How does CloudFront Field-Level Encryption protect highly sensitive user input (such as credit card numbers) all the way to a backend microservice?

CloudFront encrypts up to 10 specific POST form fields at the Edge Location using an asymmetric RSA public key immediately upon receipt. The sensitive fields remain encrypted throughout the CloudFront cache and ALB/application tier until decrypted by the specific backend service holding the private key.

How do you achieve both dedicated private bandwidth and end-to-end IPsec encryption between an on-premises data center and multiple VPCs across Regions?

Establish an AWS Direct Connect connection to a Direct Connect Gateway, create a Transit VIF to an AWS Transit Gateway, and configure an AWS Site-to-Site VPN attachment over the Transit VIF (or use Site-to-Site VPN as an automated encrypted backup connection).

How does AWS Transit Gateway simplify connecting hundreds of VPCs and on-premises networks compared to VPC Peering?

Instead of managing a full mesh of N*(N-1)/2 VPC Peering connections, AWS Transit Gateway acts as a regional hub-and-spoke network router supporting transitive routing across attached VPCs, Site-to-Site VPNs, and Direct Connect Gateways, as well as cross-Region Transit Gateway peering and IP multicast.

How do you make a NAT Gateway deployment resilient to an Availability Zone failure?

Because a single NAT Gateway is resilient only within its own Availability Zone, a Multi-AZ architecture requires deploying an independent NAT Gateway in a public subnet in each Availability Zone and configuring each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in its same AZ.

How can a SaaS provider expose a microservice running in their VPC to thousands of customer VPCs without VPC Peering and even when CIDR blocks overlap?

Use AWS PrivateLink (VPC Endpoint Service): the SaaS provider places a Network Load Balancer (NLB) in front of the service and creates an Endpoint Service. Customers create an Interface VPC Endpoint (ENI) in their own VPC, enabling private, unidirectional connectivity over the AWS backbone regardless of overlapping IP ranges.

What are the two ways to restrict geographic access to content served by Amazon CloudFront?

You can use CloudFront Geo-Restriction (allowlist or blocklist by country based on GeoIP database) or attach an AWS WAF Web ACL with a Geo-Match rule (which also allows combining geographic checks with rate-limiting or custom header conditions).

Compare Latency-Based, Geolocation, Geoproximity, and Weighted routing policies in Amazon Route 53.

Latency routes users to the AWS Region offering the lowest network round-trip time. Geolocation routes based on the user's exact continent, country, or US state (ideal for regulatory/content localization). Geoproximity routes based on geographic distance with configurable Bias values to expand or shrink traffic regions. Weighted assigns relative traffic percentages across endpoints (ideal for blue/green testing).

Compare Active/Passive and Active/Active high-availability topologies in AWS Direct Connect.

A single Direct Connect connection at one location provides no SLA. Development/non-critical workloads use 2 connections at 1 or 2 locations. Maximum resiliency (99.99% SLA) requires at least 2 independent Direct Connect locations, each with 2 redundant connections terminating on separate customer routers.

Compare CloudFront Signed URLs and CloudFront Signed Cookies for delivering paid or restricted media content.

Use a CloudFront Signed URL when granting temporary access to a single individual file (such as a software download or single PDF). Use CloudFront Signed Cookies when granting access to multiple restricted files (such as HLS video streaming segments or an entire subscriber-only website section) without changing the asset URLs.

What is the difference between a Route 53 Alias Record and a standard DNS CNAME Record?

A Route 53 Alias Record works at the zone apex (root domain like example.com) as well as subdomains, automatically tracks IP changes of AWS resources, and queries to AWS Alias targets (ALB, NLB, CloudFront, S3 website, API Gateway) are free. A CNAME cannot be used at the zone apex and incurs standard DNS query charges.

How does Route 53 Geolocation Routing handle requests from locations that do not match any configured geographic rule?

You should always configure a 'Default' location record in Route 53 Geolocation Routing; without a Default record, Route 53 returns a 'no answer' (NXDOMAIN/SERVFAIL) response for queries originating from unmapped geographic regions or IP addresses.

What information is captured in VPC Flow Logs, and what destinations can receive them?

VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, byte/packet counts, and ACCEPT/REJECT action) at the VPC, Subnet, or ENI level. They can be published directly to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose.

What are the three types of Virtual Interfaces (VIFs) in AWS Direct Connect, and what does each access?

