new security group. But for Default it is.

17. Hi Jayendra,
    First of all, thanks a ton for the material – extremely useful!

    Can you explain Q#5?
    “VPC bounds the main route table with a private subnet and a custom route table with a public subnet”. Are we trying to say that for a subnet to be private, we need to edit the route table?
    And why is option C not the right answer? While creating a NAT instance is unrelated, it is not incorrect

    Regards,
    NMD

    1. This is more of a question for VPC created through the Wizard. Refer VPC Creation Scenario
       The way it is implemented is the :-
       Main Route Table which points to NAT is associated with the Subnets. As there is no internet access, they are private.
       Also, any new subnet created are by default associated with the Main Route Table making them private.

       Custom Route table is associated with Internet Gateway with the Subnets associated being public.
       Any new subnets created need to be explicitly associated with the Custom Route table to make it public

       For NAT, it is created by the wizard depending upon the selection used.

       1. I wasn’t aware of the scenarios while creating VPC using the wizard. Thank you!

          1. I have created VPCs manually and I see that a default routing table is created but no subnets are associated it with automatically. Shouldn’t C be the correct answer?

18. Hi Jayendra,

    I am not sure why d is correct answer. Because as I understand none of the CIDRs are overlapping.

    20.0.1.0/24 – 256 hosts – 20.0.1.0-20.0.1.255
    20.0.0.0/24 – 256 hosts – 20.0.0.0-20.0.0.255
    20.0.54.0/24 – 256 hosts – 20.0.54.0-20.0.54.255
    20.1.0.0/24 – 256 hosts – 20.1.0.0-20.1.0.255

    Can you just double check?

    10. A user has setup a VPC with CIDR 20.0.0.0/16. The VPC has a private subnet (20.0.1.0/24) and a public subnet (20.0.0.0/24). The user’s data centre has CIDR of 20.0.54.0/24 and 20.1.0.0/24. If the private subnet wants to communicate with the data centre, what will happen?
    It will allow traffic communication on both the CIDRs of the data centre
    It will not allow traffic with data centre on CIDR 20.1.0.0/24 but allows traffic communication on 20.0.54.0/24
    It will not allow traffic communication on any of the data centre CIDRs
    It will allow traffic with data centre on CIDR 20.1.0.0/24 but does not allow on 20.0.54.0/24 (as the CIDR block would be overlapping)

    1. The VPC CIDR block should have an non overlapping IP addressess. As the VPC CIDR block is 20.0.0.0/16, so the range is 20.0.0.1 ~ 20.0.255.254 and would overlap with the 20.0.54.0/24

       1. Hi Jay: So you mean the datacenter’s ID overlap will check with VPC’s CIDR , not only subnet’s CIDR?

          1. Thats right. The check is with VPC’s CIDR.

19. For Question ‘1’ you mean using X-Forwarded-For from Apache level on webserver right ?

    1. Yup. Please refer to AWS Documentation @ https://aws.amazon.com/premiumsupport/knowledge-center/log-client-ip-load-balancer-apache/

20. Hi – re: Q 32. Can you explain why it is 4 and not 2.

    ‘cos I was confused once I read: “You can have your Web servers in two VPC’s and configure the RDS servers to use those as well. You just need to configure RDS to be “not publicly accessible” to fulfill the needs of this scenario.”

    On: http://cloudtrainingnotebook.blogspot.com/2016/10/aws-saa-study-list-rds.html

    1. For Multi-AZ RDS to not be publicly accessible it needs 2 private subnets. Also for Web Tier to be hosted on the Multiple AZs you would need atleast instances to be hosted on 2 different public subnets. Hence the answer would be 4.

       1. Thanks Jayendra 🙂

       2. Why we can’t put both RDS and web tier in same private subnets? In this case two private subnets would be enough, what do you think?

