Networking and Connectivity
What to know
A VPC is your isolated virtual network with a CIDR block, divided into vSwitches (subnets) bound to zones. Route tables direct traffic; security groups are stateful instance-level firewalls, while network ACLs are subnet-level and stateless. NAT Gateway gives private instances outbound internet without inbound exposure; an Internet gateway/EIP gives public access. SLB distributes traffic. For hybrid connectivity, know VPN Gateway (encrypted over internet) vs. Express Connect (dedicated private line, lower latency, higher cost). DNS and peering connect VPCs.
Traps
CIDR overlap between peered VPCs or on-prem ranges breaks connectivity - a frequent scenario trap. Security groups are stateful (return traffic auto-allowed); ACLs are stateless (must allow both directions). Instances in a private vSwitch cannot reach the internet without NAT or an EIP. Questions may imply Express Connect is instant - it involves physical provisioning, unlike VPN. Also watch for assuming a NAT Gateway allows inbound connections; it does not.
Rule of thumb
Private subnet + NAT Gateway for outbound-only internet; public subnet + EIP for inbound. Choose VPN for quick/cheap hybrid links, Express Connect for predictable high bandwidth and low latency.
Worked example
Backend servers need to download patches but must not be reachable from the internet. Place them in a private vSwitch, route 0.0.0.0/0 to a NAT Gateway, and keep security groups restrictive.