Here are 50 top questions and detailed answers on AWS VPC:

Basics of AWS VPC

1. What is AWS VPC?

AWS VPC (Virtual Private Cloud) is a service that allows you to provision a logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define. It gives you complete control over your virtual networking environment, including IP address ranges, subnets, route tables, and network gateways.

2. What are the key components of AWS VPC?

The key components of AWS VPC include:

• Subnets
• Route tables
• Internet gateways
• NAT gateways
• Security groups
• Network Access Control Lists (NACLs)
• VPC endpoints
• Elastic IP addresses
• VPC peering connections

3. What is a subnet in AWS VPC?

A subnet is a range of IP addresses within your VPC. You can launch AWS resources, such as EC2 instances, into specific subnets. Subnets can be public (with direct access to the internet) or private (without direct internet access).

4. What is the difference between a public and private subnet?

• Public subnet: Has a route to the internet via an Internet Gateway
• Private subnet: Does not have a direct route to the internet

5. What is an Internet Gateway?

An Internet Gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.

VPC Configuration

6. How do you create a VPC?

To create a VPC:

1. Go to the VPC Dashboard in the AWS Management Console
2. Click “Create VPC”
3. Specify the IPv4 CIDR block
4. Configure other settings as needed
5. Click “Create VPC”

7. What is the maximum number of VPCs you can create per region?

By default, you can create up to 5 VPCs per region. This limit can be increased by contacting AWS support.

8. What is the largest IPv4 CIDR block size for a VPC?

The largest IPv4 CIDR block size for a VPC is /16 (65,536 IP addresses).

9. Can you change the size of a VPC after creation?

No, you cannot change the size of a VPC after creation. However, you can add secondary CIDR blocks to expand the IP address range.

10. What is a default VPC?

A default VPC is automatically created in each AWS region when you create a new AWS account. It comes preconfigured with default settings to make it easier to get started with EC2 instances.

Networking and Connectivity

11. What is VPC peering?

VPC peering is a networking connection between two VPCs that enables you to route traffic between them using private IP addresses.

12. What is a NAT Gateway?

A NAT (Network Address Translation) Gateway allows instances in a private subnet to connect to the internet or other AWS services while preventing the internet from initiating connections to those instances.

13. What is the difference between a NAT Gateway and a NAT Instance?

• NAT Gateway: Managed by AWS, highly available, automatic scaling
• NAT Instance: Self-managed EC2 instance, requires manual configuration and scaling

14. What is a VPC Endpoint?

A VPC Endpoint enables you to privately connect your VPC to supported AWS services without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection.

15. What types of VPC Endpoints are available?

There are three types of VPC Endpoints:

• Interface Endpoints
• Gateway Endpoints
• Gateway Load Balancer Endpoints

Security and Access Control

16. What is a Security Group?

A Security Group acts as a virtual firewall for your EC2 instances to control inbound and outbound traffic. It operates at the instance level.

17. What is a Network ACL (NACL)?

A Network ACL is an optional layer of security that acts as a firewall for controlling traffic in and out of subnets. It operates at the subnet level.

18. What is the difference between Security Groups and NACLs?

• Security Groups: Stateful, operate at instance level, allow rules only
• NACLs: Stateless, operate at subnet level, allow and deny rules

19. Can you use IAM roles with VPC?

Yes, you can use IAM roles to control access to VPC resources and actions.

20. How can you secure data in transit within a VPC?

You can secure data in transit within a VPC by using:

• SSL/TLS encryption
• VPN connections
• AWS PrivateLink

Advanced VPC Features

21. What is VPC Flow Logs?

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC.

22. What is AWS PrivateLink?

AWS PrivateLink is a feature that enables you to access services over AWS network instead of the public internet, improving security and reducing data transfer costs.

23. What is a Transit Gateway?

A Transit Gateway is a network transit hub that you can use to interconnect your VPCs and on-premises networks.

24. What is VPC sharing?

VPC sharing allows multiple AWS accounts to create their application resources, such as EC2 instances, RDS databases, Redshift clusters, and Lambda functions, into shared, centrally-managed VPCs.

25. What is a Bastion Host?

A Bastion Host is an EC2 instance that serves as a secure, controlled means of accessing instances in a private subnet from an external network.

