Skip to content

CLF-C02 Study Notes: Task Statement 3.5 — Identify AWS Network Services

1. Amazon Virtual Private Cloud (Amazon VPC)

Amazon VPC lets you create a logically isolated virtual network in AWS. It provides control over:

  • IP address ranges using CIDR blocks
  • Subnets
  • Route tables
  • Internet and network gateways
  • Network access controls
  • Connectivity to on-premises networks and other VPCs

A VPC is similar to a private data center network, but AWS manages the underlying networking infrastructure.

Key characteristics

  • A VPC is regional: it exists in one AWS Region.
  • A VPC can span multiple Availability Zones within that Region.
  • A VPC is isolated by default unless you explicitly configure access.
  • You can connect a VPC to:
  • The internet
  • On-premises networks
  • Other VPCs
  • AWS services through VPC endpoints

Default VPC and custom VPC

Feature Default VPC Custom VPC
Created automatically Yes, when an AWS account is created No
Number per Region One default VPC per Region Multiple custom VPCs possible
Configuration AWS provides initial configuration You configure it
Internet access Configured with an internet gateway Must be configured by you
Subnets Typically one subnet per Availability Zone You create and configure subnets

Exam tip: A default VPC is not completely isolated because AWS configures it with internet connectivity. A custom VPC is private and isolated until you configure access.

2. CIDR Blocks and Subnets

A VPC receives an IPv4 CIDR block, which defines its available private IP address range.

For example:

10.0.0.0/16

The VPC can be divided into smaller networks called subnets.

Subnets

  • A subnet is a portion of a VPC’s IP address range.
  • Each subnet exists in exactly one Availability Zone.
  • A VPC can have subnets in multiple Availability Zones.
  • Subnets help separate resources and improve resiliency.

For example:

VPC:       10.0.0.0/16
Subnet A:  10.0.1.0/24   — Availability Zone 1
Subnet B:  10.0.2.0/24   — Availability Zone 2

If one Availability Zone fails, resources in other Availability Zones can continue operating.

Exam trap: A subnet cannot span multiple Availability Zones. A VPC can span multiple Availability Zones, but each subnet belongs to only one Availability Zone.

3. VPC Router and Route Tables

Every VPC has a highly available VPC router managed by AWS. The router directs traffic between:

  • Subnets
  • The internet gateway
  • NAT gateways
  • VPC peering connections
  • VPN connections
  • Other network destinations

You control routing through route tables.

Route tables

  • A route table contains rules that determine where network traffic is sent.
  • Each subnet is associated with one route table at a time.
  • One route table can be associated with multiple subnets.
  • A VPC has a main route table.
  • If a subnet is not explicitly associated with another route table, it uses the main route table.

Example route:

Destination Target
10.0.0.0/16 Local
0.0.0.0/0 Internet Gateway

The route 0.0.0.0/0 represents all IPv4 destinations not otherwise specified.

Exam tip: A subnet is considered public when its route table has a route to an internet gateway. A subnet without such a route is generally private.

4. Internet Gateway

An internet gateway (IGW) provides connectivity between a VPC and the internet.

Key points

  • A VPC can have only one attached internet gateway.
  • An internet gateway is highly available and supports all Availability Zones in the VPC.
  • It must be attached to the VPC.
  • A route table must include a route to the internet gateway.
  • Resources generally need a public IPv4 address or Elastic IP address for direct internet communication.

Public subnet

A subnet is public when:

  1. Its route table contains a route to an internet gateway.
  2. The resource has the necessary public addressing and security configuration.

Exam trap: Simply attaching an internet gateway to a VPC does not automatically make every subnet public. The subnet’s route table must have a route to the gateway.

5. NAT and NAT Gateway

Network Address Translation, or NAT, allows private resources to initiate outbound communication while preventing unsolicited inbound connections from the internet.

A common example is allowing private servers to:

  • Download software updates
  • Access public AWS services
  • Reach external websites or repositories

NAT gateway

A NAT gateway:

  • Is deployed in a subnet, usually a public subnet
  • Uses an Elastic IP address for internet access
  • Allows resources in private subnets to initiate outbound internet connections
  • Allows return traffic for connections initiated by the private resources
  • Does not allow the internet to initiate connections directly to private resources

Typical architecture:

Private subnet
     |
     v
NAT gateway in public subnet
     |
     v
Internet gateway
     |
     v
Internet

The private subnet’s route table commonly contains:

0.0.0.0/0 → NAT Gateway

Exam trap: A NAT gateway is not the same as an internet gateway. A NAT gateway provides outbound internet access for private resources; an internet gateway provides VPC-level connectivity to the internet.