          1. Website needs to be in public, as there is no ELB or other service mentioned.

21. Hi Jayendra,
    You mentioned “ENI has the following attributes”
    This can be confusing, because we can think that all attributes should be set at the same time.
    The correct statement is “ENI can include the following attributes”

    1. Thanks Tarek, updated the statement …

22. Q1
    Can we consider option D ,as NACL is stateless ,so DENY will work.
    Also option C is talking about security group which is stateless , Deny will not work.

    1. Security group are stateful and just need inbound rule.
       NACLs are stateless so you need to define rules for both inbound and outbound. hence D would not work.

23. Hi Jayendra,

    Question No.6. We are talking about configuring the Security group of NAT instance. NAT instance will not permit any inbound traffic from internet. It’s always outbound. So, the answer would be A & C as they are not required for NAT security group.

    If it would have been a security group of the web server then A is required for DB to Web connectivity.

    Please correct if i’m wrong …

    Regards
    Vivek

    1. for NAT instance it should
       allow Inbound from private subnets to them to communicate to internet – For Inbound allow Source: 20.0.1.0/24 on port 80
       allow outbound to Internet as it needs to reach internet – For Outbound allow Destination: 0.0.0.0/0 on port 80 and port 443

       It does not require, For Inbound allow Source: 20.0.0.0/24 on port 80, as the public subnets already have access to Internet. So #C is not required.

       Refer AWS documentation – NAT SG

24. For Question 18, isn’t the answer B and C?

    1. Which question is this for ? Q 18 is a single choice.

       1. Question 18 Isn’t there is two not true statement? A and D ?

          1. Refer VPC Scenario 2. Actually a NAT gateway is created. But before NAT gateway, as NAT instance was created by AWS.

25. For Question 19, how would option D would be right choice? when VPC is created it does not create the NAT instance automatically right?

    1. Sorry, above question is for Question 21 in this page.

       1. Check VPC Scenario 2 as a NAT is created when you create a VPC from Wizard.

26. Q:34 and 38
    You need to design a VPC for a web-application consisting of an ELB a fleet of web application servers, and an RDS DB. The entire infrastructure must be distributed over 2 AZ. Which VPC configuration works while assuring the DB is not available from the Internet?
    A.One Public Subnet for ELB, one Public Subnet for the web-servers, and one private subnet for the DB
    B.One Public Subnet for ELB, two Private Subnets for the web-servers, and two private subnets for the RDS
    C.Two Public Subnets for ELB, two private Subnet for the web-servers, and two private subnet for the RDS
    D.Two Public Subnets for ELB, two Public Subnet for the web-servers, and two public subnets for the RDS

    I am confused as to why we need two subnets for ELB. ELB do not belong any subnet. Elbs can be associated with multiple subnets. But ELB itself belongs to amazon infrastructure and scaled for you. So I don’t understand why we need sub nets for ELB.
    Also why can’t we have only two private subnets (in two AZs) each having one web server and one DB server.. Please explain.
    Once again great questions here. A big thank you

    1. ELB is a managed service whose scalability is maintained by AWS. However, underlying it still launches instances to handle the traffic which is scaled accordingly. When you configure ELB you need to specify public Subnets (in case of external load balancer), in which the ELB instances would be launched.
       If you specific a Single Subnet and that AZ goes down, the ELB is non functional even though you have your underlying instances in multiple AZs. So the best practice is to have multiple subnets associated with ELB.

       1. ELBs themselves do not launch instances. Scalability Groups do, but they are not referenced in the question. The Availability Zones configured for the ELB (and their corresponding subnets) are where the Web Servers reside. I could see 6 subnets as being a viable choice if you could associate ELBs to (for example) Subnet1 and Subnet2, and independently have the EC2 instances running in subnets 3 and 4, but that will not work – not even with cross zone load balancing enabled. So the correct answer (which is not included here as an option) is two private subnets for the web-servers and two private subnets for RDS. The ELB will be configured to send traffic to the two private Web Server subnets, but is not itself independently associated with a subnet.

