Amazon VPC Networking, Connectivity, and Security – SAP-C02 Study Guide

Purpose of This Lesson

Amazon Virtual Private Cloud (VPC) provides a logically isolated network in an AWS Region. It gives you control over IP addressing, subnets, routing, connectivity, and network security for AWS resources.

For the SAP-C02 exam, VPC questions commonly test CIDR planning, public versus private subnet behavior, multi-AZ architecture, security group versus network ACL semantics, hybrid connectivity, VPC peering, and VPC endpoints.

Key Concepts

VPC scope and Availability Zones

• A VPC is regional and can contain subnets in multiple Availability Zones (AZs).
• Each subnet belongs to exactly one AZ.
• A default VPC is created in each Region and normally includes a default subnet in each AZ.
• The default quota is five VPCs per Region, although quotas can be adjustable.
• Availability Zone names can map differently between AWS accounts. For consistent physical-zone placement across accounts, use the AZ ID, such as use1-az1, rather than relying only on names such as us-east-1a.

CIDR blocks and subnet planning

When creating a VPC, you assign an IPv4 CIDR block, commonly from the RFC 1918 private ranges:

• 10.0.0.0/8
• 172.16.0.0/12
• 192.168.0.0/16

The VPC IPv4 CIDR range can generally be between /16 and /28. The CIDR block cannot overlap with an existing VPC CIDR block associated with that VPC, and an existing CIDR block cannot be resized. You can, however, associate additional CIDR blocks where supported by the design and quotas.

AWS reserves five IPv4 addresses in every subnet: the first four addresses and the final address. For example, in 10.0.0.0/24, the following addresses are reserved:

• 10.0.0.0: network address
• 10.0.0.1: VPC router
• 10.0.0.2: Amazon-provided DNS server
• 10.0.0.3: reserved for future use
• 10.0.0.255: network broadcast address, although broadcast is not supported

A /24 therefore provides 251 usable IPv4 addresses, not 256.

Plan addressing for:

• Multiple environments, such as development, staging, and production
• Multiple application tiers
• Growth in workloads and accounts
• Multi-AZ deployment
• Future VPC peering, Transit Gateway, VPN, or Direct Connect connectivity
• On-premises and other cloud networks

Overlapping CIDRs can prevent or complicate private routing. VPC peering requires non-overlapping CIDR blocks, and overlapping address spaces are also a major obstacle for many centralized network and hybrid-connectivity designs.

Public and private subnets

A public subnet is a subnet whose route table has a route to an Internet Gateway (IGW). Resources also need a public IPv4 address or Elastic IP address to communicate directly with the public IPv4 Internet.

A private subnet has no direct route to an IGW. Private resources can still access the Internet for outbound IPv4 connections through a NAT gateway, or access selected AWS services privately through VPC endpoints.

A subnet’s name does not determine whether it is public or private. The route table association and addressing configuration do.

Core VPC components

• Subnet: A segment of the VPC CIDR range associated with one AZ.
• Route table: Defines where traffic is sent. Each subnet is associated with one route table, either explicitly or through the main route table.
• VPC router: Performs routing between subnets, gateways, and other targets according to route tables.
• Internet Gateway: Provides a horizontally scaled, redundant connection between a VPC and the Internet. It is required for direct public IPv4 Internet routing.
• NAT gateway: Managed service that allows instances in private subnets to initiate outbound IPv4 connections. It does not allow unsolicited inbound connections.
• Egress-only Internet Gateway: Provides outbound-only Internet access for IPv6 resources. IPv6 does not use NAT gateway translation in the same way as IPv4.
• VPC peering: Private connectivity between two VPCs using the AWS network, without traversing the public Internet.
• VPC endpoint: Private connectivity from a VPC to supported AWS services or endpoint services.
• Virtual private gateway (VGW): The AWS-side endpoint for a Site-to-Site VPN attached to a VPC.
• Customer gateway: The customer-side representation of the on-premises VPN device or software.

