RANGER GAMEZ

AWS Certified Cloud Practitioner (CLF-C02) · chapter 11 of 14

Roads into the VPC

In this chapter Objectives 3.5

  1. Inside a VPC
  2. Connecting VPCs and services privately
  3. Security in a VPC
  4. Amazon Route 53 and the front doors
  5. From the office to AWS
  6. Inside a VPC
  7. AWS networking services
  8. Securing a VPC: security groups vs network ACLs
  9. AWS VPN: encrypted tunnels to your VPC
  10. Network services: what each one is for
  11. Practice questions
  12. Chapter recap

Objective 3.5

Inside a VPC

Your own private network: VPC and subnets

An Amazon Virtual Private Cloud (Amazon VPC) is your own isolated network inside an AWS Region. You choose its private Internet Protocol (IP) address range as a CIDR block (Classless Inter-Domain Routing), such as 10.0.0.0/16. You split it into subnets, each living in one Availability Zone (AZ). A public subnet has a route to the internet; a private subnet doesn't, so it's the place for app servers and databases.

A virtual private cloud, VPC 10.0.0.0/16, spread across two Availability Zones. At the top, the internet connects through an internet gateway on the VPC edge. In each AZ there is a public subnet (10.0.1.0/24 and 10.0.2.0/24) whose route table sends internet traffic to the internet gateway, holding a web server; AZ a's public subnet also holds a NAT gateway. Below are private subnets (10.0.3.0/24 and 10.0.4.0/24) holding the app and the database; they have no route from the internet, and they reach out for updates through the NAT gateway. A dashed orange outline around each server is its security group, a stateful firewall at the instance. A red bar on each subnet edge is its network ACL, a stateless filter at the subnet. At the bottom, the Kibble & Co. office has two separate links up to the VPC's virtual private gateway: on the left a dashed purple line with a padlock, AWS Site-to-Site VPN, an encrypted tunnel over the internet; on the right a thick solid line, AWS Direct Connect, a private, dedicated line that does not use the internet. A company can use either, or both with one as a backup.
Public subnets route to the internet gateway; private subnets go out through a NAT gateway. Security groups guard instances, network ACLs guard subnets. The office links in by Site-to-Site VPN or Direct Connect.

Exam tip A VPC spans every AZ in its Region; a subnet sits in exactly one AZ. High availability = subnets in two or more AZs.

Route tables and gateways

A route table tells traffic in a subnet where to go. Gateways are the doors.

  • Internet gateway: connects the VPC to the internet; a subnet whose route table points to it is public
  • NAT gateway (network address translation): lets servers in private subnets reach out, for updates, while blocking connections started from the internet
  • Virtual private gateway: the AWS end of a virtual private network (VPN) connection to your office

Sam: So the database can download patches through the NAT gateway, but nobody on the internet can knock on its door.

Check yourself 1The order database sits in a private subnet. It must download security patches from the internet, but nothing on the internet may start a connection to it. What should Dev add?

  1. An internet gateway route in the private subnet
  2. A NAT gateway in a public subnet
  3. A second VPC
  4. An AWS Direct Connect link
Show the answer

Answer: B. A NAT gateway in a public subnet

A NAT gateway lets private resources start outbound connections while refusing connections started from the internet.

Objective 3.5

Connecting VPCs and services privately

Peering, Transit Gateway and endpoints

Networks grow. VPC peering links two VPCs privately, one pair at a time. AWS Transit Gateway is a central hub that connects many VPCs and on-premises networks, instead of a tangle of pairs. VPC endpoints, powered by AWS PrivateLink for most services, let resources reach AWS services such as Amazon Simple Storage Service (Amazon S3) or Amazon DynamoDB, or a partner's service, without going over the internet.

Exam tip Two VPCs = peering. Dozens of VPCs plus the office = Transit Gateway. Reach S3 privately from a private subnet = VPC endpoint.

