Virtual Private Cloud (VPC) Design Questions and Answers for Viva

Answer-1: A VPC is a logically isolated section of a cloud provider's network where users can launch resources in a virtual network they define.

Answer-2: VPC allows control over networking features like IP address ranges, subnets, route tables, and gateways to securely host cloud resources.

Answer-3: A subnet is a range of IP addresses in your VPC. You can create public or private subnets to segment your network.

Answer-4: A public subnet is connected to the internet via an internet gateway, while a private subnet is isolated or has restricted outbound access.

Answer-5: An IGW is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet.

Answer-6: A NAT Gateway allows instances in a private subnet to access the internet while preventing incoming traffic from the internet.

Answer-7: A route table contains rules that determine where network traffic is directed.

Answer-8: VPC peering enables communication between VPCs using private IPs as if they were part of the same network.

Answer-9: Yes, this is known as inter-region VPC peering, allowing VPCs in different regions to communicate.

Answer-10: CIDR (Classless Inter-Domain Routing) block defines the IP address range of your VPC or subnet.

Answer-11: You can have up to 5 IPv4 CIDR blocks and 1 IPv6 CIDR block in a VPC (limits may vary by provider).

Answer-12: A security group acts as a virtual firewall for your instance to control inbound and outbound traffic.

Answer-13: A network ACL is a stateless firewall for controlling traffic in and out of subnets in a VPC.

Answer-14: Security groups are stateful and applied to instances, while network ACLs are stateless and applied to subnets.

Answer-15: VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC.

Answer-16: Use security groups, network ACLs, encryption, and VPNs for secure data transfer.

Answer-17: A VPN connection securely connects your on-premises network to your VPC over an encrypted internet connection.

Answer-18: A Transit Gateway is a service that connects multiple VPCs and on-premises networks through a central hub.

Answer-19: A bastion host is a special-purpose instance used to securely access instances in private subnets via SSH or RDP.

Answer-20: DHCP options sets allow control over domain name settings for instances in your VPC.

Answer-21: Yes, you can add or remove secondary CIDR blocks to/from a VPC.

Answer-22: Create separate subnets for different tiers (web, app, DB) and isolate public/private resources.

Answer-23: Distribute resources across multiple Availability Zones (AZs) and subnets.

Answer-24: AZs are isolated locations within a cloud region offering redundancy and fault tolerance.

Answer-25: No, a single VPC resides within a single region but can connect to others via VPC peering or Transit Gateway.

Answer-26: Elastic IP is a static, public IPv4 address that can be associated with instances or NAT Gateways in a VPC.

Answer-27: Enable VPC Flow Logs and send them to CloudWatch or S3 for analysis and monitoring.

Answer-28: A customer gateway is a resource that represents your on-premises VPN device.

Answer-29: A virtual private gateway is a VPN concentrator on the cloud side of a VPN connection.

Answer-30: Yes, using VPC peering or a Transit Gateway allows private communication without internet access.

Answer-31: Subnet routing defines how traffic from a subnet is directed based on route tables and gateways.

Answer-32: It's a gateway for IPv6 traffic that allows outbound-only communication to the internet from VPC instances.

Answer-33: You can associate IPv6 CIDR blocks with a VPC and its subnets to enable IPv6 communication.

Answer-34: Use CIDR efficiently, consider private IP ranges, and use NAT for outbound internet access.

Answer-35: DNS resolution allows instances to resolve domain names to IP addresses using Route 53 Resolver or cloud DNS services.

Answer-36: A default VPC is pre-configured with default settings, while a custom VPC is created with custom configurations.

Answer-37: It allows the VPC route table to dynamically learn routes from attached VPN or Transit Gateways.

Answer-38: Use separate subnets, route tables, security groups, and NACLs for workload separation.

Answer-39: Use VPC Flow Logs, CloudWatch metrics, and third-party tools for traffic analysis.

Answer-40: Interface endpoints and gateway endpoints, used to privately connect to supported services.

Answer-41: It is used to connect to AWS services like S3 and DynamoDB without going through the internet.

Answer-42: It provides private connectivity to services over private IPs using ENIs in your VPC.

Answer-43: AWS imposes default limits (e.g., subnets, route tables) that can often be increased via support requests.

Answer-44: AWS PrivateLink enables private connectivity between VPCs and services without using public IPs.

Answer-45: It allows services hosted on AWS to be privately accessed by other VPCs using PrivateLink.

Answer-46: By creating separate subnets, security policies, and resource tagging to logically isolate tenants.

Answer-47: Components include NAT Gateway, VPN, Transit Gateway, and data transfer costs.

Answer-48: Improper routing can cause loss of connectivity or exposure of private resources to the public.

Answer-49: Use VPNs, Direct Connect, and migration tools while designing matching subnets and routing rules.

Answer-50: Consider IP planning, subnetting, security policies, high availability, and compliance requirements.