       2. Dear sir,

          I would like to ask ” you have posted this blog last 2 to 3 years ago, some changes has been done by AWS, so if I’m preparing my AWS exam with the help of you most informative blog, how I can distinguish changes done by AWS in syllabus.”

          Kindly guide me sir.

          Thank you so much.

          1. Usually there are minor changes on the AWS side and the thing that changes are limitations or quota limits. So over 95% of the blog is still relevant.

27. I relish, cause I discovered exactly what I was taking a look for.
    You have ended my 4 day long hunt! God Bless you man. Have a nice day.
    Bye

28. Q14. A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created both Public and VPN-Only subnets along with hardware VPN access to connect to the user’s data centre. The user has not yet launched any instance as well as modified or deleted any setup. He wants to delete this VPC from the console. Will the console allow the user to delete the VPC?
    a. Yes, the console will delete all the setups and also delete the virtual private gateway
    b. No, the console will ask the user to manually detach the virtual private gateway first and then allow deleting the VPC
    c. Yes, the console will delete all the setups and detach the virtual private gateway
    d. No, since the NAT instance is running

    I think the answer should be b because we must detach or delete all gateways and resources that are associated with the VPC before you can delete it.
    (Deletion of the VPC is possible only after terminating all instances within the VPC, and deleting all the components with the VPC for e.g. subnets, security groups, network ACLs, route tables, Internet gateways, VPC peering connections, and DHCP options)

    Please explain.

    1. As there are no other components within the VPC, the console will delete all the setups.

       1. The user has created both Public and VPN-Only subnets along with hardware VPN access.
          Subnets has been created here.

          Deletion of the VPC is possible only after terminating all instances within the VPC, and deleting all the components with the VPC for e.g. SUBNETS

          1. We can delete the VPC. Refer http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/working-with-vpcs.html#VPC_Deleting

             You can delete your VPC at any time. However, you must terminate all instances in the VPC first. When you delete a VPC using the VPC console, we delete all its components, such as subnets, security groups, network ACLs, route tables, internet gateways, VPC peering connections, and DHCP options.

             If you have a VPN connection, you don’t have to delete it or the other components related to the VPN (such as the customer gateway and virtual private gateway). If you plan to use the customer gateway with another VPC, we recommend that you keep the VPN connection and the gateways. Otherwise, your network administrator must configure the customer gateway again after you create a new VPN connection.

29. For Qn #10, shouldn’t the answer be ‘a’ instead of ‘d’.
    Here is how I see it.
    Private subnet 20.0.1.0/24 means it’s range is 20.0.1.0 to 20.0.1.255
    Likewise data center range would be 20.0.54.0 to 20.0.54.255 (for 20.0.54.0/24) and 20.1.0.0 to 20.1.0.255 (for 20.1.0.0/24)
    As such there is no overlap here.

    1. VPC CIDR block and not the subnet should have an non overlapping IP addresses. As the VPC CIDR block is 20.0.0.0/16, so the range is 20.0.0.1
       ~ 20.0.255.254 and would overlap with the 20.0.54.0/24.

30. For question 30:
    Can you please explain how CIDR 20.0.0.0/25 and 20.0.0.128/25 are not overlapping.

    1. I will allow you to create the subnets with the CIDR block 20.0.0.0/25 as it would cover the IPs from 20.0.0.0 to 20.0.0.127.
       20.0.0.128/25 would have the IPs from 20.0.0.128 to 20.0.0.255 which is non overlapping.

       1. Thanks Jayendra.
          I was able to check the ip address range for these CIDR blocks using online tool.
          Can you guide me to some documentation that can explain why 20.0.0.0/25 is resolving to the range 20.0.0.0 to 20.0.0.127.

          sorry , Not very clear on the CIDR block concepts.