Check yourself 2Kibble & Co. will soon have 15 VPCs plus the office network, and every one must reach the others. Which service keeps this simplest?

  1. AWS Transit Gateway
  2. One VPC peering link per pair
  3. An internet gateway in each VPC
  4. Amazon CloudFront
Show the answer

Answer: A. AWS Transit Gateway

Transit Gateway acts as a hub: each VPC and the office connect once, instead of managing a peering link for every pair.

Objective 3.5

Security in a VPC

Security groups: a guard at each instance

A security group is a virtual firewall around an instance (more exactly, its network interface). It has allow rules only; anything not allowed is blocked. It is stateful: if a request is allowed in, the reply is allowed back out automatically. New security groups block all inbound traffic and allow all outbound traffic until you add rules.

Sam: So I never write a rule for the reply. The guard remembers who it let in.

Network ACLs: a gate at each subnet

A network access control list (network ACL, or NACL) filters traffic at the subnet edge. It has numbered allow and deny rules, checked from the lowest number up; the first match wins. It is stateless: replies are checked again, so you must allow the return traffic too, usually on the high temporary (ephemeral) ports 1024-65535.

Priya: The NACL is the gate to the yard. The security group is the guard at each kennel door.

Exam tip Security group = instance, stateful, allow only. NACL = subnet, stateless, allow AND deny. Blocking one bad IP range = NACL deny rule.

Amazon Inspector checks the roads

Amazon Inspector, from the guard dogs chapter, also checks network exposure: it reports Amazon EC2 instances that can be reached from the internet on a port, because of the way security groups, NACLs, route tables and gateways combine. Together with its software vulnerability scans, it tells you what an attacker could actually reach.

Check yourself 3Which statements about network ACLs are correct? Choose two.

  1. They are stateless, so return traffic needs its own rule
  2. They attach to individual EC2 instances
  3. They can contain explicit deny rules
  4. They only support allow rules
  5. They automatically allow replies to permitted requests
Show the answer

Answers: A. They are stateless, so return traffic needs its own rule, C. They can contain explicit deny rules

Network ACLs work at the subnet level, keep no connection state, and support both allow and deny rules in numbered order.

Objective 3.5

Amazon Route 53 and the front doors

Amazon Route 53

Amazon Route 53 is AWS's highly available DNS service: it answers "what address is shop.kibbleco.example?". It also does domain registration (buy and manage domain names), health checks on your endpoints, and routing policies that decide which answer each user gets: simple, weighted (split traffic), latency-based (nearest Region), failover (to a standby when the main site is unhealthy) and geolocation (by the user's country).

Rosa: So Route 53 is the receptionist who tells callers which desk to walk to?

Dev: And skips any desk that's empty.

Exam tip DNS, register a domain, health checks, send users to the healthy or nearest Region = Route 53. The name comes from port 53, the DNS port.

More front doors: CloudFront, Global Accelerator, API Gateway

Three services sit in front of apps. Amazon CloudFront caches content at edge locations (you met it on the map walk). AWS Global Accelerator gives fixed IP addresses and carries users' traffic over the AWS global network to the healthiest Region, with no caching, good for non-web Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) apps. Amazon API Gateway creates and manages application programming interfaces (APIs), a front door for code such as AWS Lambda.

Exam tip Cache web content = CloudFront. Static IPs and faster routing over AWS's network = Global Accelerator. Name lookups = Route 53.

Check yourself 4Dev runs the shop in us-east-1 with a standby copy in us-west-2. If the main site fails its health checks, customers should be sent to the standby automatically. Which service does this?

  1. AWS Transit Gateway
  2. Amazon Inspector
  3. A NAT gateway
  4. Amazon Route 53 with failover routing
Show the answer

Answer: D. Amazon Route 53 with failover routing

Route 53 health checks plus a failover routing policy answer DNS queries with the standby when the primary is unhealthy.

Objective 3.5

From the office to AWS

VPN or Direct Connect?

