Network
Domain 3 covers NHN Cloud networking: VPC design, subnets, routing, gateways, security, and load balancing. The exam checks whether traffic can actually flow from source to destination.
Core rules
- A VPC is a private address space. Subnets divide it and are tied to an Availability Zone. A subnet is public or private by its route to an Internet Gateway, not by name alone.
- Route tables choose the next hop. A default route to an Internet Gateway enables outbound internet for public subnets. Private subnets need a NAT Gateway for outbound-only internet; inbound from internet is not allowed through NAT.
- Security groups filter instance traffic and are stateful for allowed connections. Network ACLs filter at subnet level and are evaluated by ordered allow/deny rules; both directions matter.
- Floating IPs map a public address to a private instance address. Load Balancers distribute traffic to target groups and perform health checks.
- VPC peering connects VPCs privately; it does not automatically provide transitive routing. Each side needs routes and security rules that permit the traffic.
Worked example
A private web server must download OS updates but must not accept inbound internet traffic. Place it in a private subnet, add a route 0.0.0.0/0 to a NAT Gateway in a public subnet, and allow outbound 443 in its security group. Do not attach a floating IP. Reason: NAT hides the private address and blocks unsolicited inbound; the route sends traffic to NAT; the security group must still allow the outbound flow.
Traps
Do not call a subnet public without an Internet Gateway route. Do not forget return routes for peering. Do not use security groups as subnet firewalls. Do not assume a load balancer health check passes because the port is open; the check path and port must match.