Storage and Networking
Domain 3 - Storage and Networking. This domain checks whether you can pick the right storage model and wire a VPC so that only intended traffic flows.
Storage choice
- Block Storage: a disk attached to one server; snapshots for cloning; expandable.
- NAS: shared NFS/CIFS filesystem mounted by many servers; typical for shared uploads, web content and container persistent volumes.
- Object Storage: HTTP(S) API with buckets, versioning, lifecycle rules and presigned URLs; static assets, backups, data-lake input.
- Archive: cold, cheap, slow retrieval.
Networking building blocks
One VPC with public and private subnets, each with its own route table. Public subnets route 0.0.0.0/0 to the Internet Gateway; private subnets send outbound traffic through a NAT Gateway. ACG is a stateful firewall attached to servers with default-deny inbound; Network ACL filters at subnet level. Load Balancers need a subnet in each zone they serve. Global Route Manager does DNS-based routing and failover; CDN caches at the edge.
Worked example
A three-tier web app. Reasoning: Application Load Balancer in public subnets across two zones; app servers in private subnets with a NAT Gateway for package updates; database in a private DB subnet with no internet route; ACG on app servers allows 8080 from the load balancer only and 22 from a bastion.
Traps
- Private instances that cannot reach the internet because no NAT Gateway or route exists.
- Opening 22 or 3306 to 0.0.0.0/0 temporarily and never closing it.
- Assuming ACG covers traffic filtered at subnet level - that is Network ACL territory.
- Putting both load balancer nodes in one zone.
- Treating CDN as a load balancer: it caches, it does not distribute to your servers.