Security groups versus network ACLs

Characteristic	Security group	Network ACL
Applied at	Elastic network interface/resource level	Subnet level
Rule types	Allow only	Allow and deny
State	Stateful	Stateless
Rule processing	All applicable rules are evaluated	Rules are evaluated in ascending rule-number order
Return traffic	Automatically allowed for an established connection	Must be explicitly allowed in the opposite direction
Scope	Only resources associated with the group	All resources in associated subnets
Typical use	Workload-level access control	Subnet boundary filtering and explicit deny rules

Security groups are the primary control for instance-level traffic. Because they are stateful, allowing inbound TCP 443 also permits the corresponding response traffic without a separate outbound rule, assuming the outbound policy allows it.

Network ACLs are useful as a coarse subnet-level control, especially when explicit deny rules are required. Because they are stateless, both inbound and outbound directions must be considered.

AWS-managed Site-to-Site VPN

AWS Site-to-Site VPN creates encrypted IPsec tunnels over the public Internet between an on-premises customer gateway and a virtual private gateway or other supported AWS network endpoint.

Important characteristics:

• Faster to provision than a dedicated private connection
• Dependent on Internet availability, Internet latency, and Internet performance
• Supports static routing or dynamic routing with BGP
• Can be used as a backup path for Direct Connect
• Commonly deployed with redundant tunnels for higher availability

Direct Connect

AWS Direct Connect provides a dedicated network connection from a customer or colocation facility to an AWS Direct Connect location and then into the AWS network.

Use it when the architecture requires more predictable connectivity, sustained high bandwidth, or reduced dependence on the public Internet. Direct Connect supports BGP and virtual interfaces, including connectivity to VPCs and public AWS services depending on the virtual interface type and design.

Tradeoffs include:

• Longer provisioning and implementation time
• Dependence on a colocation, telecom, or connectivity provider
• Additional physical and operational costs
• The need for a separate backup path if high availability is required

Direct Connect alone does not automatically provide encryption. A VPN tunnel can be run over the Direct Connect path when encryption is required, although this increases complexity.

VPN CloudHub

VPN CloudHub uses multiple Site-to-Site VPN connections attached to a virtual private gateway to create a hub-and-spoke network. It can connect branch offices and data centers to AWS and, with appropriate routing, allow communication between those locations.

CloudHub is useful when existing Internet-based VPN connections are available and a full dedicated WAN is not justified. It remains dependent on the Internet and requires careful routing and redundancy planning. Customer gateways need distinct BGP autonomous system numbers and non-overlapping network ranges where applicable.

Software VPN

A software VPN runs on customer-managed infrastructure, commonly an EC2 instance or a partner appliance. It provides flexibility over VPN protocols, routing, inspection, and topology, but the customer is responsible for:

• Operating system and VPN software maintenance
• Patching and monitoring
• Throughput and instance sizing
• High availability and failover
• Licensing and support

This option is appropriate when AWS-managed VPN capabilities do not meet a specific technical requirement, but it carries more operational responsibility.

VPC peering

VPC peering provides private, point-to-point connectivity between two VPCs over the AWS network. It can connect VPCs in the same or different Regions, subject to service and configuration requirements.

Key limitations:

• VPC peering is not transitive.
• Each VPC must have routes for the remote CIDR through the peering connection.
• Security groups, network ACLs, and routing must all permit the traffic.
• Overlapping CIDR blocks prevent the normal peering design.

If many VPCs must communicate with one another, a mesh of peering connections becomes difficult to operate. A centralized service such as AWS Transit Gateway is usually a better modern design for large-scale hub-and-spoke connectivity.

VPC endpoints

VPC endpoints keep traffic between a VPC and supported AWS services on private AWS networking rather than requiring an Internet Gateway, NAT gateway, or public IP address.

#### Gateway endpoints

Gateway endpoints are route-table targets for Amazon S3 and Amazon DynamoDB.

• No endpoint ENIs are deployed in subnets.
• Route tables receive routes based on AWS-managed prefix lists.
• They are commonly used by private subnets.
• Endpoint policies can restrict access to specific buckets, tables, or actions.
• Security groups are not associated with gateway endpoints.