          1. Refer – https://www.lifewire.com/cidr-classless-domain-routing-818375
             CIDR calculation is simple. The IP address is broken in 2^8 i.e. 0 – 255. 25 is the variable part of the address. 32 – 25 = 7 i.e. 2^7 = 128 addresses. hence 0 – 127.

             1. thanks Jayendra…got it 🙂

31. another point that gets typically missed out and is misunderstood is, what is the starting IP of the range. It is the number mentioned .0 or .128 so the range starts with that number. So that would translate into: 0 – 127 (.0/25) or 128 – 255 (.128/25)

32. Hi Jayendra
    for the below question. I am trying to understand the concepts better.. can you please provide some details or resource/link i can dig further? I am trying to understand this networking concept better & I do understand it could be an overwhelming topic but trying to understand this better at least at a high level.

    my understanding is –

    20.0.0.0/16 could span a range – 20.0.0.1 – 20.0.255.244

    how will 20.0.54.0/24 overlap with this?

    A user has setup a VPC with CIDR 20.0.0.0/16. The VPC has a private subnet (20.0.1.0/24) and a public subnet
    (20.0.0.0/24). The user’s data centre has CIDR of 20.0.54.0/24 and 20.1.0.0/24. If the private subnet wants to
    communicate with the data centre, what will happen?

    1. 20.0.0.0/16 is superset and 20.0.54.0/24 would be a part of it.
       20.0.0.0/16 would translate to 20.0.[0-255].[0-255]

33. #43 and EIP will always incur a cost.

    1. EIP is not charged if its in use. If you get it allocated but do not use it, you will be charged.
       https://aws.amazon.com/premiumsupport/knowledge-center/elastic-ip-charges/

34. Hi Jayendra,

    For question # 4 – Why option D is not right. You would need either an elastic IP or an Public IP to access the internet, right?

    For question # 8 – Why option B is not right? You need to open port 80 to 0.0.0.0/0 for outbound connection to the Internet, right?

    Thanks

    1. I am also thinking there should be an EIP assigned to the instance in order for external reach it.

       Can you explain Mr. Jayendra? Thank you very much.

       1. for #4 – EIP is not mandatory and you can actually use Public IP as well for accessing the website. However, with security group on configured properly your site would be unreachable.

35. Hi Jayendra,
    regarding new update that VPC can be resize, so Q7 should have no correct answer as per my understanding, please correct me
    https://aws.amazon.com/blogs/aws/catching-up-on-some-recent-aws-launches-and-publications/

    1. Thanks Hassan, its the latest AWS enhancement. Have updated the blog post.

36. Hi Jayendra, I got this question in AWS Dev Assoc exam today and am not sure of the answer. The question states that a set up is made with a public subnet and a private subnet with NAT in the public subnet, however the instance in private subnet still do not get connected to internet and we are asked to find which one will fix the issue:
    a. Assign elastic IP to private subnet
    b. Create secondary network instance..followed by something else can’t remember
    c. deactive some checks on incoming/outgoing traffic (not the exact words)
    d. Another option (can’t remember fullly) but talks about creating secondary network instance followed by some other things.

    Any comments?

    1. Should the disable Source/Destination question.
       Refer to my NAT post – Question 1

37. Great! Thanks. I marked the right answer by means of eliminating the others.

38. Q30- I did not understand why is answer C correct – it will allow to create private subnet 20.0.0.128/25?. 128 is last ip within this subnet group mask /25and aws reserves first 3 and last ip. Request clarification. Thanks

    1. For Q30. the answer B is marked as the correct answer. Are you referring to the same question ?

39. Yes Jayendra i am referring to B answer

40. Q30 -Answer is B – It will allow to create private subnet CIDR 20.0.0.128/25. My point is that it can allow private subnet up to 20.0.0.127/25.

