Network Implementation
Core concepts
Implementation questions ask you to build what was designed. Master VPC creation (CIDR, subnets, route tables, internet gateway), security groups and NACLs, Elastic Load Balancing (ALB, NLB, GWLB), Route 53 (public/private hosted zones, alias records, routing policies), and hybrid links: Site-to-Site VPN with BGP, Direct Connect virtual interfaces (private, public, transit), and Transit Gateway attachments. Know BGP basics: ASN selection, route advertisement, and how AWS selects paths (longest prefix, then BGP attributes). Understand Direct Connect link aggregation groups (LAGs) and MACsec where supported, and VPN tunnel redundancy (two tunnels per connection).
Traps
A common trap is forgetting that a private hosted zone only resolves inside associated VPCs, or that an ALB needs at least two AZs. Another is assuming a VPN provides the same bandwidth or latency as Direct Connect; it does not. Questions may ask why BGP is down: check ASN mismatch, missing route advertisement, or a firewall blocking TCP 179 and UDP 500/4500 for IPsec. Also remember security groups are stateful and NACLs are stateless, so return traffic rules differ.
Rule of thumb
For hybrid connectivity, prefer Direct Connect for steady high-volume traffic and VPN as backup or for quick setup. Always configure redundant tunnels and test failover.
Worked example
A company needs 1 Gbps to on-premises with sub-second failover. Use a 1 Gbps Direct Connect with a private VIF, plus a Site-to-Site VPN as backup. Advertise the same prefixes over both; BGP prefers the Direct Connect path. If the DX link drops, BGP withdraws and traffic fails over to the VPN.