Best Practices and Design Patterns

26. What is the recommended design for a multi-tier application in VPC?

A recommended design for a multi-tier application in VPC includes:

• Public subnet for load balancers
• Private subnet for application servers
• Private subnet for database servers

27. How can you implement high availability in VPC?

To implement high availability in VPC:

• Use multiple Availability Zones
• Implement Auto Scaling
• Use Elastic Load Balancing
• Design for fault tolerance

28. What is the best practice for IP addressing in VPC?

Best practices for IP addressing in VPC include:

• Use private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Plan for future growth
• Use consistent CIDR blocks across VPCs

29. How can you monitor VPC performance?

You can monitor VPC performance using:

• Amazon CloudWatch
• VPC Flow Logs
• AWS Config
• AWS CloudTrail

30. What is the recommended way to connect multiple VPCs?

The recommended ways to connect multiple VPCs are:

• VPC Peering for simple connections
• AWS Transit Gateway for more complex network topologies

Troubleshooting and Common Issues

31. How can you troubleshoot connectivity issues in VPC?

To troubleshoot connectivity issues in VPC:

1. Check Security Group rules
2. Verify NACL rules
3. Ensure proper route table configuration
4. Check VPC peering or VPN connection status
5. Verify instance network configuration

32. What should you do if you run out of IP addresses in your VPC?

If you run out of IP addresses in your VPC, you can:

• Add a secondary CIDR block to the VPC
• Create a new VPC with a larger CIDR block and migrate resources

33. How can you resolve DNS resolution issues in VPC?

To resolve DNS resolution issues in VPC:

1. Ensure DNS hostnames and DNS resolution are enabled
2. Check DHCP options set
3. Verify security group and NACL rules allow DNS traffic
4. Check Route 53 configuration if using custom DNS

34. What are common causes of VPC peering failures?

Common causes of VPC peering failures include:

• Overlapping CIDR blocks
• Incorrect route table configuration
• Security group or NACL restrictions
• Exceeding peering connection limits

35. How can you troubleshoot NAT Gateway issues?

To troubleshoot NAT Gateway issues:

1. Check the NAT Gateway’s state
2. Verify route table configuration
3. Ensure Elastic IP is associated
4. Check security group and NACL rules
5. Verify instance configuration in private subnets

VPC Costs and Optimization

36. What are the main cost factors for VPC?

Main cost factors for VPC include:

• NAT Gateway usage
• VPN connection hours
• Data transfer
• VPC endpoints

37. How can you optimize VPC costs?

To optimize VPC costs:

• Use VPC endpoints to reduce data transfer costs
• Optimize NAT Gateway usage
• Use VPC peering instead of VPN where possible
• Implement proper tagging for cost allocation

38. Are there any charges for creating a VPC?

No, there are no charges for creating a VPC itself. You are charged for resources you use within the VPC and data transfer.

39. How does data transfer pricing work in VPC?

Data transfer pricing in VPC depends on:

• Direction of transfer (in/out)
• Source and destination of transfer
• Whether transfer is within same AZ, between AZs, or to/from internet

40. What is the cost difference between NAT Gateway and NAT Instance?

NAT Gateway is typically more expensive but offers better availability and scalability. NAT Instance costs depend on the EC2 instance type used.

VPC Integration with Other AWS Services

41. How does VPC integrate with Amazon RDS?

Amazon RDS can be launched within a VPC, allowing you to isolate your database instances. You can control network access using security groups and NACLs.

42. How can you use VPC with AWS Lambda?

You can configure Lambda functions to access resources within your VPC by associating them with VPC subnets and security groups.

43. How does VPC work with Amazon S3?

You can use VPC endpoints to privately access S3 from your VPC without using an internet gateway or NAT device.

44. Can you use Elastic Load Balancing with VPC?

Yes, you can use Elastic Load Balancing within your VPC to distribute traffic across multiple EC2 instances in different Availability Zones.

45. How does Amazon ECS integrate with VPC?

Amazon ECS tasks and services can be launched within your VPC, allowing you to use VPC security features and private networking for your containers.

VPC Limits and Quotas

46. What is the maximum number of subnets per VPC?

The default limit is 200 subnets per VPC, but this can be increased by contacting AWS support.

47. How many Internet Gateways can you attach to a VPC?

You can attach only one Internet Gateway to a VPC.

48. What is the limit on the number of route tables per VPC?

The default limit is 200 route tables per VPC.

49. How many security groups can you create per VPC?

The default limit is 500 security groups per VPC.

50. What is the maximum number of rules per security group?

The default limits are:

• 60 inbound rules
• 60 outbound rules
• 16 security group references (in inbound or outbound rules)

These limits can be adjusted by contacting AWS support.