Networking (VPC, Load Balancer, DNS, CDN, VPN)
Domain 4 - Networking
This domain checks that you can build a segmented VPC and pick the right traffic path: Internet Gateway, NAT Gateway, Load Balancer, DNS/GSLB, CDN and VPN.
Core rules
- A VPC holds subnets; a subnet is public if its route table points to an Internet Gateway. Private subnets route 0.0.0.0/0 to a NAT Gateway for outbound-only access.
- ACG is stateful: return traffic for an allowed inbound flow is permitted automatically. Rules are allow-only and evaluated before the server sees the packet.
- Load Balancer types: Application LB for HTTP/HTTPS with path and host rules, Network LB for L4 TCP/UDP, Network Proxy LB for L4 with proxy semantics. All use target groups with health checks.
- Global DNS provides record management; GSLB adds health-checked routing (failover, weighted, geo) across endpoints.
- CDN caches content from an origin (often Object Storage) at edge locations; purge after origin changes.
- VPN Gateway terminates IPsec tunnels from on-premises into the VPC; a Dedicated Line is the private, higher-bandwidth alternative.
Worked example
Three-tier app: an Application LB in a public subnet receives HTTPS; app servers sit in private subnets and route outbound patching through NAT; the DB subnet has no 0.0.0.0/0 route at all. Reasoning: only the tier that must be reachable from the internet is public; the app tier needs egress but not ingress; the DB needs neither.
Traps
- Opening 0.0.0.0/0 on 22/3389 "temporarily" and never closing it.
- Pointing a private subnet at an Internet Gateway to fix a package download.
- Health check port mismatch: target group checks 80 while the app listens on 8080.
- Forgetting DNS TTL during a cutover - lower it before moving traffic.