    1. It can allow 20.0.0.128/25, which will give it 128 IP addresses from 20.0.0.128 to 20.0.0.255.

41. Can you please explain in detail about question 10?

    1. VPC CIDR block should have an non overlapping IP addresses. As the VPC CIDR block is 20.0.0.0/16, so the range is 20.0.0.1
       ~ 20.0.255.254 and would overlap with the 20.0.54.0/24, hence the traffic would not be allowed.

42. HI Jaynendra
    Thanks for yours valuable inputs . However these questons are created by you or its originally came acorss exam.

    pls confirm. beccause for associate exam few quesitions seems very tough and should be asked in professional exam.

    br//Arbind

    1. The ones with larger prose are professional ones for sure and are tough involving multiple services. You can concentrate on smaller ones.

43. Hello Jayendra,

    Can you justify the answer for Question number 34.

    Because i am suggesting answer would be B.

    1. Even though ELB is a managed service, AWS launches an EC2 instance in an AZ for routing the traffic. If the AZ goes down the ELB is going to go down as well. If you attach 2 AZs to ELB, AWS launches ELB instances in the 2 AZs, which can route traffic traffic.

       1. Hello Jayendra,

          Can we have two public subnets where we can have ELBs and WebServers and two private subnets for RDS instances, since we need to assure only the DB is not available from the Internet.

          1. You can have that combination as well as the requirement is for database only, however that is no a part of the answer.

             1. Agree with you, I just wanna know the possibility, Jayendra. Thanks Much

44. Hello Jayendra,

    Could you please help explain question 5? Via VPC wizard, the default subnet is public subnet, right? Why the answer is B, not D?

    Thank you

    Claire

    1. They are not public by default. It creates a public and private subnet, which are associated with custom and main route table.

       Refer VPC Scenario 2

       A custom route table associated with the public subnet. This route table contains an entry that enables instances in the subnet to communicate with other instances in the VPC over IPv4, and an entry that enables instances in the subnet to communicate directly with the Internet over IPv4.

       The main route table associated with the private subnet. The route table contains an entry that enables instances in the subnet to communicate with other instances in the VPC over IPv4, and an entry that enables instances in the subnet to communicate with the Internet through the NAT gateway over IPv4.

       The idea is when you create a subnet, it is by default associated with the main route table. And it is best to have the main route table not exposed to IGW so that the subnet is private by default.

       1. Many thank for your help.

45. It’s a great website that you can learn AWS and get AWS certifications.
    Thanks.

    1. Thanks Kai, happy to help ..

46. question 14, 20 and 21 seems a bit confusing . Can u please clarify my doubts?

    In the answer q 14 , you say that “Yes, the console will delete all the setups and detach the virtual private gateway”
    in q20 you say that “A NAT instance configured to allow the VPN subnet instances to connect with the internet” is not present when the VPC is setup with the wizard.

    but in q21 u say that “It will not allow to delete the VPC since it has a running NAT instance”

    In all the questions the setup seems to be the same (viz. a public subnet and a private net).

    Please clarify my doubts .
    Thanks

    1. q-14, is using VPC public and VPN subnets.
       q-20 is also using VPC public and VPN subnets and a NAT instance is not created in this setup. Refer Scenario 3
       q-21 is refering VPC with public and private subnets where a NAT instance was created before to allow instances in private subnet to reach internet. Refer scenario 2

       1. Hi Jayendra, You mentioned in Q14 VPG is attached. While testing it shows that we need to detach the VPG first and then delete VPC. But your correct answer says it will directly delete VPC and it will detach VPG automatically.

          Also could you please help little more to understand the use cases on VPG, VPN endpoints, Customer Gateway and VPC endpoints?

          1. As per the previous AWS documentation, deletion was possible but might have been updated since. Text as below –

             You can delete your VPC at any time (for example, if you decide it’s too small). However, you must terminate all instances in the VPC first.When you delete a VPC using the VPC console, we delete all its components, such as subnets, security groups, network ACLs, route tables, Internet gateways, VPC peering connections, and DHCP options.If you have a VPN connection, you don’t have to delete it or the other components related to the VPN(such as the customer gateway and virtual private gateway). If you plan to use the customer gatewaywith another VPC, we recommend you keep the VPN connection and the gateways. Otherwise, yournetwork administrator must configure the customer gateway again after you create a new VPN connection.

