Networking and Connectivity
Networking and Connectivity tests whether you can build an isolated VPC, control traffic in both directions, and connect that VPC to the internet, to other VPCs, and to on-premises networks without over-exposing it.
VPC building blocks
A VPC is defined by a CIDR block (AWS accepts /16 to /28). Subnets carve that block and are tied to a single AZ. A route table decides where traffic goes: the main route table applies to subnets without an explicit association. An Internet Gateway attaches a VPC to the internet and is required for a public subnet. A NAT Gateway lets private-subnet resources initiate outbound traffic; it lives in a public subnet, is AZ-scoped, and charges per hour plus per GB processed. VPC peering links two VPCs one-to-one and is non-transitive; Transit Gateway acts as a regional hub for many VPCs and on-premises links; AWS PrivateLink exposes a service to other VPCs via interface endpoints.
Endpoints
Gateway endpoints (S3 and DynamoDB) are attached to route tables and carry no hourly charge. Interface endpoints create an ENI in your subnet via PrivateLink and incur hourly and data charges.
Security groups versus NACLs
Security groups are stateful, allow-only, and evaluated as a whole; return traffic is automatically permitted. Network ACLs are stateless, allow and deny, evaluated in numbered order from lowest first, and apply at the subnet boundary. Getting both right is a recurring exam scenario.
Edge and hybrid connectivity
Route 53 offers simple, weighted, latency, failover, geolocation, and multivalue routing. CloudFront caches content at edge locations; Global Accelerator routes traffic over the AWS backbone with static anycast IPs. AWS Direct Connect is a dedicated private circuit (weeks to provision); Site-to-Site VPN is an encrypted tunnel over the internet (minutes to provision); Client VPN connects individual users.
Worked example
An EC2 instance in a private subnet must download OS patches from the internet but must never be reachable inbound from it. Reasoning: attach an Internet Gateway to the VPC, place a NAT Gateway in a public subnet, and give the private subnet's route table a 0.0.0.0/0 route to the NAT Gateway. There is no inbound path because NAT only translates outbound-initiated flows. If patches came from S3, a gateway endpoint would remove the NAT cost entirely.
Traps that cost marks
- Forgetting that a NACL is stateless and needs explicit return rules.
- Assuming VPC peering is transitive across three VPCs.
- Placing a NAT Gateway in a private subnet, or forgetting it is AZ-scoped.
- Confusing CloudFront caching with Global Accelerator's TCP/UDP acceleration.