Three ways in for Kibble & Co.'s own people and buildings:

  • AWS Site-to-Site VPN: an encrypted virtual private network (VPN) tunnel from the office router to the VPC over the internet. Quick and cheap to set up
  • AWS Client VPN: a managed VPN for individual people, such as staff working from home
  • AWS Direct Connect: a dedicated, private network line from your building to AWS. More consistent speed and latency, and it avoids the internet; takes longer to set up

Dev: A VPN is a private tunnel through a public road. Direct Connect is our own road.

Exam tip Need it this week, encrypted, over the internet = Site-to-Site VPN. Consistent performance and a private line = Direct Connect. Many use VPN as backup to Direct Connect.

Check yourself 5The warehouse sends large label and stock files to AWS all day and needs steady, predictable network performance that doesn't depend on the internet. Which option fits best?

  1. AWS Client VPN
  2. AWS Site-to-Site VPN
  3. AWS Direct Connect
  4. An internet gateway
Show the answer

Answer: C. AWS Direct Connect

Direct Connect is a dedicated private connection with consistent performance that doesn't travel over the public internet.

Go deeper

More on the objectives in this chapter, in the same exam-ready detail.

Objective 3.5 · Identifying the components of a VPC (for example, subnets, gateways)

Inside a VPC

The building blocks

A VPC (virtual private cloud) is your own isolated network in a Region, with an IP range you choose (CIDR block).

  • Subnets: slices of the VPC in one Availability Zone. Public subnets have a route to an internet gateway; private subnets don't
  • Route tables: decide where traffic from a subnet goes
  • Internet gateway: connects the VPC to the internet
  • NAT gateway: lets private-subnet instances reach out to the internet (updates) without being reachable from it
  • Virtual private gateway / transit gateway: connect VPN, Direct Connect and other VPCs
  • VPC endpoints: reach AWS services (like S3) privately without the internet
  • VPC peering: connect two VPCs

Typical layout

Web servers or load balancer in public subnets; databases in private subnets; a NAT gateway for outbound updates; subnets spread over two or more AZs for availability.

Exam tip Instance in a private subnet needs to download patches: NAT gateway. Needs to be reached from the internet: public subnet + internet gateway.

Objective 3.5 · AWS network services

AWS networking services

The list to know

The networking services named in the exam guide:

  • Amazon VPC: your private network
  • Elastic Load Balancing: Application (HTTP/HTTPS), Network (TCP/UDP) and Gateway load balancers
  • Amazon Route 53: DNS, domain registration, health checks and routing policies
  • Amazon CloudFront: CDN
  • AWS Global Accelerator: faster routing over AWS's global network
  • AWS Direct Connect: a private, dedicated line from your data center to AWS
  • AWS Site-to-Site VPN and AWS Client VPN: encrypted tunnels over the internet
  • AWS Transit Gateway: hub connecting many VPCs and networks
  • AWS PrivateLink / VPC endpoints: private access to services

Direct Connect vs VPN

VPN: quick to set up, encrypted, over the public internet, variable performance. Direct Connect: private physical connection, consistent bandwidth and latency, takes longer to set up.

Objective 3.5 · Understanding security in a VPC (for example, network ACLs, security groups, Amazon Inspector)

Securing a VPC: security groups vs network ACLs

Two layers of rules

A VPC has two kinds of firewall, and the exam loves the differences:

  • Security group: a firewall on an instance's network interface. Stateful (return traffic is allowed automatically). Allow rules only. Default: deny all inbound, allow all outbound
  • Network ACL: a firewall on a subnet. Stateless (you must allow return traffic too). Allow and deny rules, evaluated in number order. Default NACL allows everything

More VPC security

VPC Flow Logs record traffic for investigation; AWS Network Firewall filters traffic for whole VPCs; Amazon Inspector scans instances for vulnerabilities and unintended network exposure; Amazon GuardDuty spots suspicious traffic.

Exam tip Need to block one specific IP address: network ACL (security groups can't deny).