6. Network Access Control Lists (Network ACLs)

A network ACL, or NACL, is a stateless traffic filter that operates at the subnet level.

NACLs can control traffic:

  • Entering a subnet
  • Leaving a subnet

Characteristics

  • Associated with subnets, not individual resources
  • Stateless
  • Support both allow and deny rules
  • Rules are evaluated in numerical order
  • Inbound and outbound traffic are evaluated separately
  • Return traffic must be explicitly allowed

For example, if inbound HTTP traffic is allowed, the outbound response must also be allowed by an outbound rule.

Default and custom NACLs

  • The default NACL allows all inbound and outbound traffic by default.
  • A custom NACL denies traffic by default until rules are added.

NACL versus security group

Feature Network ACL Security group
Scope Subnet Resource network interface
Stateful No Yes
Supports allow rules Yes Yes
Supports deny rules Yes No explicit deny rules
Rule evaluation Number order All applicable rules
Return traffic Must be explicitly allowed Automatically allowed for permitted traffic

Exam tip: Use NACLs for subnet-level traffic control and security groups for resource-level traffic control.

7. Security Groups

A security group is a virtual firewall associated with an AWS resource’s network interface, such as an EC2 instance.

Characteristics

  • Operates at the resource level
  • Stateful
  • Has inbound and outbound rules
  • Allows traffic by default only when rules permit it
  • Does not support explicit deny rules
  • Return traffic is automatically allowed when the original traffic is allowed

For example, if an inbound rule allows an instance to receive HTTPS traffic, the response traffic is automatically permitted by the stateful security group.

Exam trap: Security groups are not attached to subnets. They are associated with resources or their network interfaces.

8. VPC Connectivity Options

VPC peering

VPC peering creates a private network connection between two VPCs.

It allows resources in the VPCs to communicate using private IP addresses.

VPC peering can connect:

  • VPCs in the same AWS account
  • VPCs in different AWS accounts
  • VPCs in different AWS Regions

Important characteristics:

  • Uses private IP addresses
  • Does not require traffic to travel over the public internet
  • Peering connections are not transitive

For example, if VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot automatically communicate with VPC C through VPC B.

Exam tip: Use VPC peering for direct private communication between two VPCs. For many-to-many connectivity, AWS Transit Gateway may be more appropriate, but detailed Transit Gateway configuration is generally beyond the basic scope of this task.

VPC endpoints

VPC endpoints allow resources in a VPC to access supported AWS services without requiring:

  • An internet gateway
  • A NAT gateway
  • Public IP addresses

There are two important endpoint categories for the exam.

Gateway endpoints

Gateway endpoints provide private connectivity to:

  • Amazon S3
  • Amazon DynamoDB

They use route tables and prefix lists.

Interface endpoints

Interface endpoints provide private connectivity to many other AWS services.

They:

  • Use elastic network interfaces
  • Use private IP addresses inside your subnet
  • Use AWS PrivateLink
  • Typically use DNS to resolve the service to the private endpoint
Endpoint type Common services How it works
Gateway endpoint S3 and DynamoDB Route table and prefix list
Interface endpoint Many other AWS services Network interface and private DNS

Exam trap: S3 and DynamoDB are the key services associated with gateway endpoints. Most other AWS services use interface endpoints.

AWS PrivateLink enables private access to services hosted in another VPC without requiring:

  • VPC peering
  • An internet gateway
  • Public IP addresses

It is useful when a service provider wants to privately expose an application to consumers in other VPCs or AWS accounts.

At the foundational exam level, remember:

  • PrivateLink is used with interface VPC endpoints.
  • It provides private connectivity between VPCs and supported services.
  • It avoids the need for broad network connectivity between entire VPCs.

9. Connecting to On-Premises Networks

AWS Site-to-Site VPN

AWS Site-to-Site VPN provides an encrypted connection between an on-premises network and a VPC.

Characteristics:

  • Uses the public internet as the underlying transport
  • Encrypts traffic between the on-premises network and AWS
  • Can be used to create a hybrid cloud environment
  • Usually faster to provision than Direct Connect
  • May have variable internet-based performance

Exam clue: If the question mentions an encrypted virtual connection over the public internet, choose AWS Site-to-Site VPN.

