3.2 - AWS networking basics (VPC, subnets, gateways)
AWS Certified Cloud Practitioner objective 3.2 covers core AWS networking. A Virtual Private Cloud (VPC) is a logically isolated section of the AWS Cloud where you launch resources into your own private network. Within a VPC, resources that should be reachable from the internet go in a public subnet - one whose route table sends internet-bound traffic to an internet gateway (IGW), the component that allows communication between VPC instances and the internet. Instances in a private subnet have no direct internet route; when they need to download updates but must not be reachable from the internet, they use a NAT gateway placed in a public subnet for outbound-only access. Expect scenario questions that describe isolating resources, making a subnet internet-reachable, or giving private instances outbound-only internet access, and ask which VPC component - public subnet, internet gateway or NAT gateway - is correct.
Isolated private network in AWS = VPC. Reachable from internet = public subnet (route to an internet gateway). Private instances, outbound-only internet = NAT gateway in a public subnet.
Practice questions
1. A logically isolated section of the AWS Cloud where you launch resources into your own network is a:
- Availability Zone
- Security group
- Virtual Private Cloud (VPC) (correct answer)
- Placement group
A VPC is your own isolated virtual network in AWS, with subnets, route tables, gateways, and security controls. Security groups are instance-level firewalls inside a VPC.
2. Within a VPC, resources that should be reachable from the internet are typically placed in:
- A private subnet with no route to the internet
- A public subnet with a route to an internet gateway (correct answer)
- An Availability Zone with no subnets
- A resource-based policy
A public subnet has a route table entry pointing to an internet gateway, so its resources (like a web server) can send and receive internet traffic. Private subnets have no such direct route.
3. Which VPC component allows communication between instances in a VPC and the internet?
- A route table only
- A security group
- An internet gateway (IGW) (correct answer)
- A VPC endpoint
An internet gateway is a horizontally scaled VPC component that enables communication between the VPC and the internet. A route table must point to it for a subnet to be public.
4. Instances in a private subnet need to download updates from the internet but must not receive inbound connections. What enables this?
- A NAT gateway in a public subnet (correct answer)
- An additional internet gateway per instance
- A resource-based policy on the subnet
- Disabling the route table
A NAT gateway (placed in a public subnet) lets private-subnet instances make outbound internet connections while blocking unsolicited inbound connections from the internet.
5. Which AWS service is a scalable Domain Name System (DNS) web service that translates domain names to IP addresses?
- Amazon CloudFront
- AWS Direct Connect
- Elastic Load Balancing
- Amazon Route 53 (correct answer)
Amazon Route 53 is a highly available and scalable DNS service; it resolves names to IPs, registers domains, and performs health checks and traffic routing.
6. Which Route 53 routing policy sends users to the AWS Region that gives them the lowest network latency?
- Failover routing
- Latency-based routing (correct answer)
- Simple routing
- Multivalue answer routing
Latency-based routing directs traffic to the Region that provides the lowest latency for the user. Failover is for active-passive DR; weighted splits by proportion; geolocation by user location.