Mixed Self-Check

How to use this self-check

Before answering the final question, work through these prompts on paper without looking back. 1. How many usable IPs does an AWS /26 subnet have? (64 minus 5 = 59.) 2. A subnet's route table has 10.0.0.0/16 -> local and 0.0.0.0/0 -> nat-.... Is it public? (No; it uses NAT, not an internet gateway.) 3. Which control would you use to block one hostile IP for a whole subnet? (A NACL deny rule with a low rule number.) 4. Three VPCs must all talk and more are coming. Peering or transit gateway? (Transit gateway.) 5. A vendor's VPC overlaps yours and you need one of its APIs. (PrivateLink.) 6. Flow logs show inbound ACCEPT but outbound REJECT for replies. (A stateless NACL missing ephemeral ports.) If you missed any, reread that section's concept segment; each answer maps to one topic in this course, so gaps point straight to what to revise.

Spaced repetition beats rereading

Revisit these questions after one day, then after a week. Retrieval practice, recalling an answer before checking it, builds memory far better than reading the same notes again.

Verify question 1 yourself

Quick arithmetic check of usable addresses for a few prefix lengths in AWS.

for prefix in (24, 26, 28):
    total = 2 ** (32 - prefix)
    print(f"/{prefix}: total={total} usable={total - 5}")

Output:

/24: total=256 usable=251
/26: total=64 usable=59
/28: total=16 usable=11

त्वरित जाँच: A web server in a public subnet answers on 443, but users time out. The SG allows 443 from 0.0.0.0/0, the route table has 0.0.0.0/0 -> IGW and the instance has a public IP. What should you check next?

• The subnet's NACL, including outbound ephemeral ports
• Whether the VPC is peered
• Whether a gateway endpoint exists for S3
• The transit gateway route table