Objective 3.5 · AWS VPN

AWS VPN: encrypted tunnels to your VPC

Two kinds

AWS Site-to-Site VPN connects an on-premises network (your router or firewall) to a VPC over the internet using IPsec tunnels (two tunnels for redundancy). AWS Client VPN lets individual users connect securely from their laptops (OpenVPN-based).

Exam tip Fast to set up, encrypted, uses the internet = VPN. Dedicated private line = Direct Connect. You can also run a VPN over Direct Connect for encryption.

Objective 3.5 · Network services

Network services: what each one is for

Match the need

Pick the service by what you need to do:

  • Isolated private network = Amazon VPC
  • Spread traffic across instances = Elastic Load Balancing
  • Domain names and routing users = Amazon Route 53
  • Cache content near users = Amazon CloudFront
  • Private connection from your data center = AWS Direct Connect
  • Encrypted tunnel over the internet = AWS VPN
  • Connect many VPCs and on-premises networks through one hub = AWS Transit Gateway
  • Reach AWS services without the internet = VPC endpoints / AWS PrivateLink
  • Faster global routing for TCP/UDP apps = AWS Global Accelerator

Practice questions

Answer in your head, then open the answer. Ranger's Cloud Kennel has 563 questions like these for AWS Cloud Practitioner, with mock exams.

Question 1What is Amazon Virtual Private Cloud (Amazon VPC)?

  1. A physical private line from your office to AWS
  2. A content delivery network for caching websites
  3. A DNS service for registering domain names
  4. A logically isolated virtual network you define in the AWS Cloud
Show the answer

Answer: D. A logically isolated virtual network you define in the AWS Cloud

Amazon VPC lets you launch AWS resources in a logically isolated virtual network that you define, including its IP address range, subnets, route tables and gateways.

Question 2Inside a VPC, what is a subnet?

  1. A range of IP addresses that spans every AZ in the Region
  2. A firewall attached to each EC2 instance
  3. A range of IP addresses in the VPC, placed in one Availability Zone
  4. A connection between two VPCs
Show the answer

Answer: C. A range of IP addresses in the VPC, placed in one Availability Zone

A subnet is a range of IP addresses within a VPC, and each subnet sits in a single AZ. Spreading subnets over several AZs is how you build highly available designs.

Question 3Which VPC component allows resources in public subnets to communicate with the internet in both directions?

  1. Internet gateway
  2. NAT gateway
  3. Virtual private gateway
  4. VPC gateway endpoint
Show the answer

Answer: A. Internet gateway

An internet gateway attached to the VPC, plus a route to it in the subnet's route table, lets resources with public IP addresses send and receive internet traffic.

Question 4EC2 instances in a private subnet must download software updates from the internet, but nothing on the internet may start a connection to them. Which component should they use?

  1. An internet gateway attached directly to the private subnet's routes
  2. A security group that allows all inbound traffic
  3. AWS Direct Connect
  4. A NAT gateway
Show the answer

Answer: D. A NAT gateway

A NAT gateway, placed in a public subnet, lets instances in private subnets start outbound connections to the internet while blocking connections started from outside.

Question 5What makes a subnet in a VPC a public subnet?

  1. It has a security group that allows port 443
  2. It is in the first Availability Zone of the Region
  3. Its route table has a route to an internet gateway
  4. It uses a network ACL that allows all traffic
Show the answer

Answer: C. Its route table has a route to an internet gateway

A subnet is public when its route table sends internet-bound traffic (0.0.0.0/0) to an internet gateway. A private subnet has no such route.

Practice it in Ranger's Cloud KennelThe same lessons as a story, with drills, hands-on labs and mock exams. Free, in your browser.
Play free

AWS and Amazon Web Services are trademarks of Amazon.com, Inc. or its affiliates. Ranger Gamez is not affiliated with or endorsed by Amazon. The practice questions are written to the published exam objectives; they are not real exam questions.