Cloud Technology and Services
VPC Networking and Connectivity
CoreRecognize VPC building blocks, security groups and network ACLs, DNS, and hybrid or private connectivity choices.
Aligned to the current CLF-C02 exam guide, verified August 15, 2026.
Why this matters
Foundational networking questions test which boundary or connection a service controls, not route-table syntax or packet-level troubleshooting.
Must Know
- Amazon VPC provides a logically isolated virtual network. Subnets divide its address range and each subnet belongs to one Availability Zone.
- Route tables determine traffic paths. Gateways provide specific connectivity, such as access between a VPC and the internet.
- Security groups are stateful controls attached to supported resources. Network ACLs are stateless controls at subnet boundaries.
- Amazon Route 53 provides DNS, domain registration, health checks, and DNS routing policies.
- AWS Site-to-Site VPN provides encrypted connectivity over the internet. AWS Direct Connect provides a dedicated private connection.
- AWS PrivateLink provides private access from a VPC to supported services without sending traffic through the public internet.
Compare and Distinguish
- Security group vs network ACL: a security group is stateful and resource-level; a network ACL is stateless and subnet-level.
- Route 53 vs CloudFront: Route 53 resolves and routes domain names; CloudFront caches and delivers content.
- VPN vs Direct Connect: VPN is encrypted connectivity over the internet; Direct Connect uses a dedicated private circuit.
- Direct Connect vs PrivateLink: Direct Connect connects an external network to AWS; PrivateLink privately exposes supported services within VPC networking.
Scenario examples
- Scenario: A company needs to divide a VPC into network ranges for separate application tiers. Think: Create subnets.
- Scenario: Administrators need an instance-level, stateful traffic control. Think: Use a security group.
- Scenario: A branch office needs encrypted connectivity to a VPC over its existing internet connection. Think: AWS Site-to-Site VPN.
- Scenario: A data center needs a dedicated private connection with more consistent network performance. Think: AWS Direct Connect.
Exam traps
- A security group is not an IAM policy; it controls network traffic rather than AWS API authorization.
- A network ACL does not remember connection state, so return traffic must be allowed explicitly.
- Route 53 does not cache application files, and CloudFront is not authoritative DNS hosting.
- Direct Connect is not encrypted by default merely because it is private; encryption is a separate requirement.
Key takeaways
- VPC is the network; subnets are AZ-specific ranges; routes and gateways direct connectivity.
- Stateful resource control: security group. Stateless subnet control: network ACL.
- DNS: Route 53. Encrypted internet link: VPN. Dedicated private link: Direct Connect.
How it works
- A resource sends traffic according to subnet routing, while security groups and network ACLs evaluate traffic at their respective boundaries.
- Route 53 answers DNS queries according to records and routing policies.
- VPN establishes encrypted tunnels over internet paths; Direct Connect establishes dedicated connectivity through an AWS or partner location.
When to use it
- Use VPC components to organize and route cloud networks.
- Use security groups as the primary stateful resource firewall and network ACLs for subnet-level stateless control.
- Use Route 53 for DNS, VPN for encrypted internet connectivity, Direct Connect for a dedicated link, and PrivateLink for private service access.
Security and governance implications
- Layer network controls with least-privileged identity permissions; neither replaces the other.
- A private network path does not remove the need for encryption, authentication, monitoring, and careful routing.
Troubleshooting signals
- For a connectivity problem, reason in layers: name resolution, routes and gateways, subnet controls, resource controls, then the application endpoint.
- Check both directions when a stateless network ACL is involved.
More detail
- A public subnet has a route that can support internet access through an internet gateway; subnet naming alone does not make it public.
- A NAT gateway lets resources in a private subnet initiate supported outbound connections without accepting unsolicited inbound internet connections.
- AWS Transit Gateway connects multiple VPCs and on-premises networks through a central hub at a high level.
Ready for the quiz?
- At which boundary does a network ACL apply?
- Which service maps a domain name to an application endpoint?
- What requirement makes Direct Connect a better fit than a VPN?
- When is PrivateLink relevant?
Related objectives
- D3.5