#### Interface endpoints

Interface endpoints use AWS PrivateLink and deploy elastic network interfaces with private IP addresses into selected subnets.

• They support many AWS services and eligible partner or customer endpoint services.
• DNS can resolve service names to the endpoint’s private addresses.
• Security groups control access to the endpoint ENIs.
• Each AZ that requires local high availability should generally have an endpoint ENI.
• They incur endpoint-hour and data-processing charges.

Interface endpoints are useful when private workloads need services such as CloudWatch, CloudFormation, or API Gateway without traversing public IP space or a NAT gateway.

VPC Flow Logs

VPC Flow Logs capture metadata about traffic to and from network interfaces. They do not capture packet contents.

Flow logs can be created at the:

• VPC level
• Subnet level
• Network interface level

Records can be delivered to Amazon CloudWatch Logs or Amazon S3. Flow Logs are valuable for troubleshooting rejected traffic, validating network paths, and supporting security investigations. They are not an inline firewall and do not block traffic.

Exam-Relevant Takeaways

• A VPC is regional; a subnet is tied to one AZ.
• Spread production resources across subnets in multiple AZs for resilience.
• A public subnet requires a route to an Internet Gateway. A public IP or Elastic IP is also needed for direct public IPv4 communication.
• NAT gateways provide outbound IPv4 access from private subnets; they do not provide inbound Internet access.
• For resilient private-subnet egress, deploy a NAT gateway in each AZ and route each AZ’s private subnets to the local NAT gateway. A single NAT gateway is a cross-AZ dependency and a potential failure or cost bottleneck.
• Security groups are stateful and allow-only. Network ACLs are stateless and support both allow and deny rules.
• VPC peering is private but non-transitive and requires non-overlapping CIDRs.
• Use gateway endpoints for S3 and DynamoDB; use interface endpoints for most other supported services.
• Direct Connect offers a dedicated path but is not inherently encrypted. Add VPN encryption when required.
• Site-to-Site VPN is quicker to establish but depends on the public Internet.
• VPC Flow Logs record traffic metadata for analysis; they do not enforce traffic policy.
• Use AZ IDs when coordinating AZ placement across AWS accounts.

Architecture Decision Guide

Requirement	Preferred option	Main tradeoff or consideration
Public IPv4 access for a web tier	Public subnet with IGW route and public addressing	Requires strict security controls and should not be used for private application or database tiers
Outbound IPv4 Internet access from private instances	NAT gateway	Per-hour and data-processing charges; deploy per AZ for resilience
Outbound IPv6 Internet access only	Egress-only Internet Gateway	IPv6-specific and outbound-only
Private access to S3 or DynamoDB	Gateway endpoint	Route-table based; no security group association
Private access to supported AWS or partner services	Interface endpoint	Uses ENIs, security groups, DNS, and endpoint charges
Fast encrypted hybrid connectivity	Site-to-Site VPN	Internet-dependent and variable latency
Predictable, high-volume private connectivity	Direct Connect	Longer provisioning and additional provider dependencies
Encryption over a Direct Connect path	VPN over Direct Connect	Adds operational complexity
Two-VPC private connectivity	VPC peering	Non-transitive and difficult to scale as a full mesh
Many-VPC hub-and-spoke connectivity	Transit Gateway or an equivalent centralized design	Additional service cost and centralized routing governance
Custom VPN protocols or inspection	Software VPN/appliance	Customer-managed availability, patching, and scaling