             VGW and CGW are required to establish VPN connections between your premises and AWS VPC. VGW is on AWS side while CGW is on your side.
             VPC endpoints help resources in AWS connect to AWS resources like S3 and DynamoDB through AWS internal network instead of internet providing low cost, high speed as well as security by keeping your resources private.

47. Hi Jay,

    Can you please help me in calculating IP’s in a particular CIDR block as i am not able to solve the questions which includes calculation of IP’s or solving overlapping IP’s. I am preparing for Solution Architect Associate level exam and my exam is in the next week please help me.

    1. Refer to https://www.lifewire.com/cidr-classless-domain-routing-818375 which provides a simple understanding. You just need to understand how many ips are available and whats the range.

    2. Refer to https://www.lifewire.com/cidr-classless-domain-routing-818375 which provides a simple understanding. You just need to understand how many ips are available and whats the range.

48. why are webservers in privare subnet?

    1. which question ?

49. in q.23 why 20.0.0.255 is not in private subnet??

    1. the last ip address is reserved.

50. q18-> VPC will launch one NAT instance with an elastic IP. the question is which is not correct. So VPC wont create NAT instance right? or i am missing something?

    1. VPC wizard used to create a NAT instance before the NAT gateway. So this statement is true.

51. Hi Jay,

    Q: VPC has IPv6 enabled. To initiate outbound only IPv6 traffic from a private subnet, you need to route it through:

    Answer: Egress only Internet gateway.

    can you please help me understand this.

    I thought its through nat gateway.

52. Hi, Can you please simplify explanation of how to identify the CIDR block overlapping scenarios. I see there are lot of questions mentioned here. I think I lack in some understanding which is why I cannot identity what IP range overlaps in a certain CIDR block.

    Can you please explain, or direct me to any simplified explanation?

    1. Sure will try to add a new topic on the same.

53. where’s 36.A’s link?

    1. Here you go @ https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithSecurityGroups.html#USER_WorkingWithSecurityGroups.Authorizing

       You can’t authorize an Amazon EC2 security group that is in a different AWS Region than your DB instance. You can authorize an IP range, or specify an Amazon EC2 security group in the same AWS Region that refers to IP address in another AWS Region. If you specify an IP range, we recommend that you use the private IP address of your Amazon EC2 instance, which provides a more direct network route from your Amazon EC2 instance to your Amazon RDS DB instance, and doesn’t incur network charges for data sent outside of the Amazon network.

       1. Thank you very much

54. Hello Jayendra,

    This is my 1st thread in this blog. So not sure if I have posted in correctly. Could you please respond when you get a chance.

    I am getting the below error while attaching an EIP to an instance in North Virginia. But do not see this error in Mumbai region. FYI my VPC and Security group is default for the EC2.

    “Network vpc-aab25fd0 is not attached to any internet gateway”

    Thanks in advance for looking into it.

    Cheeers,
    Bhabani

    1. Attached an Internet Gateway (IGW) to the VPC. Seems to be missing.

       1. But its a default VPC. Do you still need an IGW for a default VPC?

          1. Ah!!!! I realize by mistake I have deleted the defaulted IGW for that region. But not sure why even they allow to delete the default IGW or even the default VPC in the first place itself.

             1. And one more thing I observed. Although they are allowing to delete the default security group, IGW and Route table but you can not delete the default NACL. Why is it so Jayandra ???