AWS Direct Connect

AWS Direct Connect provides a dedicated physical network connection between an on-premises environment and AWS.

Characteristics:

  • Uses a dedicated connection rather than the public internet
  • Provides more consistent network performance
  • Useful for large data transfers and hybrid environments
  • Can help reduce network costs in some use cases
  • Does not automatically encrypt traffic in the same way as a VPN

Exam clue: The word dedicated is strongly associated with AWS Direct Connect.

VPN versus Direct Connect

Feature Site-to-Site VPN Direct Connect
Connection type Virtual connection Dedicated physical connection
Uses public internet Yes No
Encryption Encrypted by default Not automatically encrypted
Setup speed Usually faster Requires physical provisioning
Performance Can vary with internet conditions More consistent
Typical use Quick, encrypted hybrid connectivity Consistent, high-volume connectivity

10. Amazon Route 53

Amazon Route 53 is AWS’s managed DNS service.

DNS translates human-readable domain names into IP addresses.

For example:

www.example.com → IP address

Route 53 capabilities

  • Domain registration
  • DNS hosting through hosted zones
  • DNS record management
  • Routing users to applications
  • Health checks and failover routing
  • Global service availability

Route 53 routing policies include:

  • Simple routing: Routes traffic to a single resource or group of resources.
  • Weighted routing: Distributes traffic based on assigned weights.
  • Latency-based routing: Routes users to the Region with the lowest network latency.
  • Failover routing: Routes traffic to a healthy primary resource and fails over to a secondary resource when needed.

Exam tip: Route 53 is a global DNS service, not a regional service like a VPC.

Route 53 compared with a VPC route table

Feature Route 53 VPC route table
Purpose Resolves names and directs users to endpoints Directs network packets inside and outside a VPC
Example app.example.com to an IP or load balancer 0.0.0.0/0 to an internet gateway
Scope DNS and application traffic routing Network traffic routing
Service type Global Associated with VPC subnets

11. Amazon CloudFront

Amazon CloudFront is a content delivery network, or CDN.

It delivers content from edge locations closer to users, which can reduce latency.

Common use cases include:

  • Websites
  • Images and videos
  • Static files
  • Dynamic web content
  • Content from Amazon S3 or an origin server

CloudFront can improve:

  • Performance
  • Global content delivery
  • Availability
  • Protection against some types of attacks when combined with other AWS services

Exam tip: Choose CloudFront when the question focuses on caching and delivering content from edge locations.

12. AWS Global Accelerator

AWS Global Accelerator improves the availability and performance of applications for global users.

It uses static anycast IP addresses and routes users through the AWS global network to healthy application endpoints.

It is suited for:

  • TCP and UDP applications
  • Global applications requiring stable IP addresses
  • Improving availability through endpoint health checks
  • Routing traffic to the optimal AWS Region or endpoint

CloudFront versus Global Accelerator

Feature CloudFront Global Accelerator
Main purpose Content delivery and caching Network performance and availability
Caches content Yes No
Typical protocols HTTP and HTTPS TCP and UDP
Uses static anycast IPs Not the primary feature Yes
Best for Websites and media delivery Global applications and non-HTTP traffic

High-Value Exam Tips and Traps

  1. VPC is regional, but a subnet is limited to one Availability Zone.
  2. A default VPC is created automatically and generally has internet connectivity.
  3. A custom VPC is isolated until you configure routes and gateways.
  4. An internet gateway must be attached to the VPC and referenced in a route table.
  5. A NAT gateway gives private resources outbound internet access; it does not permit unsolicited inbound connections.
  6. Network ACLs are stateless and require separate inbound and outbound rules.
  7. Security groups are stateful and automatically allow return traffic.
  8. NACLs apply to subnets; security groups apply to resources.
  9. VPC peering is private but not transitive.
  10. Gateway endpoints are primarily for Amazon S3 and DynamoDB.
  11. Interface endpoints use elastic network interfaces and AWS PrivateLink.
  12. VPN uses the public internet and provides encryption.
  13. Direct Connect is a dedicated physical connection and does not automatically encrypt traffic.
  14. Route 53 is AWS’s global DNS service.
  15. CloudFront is for content caching and edge delivery.
  16. Global Accelerator is for global network performance and availability, including TCP and UDP applications.

