CLF-C02 - Cloud Technology and Services (34% of the exam) - Section 3.8

Identify AWS network services and the components of a VPC, including subnets, gateways, security groups, network ACLs, Amazon Route 53 and connectivity options such as AWS VPN and AWS Direct Connect.

Identify the core components of an Amazon VPC, including subnets, internet gateways, route tables, security groups, and network ACLs, and how they control traffic. Recognise Amazon Route 53 for DNS routing, and distinguish AWS VPN, an encrypted tunnel over the internet, from AWS Direct Connect, a dedicated private link from on-premises to AWS.

Amazon VPCAmazon Route 53AWS Direct ConnectSubnets and gateways

Practice question for this objective

Free sampleCloud Technology and Servicesmedium

A company wants to link its on-premises data centre directly to its Amazon VPC so that internal servers can reach AWS resources over a private path rather than across the open public internet to a website. Which TWO AWS options establish this kind of private connectivity between the data centre and AWS? (Select TWO.)

AAWS Site-to-Site VPN, which builds an encrypted tunnel from the data centre to the VPC over the existing internet link Correct
BAWS Direct Connect, which provides a dedicated private physical line from the data centre into AWS Correct
CAmazon Route 53, which directs end users to resources by resolving public domain names into IP addresses
DAmazon CloudFront, which speeds public content delivery by caching files at edge locations near viewers
EAn internet gateway, which lets resources in a public subnet send and receive public internet traffic

Identify AWS Site-to-Site VPN and AWS Direct Connect as the options for private connectivity between an on-premises data centre and an Amazon VPC. Site-to-Site VPN reaches the VPC through an encrypted tunnel over the internet, while Direct Connect uses a dedicated private physical circuit. Both join an on-premises network to AWS privately, whereas Route 53, CloudFront and an internet gateway serve public-facing roles instead.

Why A is correct: Site-to-Site VPN creates an encrypted private tunnel connecting an on-premises network to a VPC quickly.

Why B is correct: Direct Connect supplies a dedicated private physical connection for consistent throughput into AWS.

Why C is wrong: Route 53 is a public DNS service for name resolution and does not create a private link to a data centre.

Why D is wrong: CloudFront accelerates public content delivery and does not connect a data centre privately to a VPC.

Why E is wrong: An internet gateway enables public internet access for a VPC and is not a private data-centre link.

See more CLF-C02 practice questions, answers explained.

Exam traps in Cloud Technology and Services

Answers that look right on this material and are not. Each one is a distractor from a different question in the CLF-C02 bank for this domain.

Amazon Route 53 hosted zones that translate registered domain names into IP addresses
Why it is wrong: Route 53 is a global DNS service that resolves domain names, not a component contained inside a single VPC.
AWS Direct Connect, providing a dedicated private physical link from the data centre into AWS
Why it is wrong: Direct Connect gives consistent private performance but needs a dedicated physical circuit to be provisioned, so it is neither quick to set up nor carried over the public internet.
An AWS Site-to-Site VPN, which gives a dedicated private physical line from the company data centre into AWS for more consistent network performance
Why it is wrong: A Site-to-Site VPN is an encrypted tunnel that still travels over the public internet, so it is not the dedicated private physical line the company wants.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.