EC2 Networking Essentials: ENIs and Elastic Network Interfaces Quiz

Explore key concepts of EC2 networking with a quiz focused on Elastic Network Interfaces (ENIs), their features, attachment, and common configuration scenarios. This set of questions helps reinforce foundational knowledge of ENIs and networking best practices within EC2 environments.

1. ENI Basics

   What is an Elastic Network Interface (ENI) most accurately described as in the context of virtual machines?

   1. A static storage device for backups
   2. An encrypted password management service
   3. A dedicated physical network router for each virtual machine
   4. A virtual network card that can be attached to instances

   Explanation: An ENI functions as a virtual network card that can be attached or detached from instances, providing networking capabilities such as private IP addresses, security groups, and MAC addresses. It is not a physical router or device, which eliminates option two. ENIs do not serve as storage devices for backups, ruling out option three. Option four refers to an unrelated security service, not a networking component.

2. ENI Attachments

   Which of the following best describes how many ENIs can an instance usually have attached by default, depending on its type?

   1. Only one ENI per instance type
   2. An unlimited number of ENIs
   3. Up to two ENIs on all instance types
   4. The number varies depending on the instance type

   Explanation: The maximum number of ENIs that can be attached to an instance is determined by the instance type. Some types support more ENIs than others based on their specifications, so option three is most accurate. Option one incorrectly sets a uniform maximum of two, while option two is too restrictive. Unlimited attachment is not possible, so option four is incorrect.

3. ENI Features

   Which feature does an ENI provide when attached to an instance?

   1. Increased CPU performance
   2. One or more private IP addresses
   3. Automatic data encryption at rest
   4. Scheduled backup functionality

   Explanation: ENIs allow assignment of one or more private IP addresses, which facilitate network communication. They do not provide data encryption at rest, as that is a storage security feature. Scheduled backup is not a networking function, eliminating option three. ENIs do not affect CPU performance, so option four does not apply.

4. ENI Movement

   In which scenario might moving an ENI from one instance to another be useful?

   1. Increasing disk storage on the instance
   2. Upgrading the physical memory of an instance
   3. Preserving networking configuration during failover
   4. Launching an instance in a new region

   Explanation: Detaching an ENI from one instance and attaching it to another preserves its networking setup, which is valuable for failover or replacement scenarios. Upgrading memory or disk storage is unrelated to ENIs. ENIs cannot be transferred between regions, making that option invalid. Only preserving networking configuration directly involves ENIs.

5. Public IP Assignment

   What is needed for an ENI to be accessible from the public internet?

   1. Direct access to the instance's root file system
   2. A public IP or an associated Elastic IP address
   3. A complex password policy configured on the ENI
   4. Only a security group with open inbound rules

   Explanation: To allow internet access, an ENI must have a public IP or Elastic IP associated with it. A password policy does not relate to ENI external connectivity. Accessing a root file system is a storage concept and not connected to networking. While security groups help control access, alone they do not provide public reachability without a public IP.

6. Security Groups on ENIs

   If you attach multiple security groups to an ENI, how is incoming traffic filtered?

   1. The union of all rules from all attached security groups applies
   2. All incoming traffic is blocked regardless of rules
   3. Only outbound rules are evaluated for incoming traffic
   4. Only the rules from the first security group apply

   Explanation: When multiple security groups are attached, the set of allowed traffic is the union of all rules from all these groups. Only using the first group would ignore additional rules, making option two incorrect. Blocking all traffic is never the default behavior when groups are attached, so option three is wrong. Evaluating only outbound rules for incoming traffic is incorrect, invalidating option four.

7. ENI Subnet Association

   When you create an ENI, to which network construct must it be associated?

   1. A specific subnet
   2. A domain name system record
   3. A virtual storage volume
   4. A security key pair

   Explanation: ENIs must be created within a subnet to define their network range and connectivity. Virtual storage volumes are for data storage, not networking. Domain name systems resolve names, not provide network attachment. A security key pair deals with instance authentication rather than network interface placement.

8. Primary ENI Concept

   What best describes the primary ENI on a standard virtual machine instance?

   1. It is always assigned a random security group
   2. It can only be manually created and attached
   3. It is a backup interface that is rarely used
   4. It is created and attached automatically at launch and cannot be detached

   Explanation: The primary ENI is automatically created and attached to the instance at launch and cannot be detached during the instance’s lifetime. Manual creation is not required for the primary ENI. It is not a rarely used backup interface, so option three is incorrect. Security groups can be chosen and are not always random.

9. ENI States

   Which state does an ENI enter when it is not attached to any instance?

   1. Disconnected
   2. In use
   3. Available
   4. Pending

   Explanation: When not attached, the ENI is in the ‘Available’ state, making it ready to be attached to an instance. The 'In use' state refers to being attached. The ‘Pending’ state reflects creation or configuration in process. ‘Disconnected’ is not a recognized state for ENIs.

10. ENI MAC Address

    When you move an ENI between instances, how does the MAC address behave?

    1. It switches based on the new instance's MAC address
    2. It always changes to the primary ENI’s address
    3. The MAC address remains the same
    4. It gets reset to a randomly generated address

    Explanation: An ENI retains its MAC address when moved, ensuring consistent network identification. The MAC is not randomly reset or reassigned to match the target instance, making options two and three incorrect. It does not assume the primary ENI's address, which dismisses option four.