1. Public VIF: accesses AWS public service endpoints (such as S3 and DynamoDB public IPs) over Direct Connect. 2. Private VIF: connects to a Virtual Private Gateway (VGW) or Direct Connect Gateway to reach private VPC IP addresses. 3. Transit VIF: connects to a Direct Connect Gateway associated with an AWS Transit Gateway.

Compare Dedicated Connections and Hosted Connections in AWS Direct Connect.

A Dedicated Connection is a physical Ethernet port (1 Gbps, 10 Gbps, 100 Gbps, or 400 Gbps) dedicated to a single customer and ordered directly from AWS. A Hosted Connection is a logical connection (50 Mbps up to 25 Gbps) provisioned on demand through an AWS Direct Connect Delivery Partner over shared physical ports.

How do Amazon CloudFront Origin Groups provide high availability for origins?

A CloudFront Origin Group consists of a primary origin and a secondary origin (such as two S3 buckets in different Regions with CRR enabled). If the primary origin returns specific HTTP 4xx or 5xx status codes (or times out), CloudFront automatically fails over the GET/HEAD/OPTIONS request to the secondary origin.

What is an Egress-Only Internet Gateway, and why is it needed when IPv6 is enabled in a VPC?

All IPv6 addresses assigned in AWS VPC are publicly routable (there is no NAT for IPv6). An Egress-Only Internet Gateway allows instances in private subnets to initiate outbound IPv6 connections to the internet (::/0) while blocking any unsolicited inbound IPv6 connections from the internet.

Compare CloudFront Functions and Lambda@Edge for customizing edge requests and responses.

CloudFront Functions run at Edge Locations in a lightweight JavaScript runtime with sub-millisecond execution (scales to millions of req/s) for Viewer Request/Response header manipulation, URL rewrites, and JWT validation. Lambda@Edge runs Node.js or Python at Regional Edge Caches across all 4 trigger points (Viewer/Origin Request/Response) with up to 30s timeout and network/file system access.

What makes a VPC subnet a 'Public Subnet' versus a 'Private Subnet', and where must a NAT Gateway be deployed?

A Public Subnet has a route table entry directing 0.0.0.0/0 (or ::/0) to an Internet Gateway (IGW), whereas a Private Subnet has no direct route to an IGW. A Public NAT Gateway must be deployed inside a Public Subnet (with an Elastic IP) so Private Subnets can route 0.0.0.0/0 to it for outbound internet access (whereas a Private NAT Gateway needs no IGW or Elastic IP and is used for private-to-private NAT across peered VPCs or on-premises networks).

Compare Gateway VPC Endpoints and Interface VPC Endpoints (AWS PrivateLink).

Gateway Endpoints support only Amazon S3 and Amazon DynamoDB, are completely free, and work by adding prefix-list target entries to VPC Route Tables. Interface Endpoints (powered by AWS PrivateLink) support hundreds of AWS services and custom endpoints, provision Elastic Network Interfaces (ENIs) with private IPs inside your subnets, use Security Groups, and incur hourly + per-GB charges.

How is AWS Network Firewall deployed in a VPC to inspect and filter outbound domain traffic or IPS signatures?

AWS Network Firewall is deployed into dedicated firewall subnets in each Availability Zone using Gateway Load Balancer endpoints. VPC route tables are updated to route ingress/egress traffic through the firewall endpoints for stateful domain filtering, Suricata IPS signature matching, and TLS inspection.

How can an administrator troubleshoot why an EC2 instance cannot reach another EC2 instance across a Transit Gateway without sending actual network packets?

Use VPC Reachability Analyzer, which performs static configuration analysis across Security Groups, NACLs, Route Tables, VPC Peering, Transit Gateways, and NAT Gateways to identify the exact component blocking the network path.

Compare Amazon CloudFront and AWS Global Accelerator in terms of caching, protocols, and IP addresses.

CloudFront caches HTTP/HTTPS content at 600+ Edge Locations to reduce origin load and latency for cacheable and dynamic web assets. AWS Global Accelerator does not cache content; it provides two static Anycast IPv4 addresses that route TCP or UDP traffic (gaming, VoIP, IoT, financial APIs) onto the AWS global backbone at the nearest edge and perform instant endpoint health failover across Regions.

When does Route 53 Failover Routing trigger a failover, and what differs between Active-Passive and Active-Active configurations?

