5.1 - VPC networking and connectivity
AWS SysOps Administrator objective 5.1 covers VPC networking and connectivity. You plan CIDR ranges, place public and private subnets across AZs, route with route tables, reach the internet through an Internet Gateway and let private subnets egress through a managed, AZ-resilient NAT Gateway. Security groups are stateful at the instance and allow return traffic automatically, while Network ACLs are stateless at the subnet, ordered, and need ephemeral ports for return traffic - a classic troubleshooting trap. Gateway VPC endpoints reach S3 and DynamoDB free while interface endpoints use PrivateLink for private access at an hourly cost. For hybrid and multi-VPC connectivity you use VPC peering, Transit Gateway, Site-to-Site VPN and Direct Connect. Expect scenario questions about private egress, a blocked connection, or private service access, and ask which VPC component or fix applies.
Private subnet reaches the internet = NAT Gateway (managed, per-AZ). NACLs are stateless and need ephemeral return ports; security groups are stateful. Free private access to S3/DynamoDB = gateway VPC endpoint.
Practice questions
1. You need to alarm when an Application Load Balancer starts returning many 5XX errors from the load balancer itself. Which metric fits?
- HTTPCode_ELB_5XX_Count (correct answer)
- HTTPCode_Target_2XX_Count aggregated across all of the healthy targets
- RequestCountPerTarget on the single busiest registered instance
- HealthyHostCount averaged over the last full hour of traffic
HTTPCode_ELB_5XX_Count counts 5XX responses generated by the load balancer (not the targets), which signals ALB-side problems. Target 2XX counts successes, and HealthyHostCount tracks target health, not errors.
2. You are troubleshooting a saturated NAT gateway. Which TWO CloudWatch metrics help you spot the bottleneck? (Choose TWO.)
- BytesOutToDestination on the NAT gateway (correct answer)
- ErrorPortAllocation, counting failed source port allocations (correct answer)
- CPUUtilization reported by the NAT gateway's underlying managed host
- DiskReadOps on the NAT gateway's managed storage volume
NAT gateway metrics like BytesOutToDestination (throughput) and ErrorPortAllocation (port exhaustion) reveal saturation. A NAT gateway is fully managed and exposes no CPU or disk metrics, so those options are traps.
3. To make an Auto Scaling group highly available behind an Application Load Balancer, how should its subnets be configured?
- One subnet in a single AZ
- Subnets in at least two AZs (correct answer)
- Only public subnets with no private ones
- A subnet shared with the ALB nodes only
Spreading instances across subnets in at least two AZs keeps the app running if one AZ fails, matching the ALB's multi-AZ design. A single AZ is a single point of failure, and public-only or ALB-shared constraints are not HA requirements.
4. You want to run Logs Insights queries directly on VPC Flow Logs. Which destination should you pick?
- CloudWatch Logs, so Insights can query the flow records (correct answer)
- Amazon S3, then load every object into Athena before any query runs
- Kinesis Data Firehose, which lets Logs Insights read the stream live
- An EBS volume attached to a jump host that parses the flow files locally
Sending Flow Logs to CloudWatch Logs lets you query them with Logs Insights directly. S3 needs Athena instead of Insights, Firehose is a delivery stream not queryable by Insights, and an EBS parsing host is not a native option.
5. A Lambda function runs but you find no logs. Which requirement is most likely unmet?
- The function needs a VPC attachment before it can log anything
- A subscription filter must exist or Lambda writes nothing to logs
- The execution role lacks permission to write to CloudWatch Logs (correct answer)
- A metric filter has to be created first so that Lambda knows where to log
Lambda writes to CloudWatch Logs using its execution role, so missing logs usually mean the role lacks logs:CreateLogGroup/CreateLogStream/PutLogEvents. VPC attachment, subscription filters, and metric filters are not prerequisites for basic logging.
6. You must monitor a global website's availability and full user journey. Which two tools contribute? (Choose TWO.)
- Route 53 health checks for endpoint availability (correct answer)
- A CloudWatch metric filter over the VPC flow logs of the site
- A Synthetics canary replaying the checkout journey (correct answer)
- An S3 bucket policy restricting object downloads
Route 53 health checks probe endpoints from global locations for availability and can drive DNS failover, while a Synthetics canary validates the multi-step user journey. A flow-log metric filter measures network traffic, and an S3 bucket policy controls access, neither monitoring the journey.