Networking and Content Delivery
VPC fundamentals
A Virtual Private Cloud (VPC) is an isolated network with a CIDR block you define. Inside it, vSwitches partition the VPC into subnets bound to a single zone. Route tables direct traffic; an Internet Gateway (IGW) or NAT Gateway provides outbound access. Key distinction: an EIP or IGW gives inbound/outbound public connectivity to an instance, while a NAT Gateway allows outbound-only access for private instances - a classic trap where questions ask how to let private instances download updates without exposing them.
Security and connectivity
Security groups are stateful instance-level firewalls; network ACLs are stateless subnet-level filters. For hybrid connectivity, Express Connect provides dedicated private links, VPN Gateway provides encrypted tunnels over the internet, and Cloud Enterprise Network (CEN) interconnects VPCs and on-premises networks.
Load balancing and DNS
SLB/ALB distributes traffic across backend servers; health checks remove unhealthy nodes. DNS resolves names and supports weighted or failover routing. Anycast EIP and global acceleration improve cross-region latency.
Content delivery
CDN caches static content at edge nodes close to users, reducing origin load and latency. Configure cache expiration and origin authentication. Traps: assuming CDN caches dynamic content well, or forgetting to purge cache after content updates.
Worked rule of thumb
Private subnet instances needing outbound internet → NAT Gateway. Publicly reachable web service → SLB + EIP/IGW with security groups. Global static assets → CDN with proper TTLs. Hybrid private link → Express Connect.
Exam framing
Map each requirement (inbound vs outbound, private vs public, latency vs security) to exactly one connectivity component.