In Active-Passive Failover, a Primary record is monitored by a Route 53 Health Check; if unhealthy, DNS automatically resolves to the Secondary (DR) record. In Active-Active, multiple records share a non-failover policy (e.g., Latency or Weighted) with Health Checks attached so unhealthy endpoints are removed from rotation.

What problem occurs when an EC2 instance in a private subnet downloads terabytes of data from Amazon S3 through a NAT Gateway, and how do you eliminate that cost?

Traffic routed through a NAT Gateway incurs per-GB NAT Gateway data processing charges ($0.045/GB). Adding a free Gateway VPC Endpoint for Amazon S3 to the private subnet's route table routes S3 traffic directly over the AWS network, eliminating NAT Gateway data processing fees.

How does AWS VPN CloudHub work when connecting multiple remote branch offices?

AWS VPN CloudHub uses a single Virtual Private Gateway (VGW) or Transit Gateway with multiple Customer Gateways (one per branch office) using BGP routing over IPsec VPN tunnels, allowing branch offices to communicate both with the VPC and directly with each other in a hub-and-spoke topology.

When should an architect use a Gateway VPC Endpoint versus an Interface VPC Endpoint for Amazon S3?

Use a Gateway VPC Endpoint (free) when accessing S3 or DynamoDB from resources inside the same VPC. Use an Interface VPC Endpoint (AWS PrivateLink) for S3 or DynamoDB when accessing them privately from on-premises networks over Direct Connect or Site-to-Site VPN, from peered VPCs in another Region, or when requiring security-group filtering on the endpoint ENI.

Compare AWS Site-to-Site VPN and AWS Direct Connect in terms of provisioning time, encryption, and bandwidth consistency.

Site-to-Site VPN can be provisioned in minutes, provides built-in IPsec encryption, and offers up to 1.25 Gbps per tunnel over the public internet (variable latency). Direct Connect provides a dedicated physical fiber connection (1 Gbps to 100 Gbps) with consistent low latency and private network transit, takes weeks to provision, and is not encrypted by default unless paired with MACsec or an IPsec VPN over Direct Connect.

How many IP addresses does AWS reserve in every VPC subnet CIDR block, and what are those five addresses used for?

AWS reserves 5 IP addresses in every subnet (first 4 and last 1). For example, in 10.0.0.0/24: .0 is the network address, .1 is reserved for the VPC router, .2 is reserved for the AWS DNS server, .3 is reserved for future use, and .255 is the network broadcast address.

Compare Security Groups and Network Access Control Lists (NACLs) in Amazon VPC.

Security Groups operate at the ENI/instance level, are stateful (return traffic is automatically allowed regardless of outbound rules), and support Allow rules only. NACLs operate at the subnet boundary, are stateless (both inbound and outbound return traffic on ephemeral ports must be explicitly permitted), and support numbered Allow and Deny rules evaluated in order.

Why is AWS Global Accelerator superior to DNS-based failover when client devices aggressively cache DNS records?

Because Global Accelerator exposes fixed Anycast IP addresses that never change, failing over between ALB, NLB, or EC2 endpoints in different AWS Regions happens at the network routing layer within seconds after a health check failure, completely bypassing client and ISP DNS TTL caching.

How do Route 53 Resolver Inbound and Outbound Endpoints enable hybrid DNS resolution between on-premises networks and Amazon VPCs?

An Inbound Endpoint provides IP addresses inside the VPC where on-premises DNS servers can forward queries for VPC private hosted zones (e.g., *.internal.example.com). An Outbound Endpoint uses Forwarding Rules to forward DNS queries originating inside the VPC to on-premises corporate DNS resolvers.

What are the limitations of VPC Peering regarding transitive routing and overlapping CIDR blocks?

VPC Peering does not support overlapping IPv4 CIDR blocks and does not support transitive routing—if VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot communicate with VPC C through VPC B unless a direct peering connection (or AWS Transit Gateway) is established.

Network Security: Amazon VPC, NACLs, PrivateLink, VPN, CloudFront & Network Firewall

Cloud network security and hybrid connectivity covering VPC subnets, Security Groups vs NACLs, NAT Gateways, PrivateLink, Transit Gateway, IPsec VPN, Direct Connect encryption, CloudFront security, and AWS Network Firewall.