55. for question no 20 ,i think custom route table for public subnet should be a right answer .Please clarify

    1. Question checks for components not present. Custom route table is created and associated with the public subnet.

56. Hi,

    Thanks for this helpful blog.
    Shouldn’t the answer for question 4 be the option ‘d’ and not ‘a’

    A user has launched an EC2 instance and installed a website with the Apache webserver. The webserver is running but the user is not able to access the website from the Internet. What can be the possible reason for this failure?
    a.The security group of the instance is not configured properly.
    bThe instance is not configured with the proper key-pairs.
    c.The Apache website cannot be accessed from the Internet.
    d.Instance is not configured with an elastic IP.

    Regards,
    Sheldon

    1. The website can still work if the Instance has an Public IP. Elastic IP is not mandatory.

57. Hi Jayendra,

    Thanks for this helpful blog.

    Below is still correct?

    CIDR block from private (non-publicly routable) IP address can be assigned
    172.16.0.0 – 172.31.255.255 (172.16/12 prefix)

    Thanks,
    Rajesh

    1. Thats right there are limited sets of private IP ranges that you can assigned as a part of RFC standards.

58. for query 10, why 20.0.54.0/24 is overlapping?

    1. o, I found the answer in previous comments.

59. Hi jayendrapatil,
    Greater blog.
    Q35: why choice 4 is correct. ELB doesn’t scale up. to me 5 and 2 are the correct answers. Would you 3xplain?
    Thanks
    Farzin

    1. Hi Farzin, refer to ELB documentation.
       ELB does need ip addressess and if it requires more if it scales.

       To ensure that your load balancer can scale properly, verify that each subnet for your load balancer has a CIDR block with at least a /27 bitmask (for example, 10.0.0.0/27) and has at least 8 free IP addresses. Your load balancer uses these IP addresses to establish connections with the instances.

       1. thanks for your reply.
          1. Does it apply to ELB classic only? The link you sent is just talks about classic.
          2. Does it create a new ENI once it scales out?
          Thanks,

          1. it applies to ALB as well as they scale as per the traffic as well.

       2. also: Why #2 is not correct? I know was receive 5 ip, however just one for DNS.

          1. AWS reserves 5 IP address, so its partial information.

       3. #35
          jayendrapatil, yes, ELB needs CIDR block with at least a /27 bitmask, then here it is difficult to count it as right answer, because elb and its associated instances should be in same subnet, but the question is the subnet is only defined /28. 16-7-5=4 left instances buffer. only e is the right one.

          1. Thats right Aaron, however given 2 options are needed that is the only one that makes sense.

60. thanks for your reply.
    1. Does it apply to ELB classic only? The link you sent is just talks about classic.
    2. Does it create a new ENI once it scales out?
    Thanks,

61. Hi Jayednrapatil, thanks for your usefull blog.

    I see that you mentioned the below point in IP Address section of VPC components.

    “A Network Interface can be assigned either a Public IP or an Elastic IP. If you assign an instance, already having an Public IP, an Elastic IP, the public IP is released”

    What i observed is if i assign elastic ip to the secondary private address of an instance the public ip associated with primary private address remains unchanged. In this case an instance can have both public and elastic ip as well.

    Thanks.

    1. As you are assigning the elastic ip to another network interface, both would co-exist. The statement is for a single network interface.

62. Hi Jayendra,

    I think for ques-4 the answer a is valid but d also could be a reason as if an instance is having any service running on it but not associated with an Elastic(public ) IP so in that case it would not be accessible to the user on internet in anyway.

    Please correct me if I am wrong.

    1. It can be publicly available using a public ip as well. Elastic IP is not mandatory.

63. Dear sir please correct question no 17 as i think answer is c

    1. Instance can be launched without a public/elastic ip with just the private ip.

64. As i test it question no 17 answer is b please i need your feekback

    1. Its just that option d is more complete. The question does not mention its a public subnet. So whether a internet gateway exists is doubtful.

65. Hi,
    for question 38 – if we this option , will that be a correct answer?
    You need to design a VPC for a web-application consisting of an ELB a fleet of web application servers, and an RDS DB. The entire infrastructure must be distributed over 2 AZ. Which VPC configuration works while assuring the DB is not available from the Internet?

