Networking: private networks, security groups, Elastic IPs, NLB and DNS
The Networking domain tests whether you can connect instances privately, control traffic precisely, and expose services without exposing everything.
Private networks
A private network is an isolated L2 segment inside one zone. Attached instances receive a private address and talk to each other without touching the public internet. Private networks do not span zones, so a multi-zone design needs one per zone plus routing decisions at the edges. Put a database and its clients on the same private network and most of your exposure disappears.
Security groups
Security groups are stateful packet filters attached to instances. Return traffic for an allowed flow is permitted automatically; you do not write reverse rules. Default posture is deny inbound, allow outbound. Rules reference a CIDR or another security group, which lets you say "app tier may reach 5432" without hard-coding addresses. Keep groups role-based (web, app, db) and attach by role, not by hostname.
Elastic IPs and load balancing
An Elastic IP is a public IPv4 you hold within a zone and can move between instances or a Network Load Balancer. The NLB is managed Layer 4: frontends (public or private) listening on TCP/UDP, backends targeting instances or an instance pool, health checks removing unhealthy targets. Put the Elastic IP on the NLB, keep instances private, and let the pool scale behind it. DNS is managed separately with anycast name servers; point records at the Elastic IP or service hostname.
Worked example
A three-tier app must expose HTTPS only. Reasoning: the NLB does not terminate TLS at Layer 4 - it forwards TCP 443 - so TLS terminates on the web instances, which accept 443 from the internet and 22 only from the bastion group. The app tier has no public address and accepts traffic only from the web group; the database accepts only from the app group. All tiers share one private network in one zone. Scaling the web tier is a pool change, not a DNS change, because the Elastic IP is bound to the NLB.
Traps
Writing mirror egress rules for stateful filters; putting a database on the public network because private setup felt slow; assuming a private network spans zones; moving an Elastic IP to an instance in a different zone; and pointing the NLB health check at a port or path the app does not actually serve, draining every target.