Level: intermediate
Languages: en → en
Cards: 32
Markdown: Network Security: Amazon VPC, NACLs, PrivateLink, VPN, CloudFront & Network Firewall (.md)

Flashcards (32)

#	Front (Term / Question)	Back (Definition / Answer)
1	How does CloudFront Field-Level Encryption protect highly sensitive user input (such as credit card numbers) all the way to a backend microservice?	CloudFront encrypts up to 10 specific POST form fields at the Edge Location using an asymmetric RSA public key immediately upon receipt. The sensitive fields remain encrypted throughout the CloudFront cache and ALB/application tier until decrypted by the specific backend service holding the private key.
2	How do you achieve both dedicated private bandwidth and end-to-end IPsec encryption between an on-premises data center and multiple VPCs across Regions?	Establish an AWS Direct Connect connection to a Direct Connect Gateway, create a Transit VIF to an AWS Transit Gateway, and configure an AWS Site-to-Site VPN attachment over the Transit VIF (or use Site-to-Site VPN as an automated encrypted backup connection).
3	How does AWS Transit Gateway simplify connecting hundreds of VPCs and on-premises networks compared to VPC Peering?	Instead of managing a full mesh of N*(N-1)/2 VPC Peering connections, AWS Transit Gateway acts as a regional hub-and-spoke network router supporting transitive routing across attached VPCs, Site-to-Site VPNs, and Direct Connect Gateways, as well as cross-Region Transit Gateway peering and IP multicast.
4	How do you make a NAT Gateway deployment resilient to an Availability Zone failure?	Because a single NAT Gateway is resilient only within its own Availability Zone, a Multi-AZ architecture requires deploying an independent NAT Gateway in a public subnet in each Availability Zone and configuring each private subnet's route table to route 0.0.0.0/0 to the NAT Gateway in its same AZ.
5	How can a SaaS provider expose a microservice running in their VPC to thousands of customer VPCs without VPC Peering and even when CIDR blocks overlap?	Use AWS PrivateLink (VPC Endpoint Service): the SaaS provider places a Network Load Balancer (NLB) in front of the service and creates an Endpoint Service. Customers create an Interface VPC Endpoint (ENI) in their own VPC, enabling private, unidirectional connectivity over the AWS backbone regardless of overlapping IP ranges.
6	What are the two ways to restrict geographic access to content served by Amazon CloudFront?	You can use CloudFront Geo-Restriction (allowlist or blocklist by country based on GeoIP database) or attach an AWS WAF Web ACL with a Geo-Match rule (which also allows combining geographic checks with rate-limiting or custom header conditions).
7	Compare Latency-Based, Geolocation, Geoproximity, and Weighted routing policies in Amazon Route 53.	Latency routes users to the AWS Region offering the lowest network round-trip time. Geolocation routes based on the user's exact continent, country, or US state (ideal for regulatory/content localization). Geoproximity routes based on geographic distance with configurable Bias values to expand or shrink traffic regions. Weighted assigns relative traffic percentages across endpoints (ideal for blue/green testing).
8	Compare Active/Passive and Active/Active high-availability topologies in AWS Direct Connect.	A single Direct Connect connection at one location provides no SLA. Development/non-critical workloads use 2 connections at 1 or 2 locations. Maximum resiliency (99.99% SLA) requires at least 2 independent Direct Connect locations, each with 2 redundant connections terminating on separate customer routers.
9	Compare CloudFront Signed URLs and CloudFront Signed Cookies for delivering paid or restricted media content.	Use a CloudFront Signed URL when granting temporary access to a single individual file (such as a software download or single PDF). Use CloudFront Signed Cookies when granting access to multiple restricted files (such as HLS video streaming segments or an entire subscriber-only website section) without changing the asset URLs.
10	What is the difference between a Route 53 Alias Record and a standard DNS CNAME Record?	A Route 53 Alias Record works at the zone apex (root domain like example.com) as well as subdomains, automatically tracks IP changes of AWS resources, and queries to AWS Alias targets (ALB, NLB, CloudFront, S3 website, API Gateway) are free. A CNAME cannot be used at the zone apex and incurs standard DNS query charges.