    Answer:
    Two Public Subnets for ELB, two public Subnet for the web-servers, and two private subnet for the RDS

    1. The option would work. You need to choose the best option. If this is the only workable option, you can select this.
       However, public subnets are not needed.

66. Which of the following is used to build network segment?
    1. VPC
    2.Security Group
    3. NACLs
    4. DR

    Answer is 1,2,3 or 1,3 ?

    1. DR is Disaster recovery ??? might be just a course lesson quiz to answer that but then 1,2,3 are the only valid ones.

67. Thanks Jayendra sir for best blogs and sharing point wise knowledge to AWS aspirants. You are Rockstar!

    I am little confused with question 14

    A user has created a VPC with CIDR 20.0.0.0/16 using the wizard. The user has created both Public and VPN-Only subnets along with hardware VPN access to connect to the user’s data centre. The user has not yet launched any instance as well as modified or deleted any setup. He wants to delete this VPC from the console. Will the console allow the user to delete the VPC?

    How VPC can be deleted if it has NAT running instance? In question 21 it has different answer. which one is correct?

    1. Q. 14 is without the Private Subnet and does not create a NAT instance. Q.21 is with Private and would create a NAT instance when created with Wizard.

68. Hi Jayendra sir. thanks for writing such a best blog.

    My question is realted with 14 and 21.

    Whether VPC can be deleted using wizard with deletion of all setup and detaching VPG or it will be blocked because of running NAT instance?

    answers are different in 14 and 21. Please throw some light.

    1. The Scenario is different for 14 and 21. VPN one does not create a NAT Instance.

69. Hi Jayendra,
    I believe this statement under VPC Internet Gateway should be “To perform network address translation (NAT) for instances that have NOT been assigned public IP addresses”.

    1. Thanks Bhargav, corrected the same.

70. Hi Jay,

    Can u please explain Q:41

    1. B as the instance needs to either have a public IP or Elastic IP address to be reachable from internet.

71. Hi Jayendra,
    Regarding below question : I believe the answer is the private subnet should be able to connect to both the subnets on premise. Please let me know if I am wrong.

    10. A user has setup a VPC with CIDR 20.0.0.0/16. The VPC has a private subnet (20.0.1.0/24) and a public subnet (20.0.0.0/24).
    The user’s data centre has CIDR of 20.0.54.0/24 and 20.1.0.0/24. If the private subnet wants to communicate with the data centre, what will happen?
    It will allow traffic communication on both the CIDRs of the data centre
    It will not allow traffic with data centre on CIDR 20.1.0.0/24 but allows traffic communication on 20.0.54.0/24
    It will not allow traffic communication on any of the data centre CIDRs
    It will allow traffic with data centre on CIDR 20.1.0.0/24 but does not allow on 20.0.54.0/24 (as the CIDR block would be overlapping)

    Logic :
    20.0.1.0/24 = 20.0.1.0/20.0.1.255
    20.0.54.0/24 = 20.0.54.0/54.255
    20.1.0.0/24 = 20.1.0.0/20.1.0.255

    1. VPC CIDR should not overlap and not the individual Subnets.
       Confirm that the on-premises and VPC private networks are not overlapping, because overlapping subnets can cause routing issues over the VPN tunnel.

72. Hi Jayendra,

    Stuck with this-

    1. SIngle VPC- CIDR created and working – 10.253.242.0/24
    2. New CIDR created- 10.253.243.0/24

    Problem-
    The instances deployed in the new CIDR (diff private subnets) cannot access Internet or VPC endpoints like S3. Old instances in old CIDR are perfectly fine.

    Checked and validated the following-
    1. IGW is present in the public subnet (mgmt)
    2. NAT GW is created and routes configured in each private subnet
    3. SGs allow all outbound traffic to 0.0.0.0

    What can be the issue?

Comments are closed.