Practice Questions

Question 1

A company wants to deploy resources in an isolated virtual network in AWS. The company must control IP ranges, subnets, routing, and network access.

Which AWS service should the company use?

A. Amazon Route 53
B. Amazon VPC
C. Amazon CloudFront
D. AWS Direct Connect

Answer: B. Amazon VPC

Explanation: Amazon VPC provides a logically isolated virtual network where you control IP ranges, subnets, route tables, and network access.

Question 2

Which statement about Amazon VPC subnets is correct?

A. A subnet can span multiple AWS Regions.
B. A subnet can span multiple Availability Zones.
C. A subnet exists in exactly one Availability Zone.
D. A subnet must be connected to the internet.

Answer: C. A subnet exists in exactly one Availability Zone.

Explanation: Subnets are associated with one Availability Zone. A VPC can span multiple Availability Zones.

Question 3

An application runs on an EC2 instance in a private subnet. The application needs to download operating system updates from the internet, but internet users must not be able to initiate connections to the instance.

Which solution should be used?

A. Attach an internet gateway directly to the private subnet.
B. Use a NAT gateway in a public subnet.
C. Use a network ACL without a route table.
D. Use Route 53.

Answer: B. Use a NAT gateway in a public subnet.

Explanation: A NAT gateway allows private resources to initiate outbound internet connections and receive responses while preventing unsolicited inbound connections.

Question 4

Which security feature is stateful and is associated with an EC2 instance’s network interface?

A. Network ACL
B. Security group
C. Route table
D. Internet gateway

Answer: B. Security group

Explanation: Security groups are stateful firewalls associated with resource network interfaces.

Question 5

A network administrator allows inbound HTTPS traffic using a network ACL. What else is required for response traffic to return successfully?

A. Nothing, because NACLs are stateful.
B. An outbound rule allowing the response traffic.
C. A second security group.
D. A VPC peering connection.

Answer: B. An outbound rule allowing the response traffic.

Explanation: Network ACLs are stateless. Inbound and outbound traffic must be allowed separately.

Question 6

An EC2 instance in a private subnet needs to access Amazon S3 without using a NAT gateway or internet gateway.

Which solution should be used?

A. Gateway VPC endpoint
B. VPC peering
C. AWS Direct Connect
D. Route 53 private hosted zone

Answer: A. Gateway VPC endpoint

Explanation: Gateway endpoints provide private access to Amazon S3 and DynamoDB without requiring internet connectivity.

Question 7

A company needs an encrypted connection between its data center and an AWS VPC using the public internet.

Which service should it use?

A. AWS Direct Connect
B. AWS Site-to-Site VPN
C. VPC peering
D. Amazon CloudFront

Answer: B. AWS Site-to-Site VPN

Explanation: Site-to-Site VPN creates an encrypted virtual connection over the public internet.

Question 8

A company needs a dedicated physical network connection between its on-premises data center and AWS for consistent performance.

Which service should it use?

A. AWS Site-to-Site VPN
B. AWS Direct Connect
C. VPC endpoint
D. Amazon Route 53

Answer: B. AWS Direct Connect

Explanation: Direct Connect provides a dedicated physical connection between an on-premises network and AWS.

Question 9

Which AWS service translates domain names into IP addresses and supports DNS routing policies such as latency-based and failover routing?

A. Amazon CloudFront
B. Amazon Route 53
C. AWS Global Accelerator
D. Amazon VPC

Answer: B. Amazon Route 53

Explanation: Route 53 is AWS’s managed global DNS service and supports multiple routing policies.

Question 10

A company wants to cache website content at locations close to users around the world.

Which AWS service should it use?

A. AWS Global Accelerator
B. Amazon Route 53
C. Amazon CloudFront
D. AWS Direct Connect

Answer: C. Amazon CloudFront

Explanation: CloudFront is AWS’s content delivery network and caches content at edge locations.

Question 11

A company runs a global TCP-based application and wants static IP addresses and improved routing over the AWS global network. The company does not need content caching.

Which service should it use?

A. Amazon CloudFront
B. AWS Global Accelerator
C. Amazon Route 53
D. NAT gateway

Answer: B. AWS Global Accelerator

Explanation: Global Accelerator provides static anycast IP addresses and improves global application availability and network performance for TCP and UDP traffic.