11	How does Route 53 Geolocation Routing handle requests from locations that do not match any configured geographic rule?	You should always configure a 'Default' location record in Route 53 Geolocation Routing; without a Default record, Route 53 returns a 'no answer' (NXDOMAIN/SERVFAIL) response for queries originating from unmapped geographic regions or IP addresses.
12	What information is captured in VPC Flow Logs, and what destinations can receive them?	VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, byte/packet counts, and ACCEPT/REJECT action) at the VPC, Subnet, or ENI level. They can be published directly to Amazon CloudWatch Logs, Amazon S3, or Amazon Data Firehose.
13	What are the three types of Virtual Interfaces (VIFs) in AWS Direct Connect, and what does each access?	1. Public VIF: accesses AWS public service endpoints (such as S3 and DynamoDB public IPs) over Direct Connect. 2. Private VIF: connects to a Virtual Private Gateway (VGW) or Direct Connect Gateway to reach private VPC IP addresses. 3. Transit VIF: connects to a Direct Connect Gateway associated with an AWS Transit Gateway.
14	Compare Dedicated Connections and Hosted Connections in AWS Direct Connect.	A Dedicated Connection is a physical Ethernet port (1 Gbps, 10 Gbps, 100 Gbps, or 400 Gbps) dedicated to a single customer and ordered directly from AWS. A Hosted Connection is a logical connection (50 Mbps up to 25 Gbps) provisioned on demand through an AWS Direct Connect Delivery Partner over shared physical ports.
15	How do Amazon CloudFront Origin Groups provide high availability for origins?	A CloudFront Origin Group consists of a primary origin and a secondary origin (such as two S3 buckets in different Regions with CRR enabled). If the primary origin returns specific HTTP 4xx or 5xx status codes (or times out), CloudFront automatically fails over the GET/HEAD/OPTIONS request to the secondary origin.
16	What is an Egress-Only Internet Gateway, and why is it needed when IPv6 is enabled in a VPC?	All IPv6 addresses assigned in AWS VPC are publicly routable (there is no NAT for IPv6). An Egress-Only Internet Gateway allows instances in private subnets to initiate outbound IPv6 connections to the internet (::/0) while blocking any unsolicited inbound IPv6 connections from the internet.
17	Compare CloudFront Functions and Lambda@Edge for customizing edge requests and responses.	CloudFront Functions run at Edge Locations in a lightweight JavaScript runtime with sub-millisecond execution (scales to millions of req/s) for Viewer Request/Response header manipulation, URL rewrites, and JWT validation. Lambda@Edge runs Node.js or Python at Regional Edge Caches across all 4 trigger points (Viewer/Origin Request/Response) with up to 30s timeout and network/file system access.
18	What makes a VPC subnet a 'Public Subnet' versus a 'Private Subnet', and where must a NAT Gateway be deployed?	A Public Subnet has a route table entry directing 0.0.0.0/0 (or ::/0) to an Internet Gateway (IGW), whereas a Private Subnet has no direct route to an IGW. A Public NAT Gateway must be deployed inside a Public Subnet (with an Elastic IP) so Private Subnets can route 0.0.0.0/0 to it for outbound internet access (whereas a Private NAT Gateway needs no IGW or Elastic IP and is used for private-to-private NAT across peered VPCs or on-premises networks).
19	Compare Gateway VPC Endpoints and Interface VPC Endpoints (AWS PrivateLink).	Gateway Endpoints support only Amazon S3 and Amazon DynamoDB, are completely free, and work by adding prefix-list target entries to VPC Route Tables. Interface Endpoints (powered by AWS PrivateLink) support hundreds of AWS services and custom endpoints, provision Elastic Network Interfaces (ENIs) with private IPs inside your subnets, use Security Groups, and incur hourly + per-GB charges.
20	How is AWS Network Firewall deployed in a VPC to inspect and filter outbound domain traffic or IPS signatures?	AWS Network Firewall is deployed into dedicated firewall subnets in each Availability Zone using Gateway Load Balancer endpoints. VPC route tables are updated to route ingress/egress traffic through the firewall endpoints for stateful domain filtering, Suricata IPS signature matching, and TLS inspection.
21	How can an administrator troubleshoot why an EC2 instance cannot reach another EC2 instance across a Transit Gateway without sending actual network packets?	Use VPC Reachability Analyzer, which performs static configuration analysis across Security Groups, NACLs, Route Tables, VPC Peering, Transit Gateways, and NAT Gateways to identify the exact component blocking the network path.
22	Compare Amazon CloudFront and AWS Global Accelerator in terms of caching, protocols, and IP addresses.	CloudFront caches HTTP/HTTPS content at 600+ Edge Locations to reduce origin load and latency for cacheable and dynamic web assets. AWS Global Accelerator does not cache content; it provides two static Anycast IPv4 addresses that route TCP or UDP traffic (gaming, VoIP, IoT, financial APIs) onto the AWS global backbone at the nearest edge and perform instant endpoint health failover across Regions.
23	When does Route 53 Failover Routing trigger a failover, and what differs between Active-Passive and Active-Active configurations?	In Active-Passive Failover, a Primary record is monitored by a Route 53 Health Check; if unhealthy, DNS automatically resolves to the Secondary (DR) record. In Active-Active, multiple records share a non-failover policy (e.g., Latency or Weighted) with Health Checks attached so unhealthy endpoints are removed from rotation.
24	What problem occurs when an EC2 instance in a private subnet downloads terabytes of data from Amazon S3 through a NAT Gateway, and how do you eliminate that cost?	Traffic routed through a NAT Gateway incurs per-GB NAT Gateway data processing charges ($0.045/GB). Adding a free Gateway VPC Endpoint for Amazon S3 to the private subnet's route table routes S3 traffic directly over the AWS network, eliminating NAT Gateway data processing fees.
25	How does AWS VPN CloudHub work when connecting multiple remote branch offices?	AWS VPN CloudHub uses a single Virtual Private Gateway (VGW) or Transit Gateway with multiple Customer Gateways (one per branch office) using BGP routing over IPsec VPN tunnels, allowing branch offices to communicate both with the VPC and directly with each other in a hub-and-spoke topology.
26	When should an architect use a Gateway VPC Endpoint versus an Interface VPC Endpoint for Amazon S3?	Use a Gateway VPC Endpoint (free) when accessing S3 or DynamoDB from resources inside the same VPC. Use an Interface VPC Endpoint (AWS PrivateLink) for S3 or DynamoDB when accessing them privately from on-premises networks over Direct Connect or Site-to-Site VPN, from peered VPCs in another Region, or when requiring security-group filtering on the endpoint ENI.
27	Compare AWS Site-to-Site VPN and AWS Direct Connect in terms of provisioning time, encryption, and bandwidth consistency.	Site-to-Site VPN can be provisioned in minutes, provides built-in IPsec encryption, and offers up to 1.25 Gbps per tunnel over the public internet (variable latency). Direct Connect provides a dedicated physical fiber connection (1 Gbps to 100 Gbps) with consistent low latency and private network transit, takes weeks to provision, and is not encrypted by default unless paired with MACsec or an IPsec VPN over Direct Connect.
28	How many IP addresses does AWS reserve in every VPC subnet CIDR block, and what are those five addresses used for?	AWS reserves 5 IP addresses in every subnet (first 4 and last 1). For example, in 10.0.0.0/24: .0 is the network address, .1 is reserved for the VPC router, .2 is reserved for the AWS DNS server, .3 is reserved for future use, and .255 is the network broadcast address.
29	Compare Security Groups and Network Access Control Lists (NACLs) in Amazon VPC.	Security Groups operate at the ENI/instance level, are stateful (return traffic is automatically allowed regardless of outbound rules), and support Allow rules only. NACLs operate at the subnet boundary, are stateless (both inbound and outbound return traffic on ephemeral ports must be explicitly permitted), and support numbered Allow and Deny rules evaluated in order.
30	Why is AWS Global Accelerator superior to DNS-based failover when client devices aggressively cache DNS records?	Because Global Accelerator exposes fixed Anycast IP addresses that never change, failing over between ALB, NLB, or EC2 endpoints in different AWS Regions happens at the network routing layer within seconds after a health check failure, completely bypassing client and ISP DNS TTL caching.
31	How do Route 53 Resolver Inbound and Outbound Endpoints enable hybrid DNS resolution between on-premises networks and Amazon VPCs?	An Inbound Endpoint provides IP addresses inside the VPC where on-premises DNS servers can forward queries for VPC private hosted zones (e.g., *.internal.example.com). An Outbound Endpoint uses Forwarding Rules to forward DNS queries originating inside the VPC to on-premises corporate DNS resolvers.
32	What are the limitations of VPC Peering regarding transitive routing and overlapping CIDR blocks?	VPC Peering does not support overlapping IPv4 CIDR blocks and does not support transitive routing—if VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot communicate with VPC C through VPC B unless a direct peering connection (or AWS Transit Gateway) is established.