Common Exam Traps

• Calling a subnet public because it has a public IP setting: The route table must include a route to an Internet Gateway, and the resource must have public addressing for direct Internet communication.
• Assuming a NAT gateway accepts inbound connections: NAT gateways support return traffic for connections initiated from private resources; they are not inbound publishing mechanisms.
• Treating security groups like firewalls with deny rules: Security groups support allow rules only. Use network ACLs or a dedicated firewall service when explicit denies are required.
• Forgetting that network ACLs are stateless: Return traffic needs a matching rule in the reverse direction.
• Assuming VPC peering is transitive: A-to-B and B-to-C peering does not automatically permit A-to-C traffic.
• Using overlapping CIDRs in a multi-VPC plan: Overlap prevents normal routing and can invalidate peering or centralized network designs.
• Assuming Direct Connect is encrypted: Direct Connect is a private circuit, not automatically an encrypted tunnel.
• Using an interface endpoint for S3 or DynamoDB without checking the design: Gateway endpoints are the standard route-table-based option for these services.
• Expecting Flow Logs to block traffic: Flow Logs provide visibility only.
• Assuming AZ names identify the same physical AZ across accounts: Use AZ IDs for cross-account placement decisions.

Real-World Engineer Notes

• Reserve CIDR space for future VPCs, shared services, inspection networks, and hybrid connectivity before deploying workloads.
• Avoid putting all private-subnet egress through one NAT gateway. Per-AZ NAT gateways improve fault isolation but increase cost.
• Prefer private subnets for application and data tiers. Public subnets should generally contain only components that genuinely require direct public reachability, such as load balancers or controlled bastion access.
• Use route tables, security groups, network ACLs, endpoint policies, and AWS Network Firewall as separate layers rather than expecting one control to solve every network-security requirement.
• Centralize VPC Flow Logs in a security or logging account when organizational governance requires cross-account visibility.
• For large VPC estates, evaluate AWS Transit Gateway rather than building and operating a large peering mesh.
• When designing hybrid networks, include failure modes: redundant VPN tunnels, redundant customer equipment, multiple Direct Connect connections or locations, and a tested failover path.
• Remember that endpoint deployment, NAT processing, cross-AZ traffic, and Direct Connect data transfer can all affect cost. Route traffic deliberately.

Quick Reference Summary

• VPC: Regional, logically isolated network.
• Subnet: Single-AZ segment of a VPC CIDR.
• Public subnet: Route to an Internet Gateway; resources need public addressing for direct IPv4 Internet access.
• Private subnet: No direct IGW route; use NAT for outbound IPv4 or endpoints for private AWS-service access.
• Security group: Resource-level, stateful, allow-only.
• Network ACL: Subnet-level, stateless, ordered allow/deny.
• VPN: Encrypted over the Internet; fast to deploy but Internet-dependent.
• Direct Connect: Dedicated private connectivity; predictable but slower to provision and not inherently encrypted.
• VPC peering: Private, point-to-point, non-transitive.
• Gateway endpoint: S3 and DynamoDB through route tables.
• Interface endpoint: PrivateLink ENIs for many supported services.
• Flow Logs: Traffic metadata for visibility, not enforcement.

Flashcards

1. What is the scope of a VPC?

A VPC is regional and can span multiple Availability Zones through its subnets.

2. What is the scope of a subnet?

A subnet belongs to exactly one Availability Zone.

3. What makes a subnet public?

Its associated route table has a route to an Internet Gateway. A resource also needs a public IPv4 address or Elastic IP for direct public IPv4 communication.

4. How many IPv4 addresses does AWS reserve in each subnet?

Five: the first four and the final address.

5. How do security groups differ from network ACLs?

Security groups are stateful, resource-level, and allow-only. Network ACLs are stateless, subnet-level, and support ordered allow and deny rules.

6. What is the purpose of a NAT gateway?

To provide outbound IPv4 Internet access for resources in private subnets without allowing unsolicited inbound connections.

7. Is VPC peering transitive?

No. VPC peering is a direct point-to-point relationship.

8. What is required for normal VPC peering connectivity?

Non-overlapping CIDRs, routes through the peering connection, and permissive security controls.

9. Which endpoint type is used for S3 and DynamoDB?

Gateway endpoints.

10. What does an interface endpoint use?

Elastic network interfaces with private IP addresses, DNS resolution, security groups, and AWS PrivateLink.

11. Is Direct Connect encrypted by default?

No. Use a VPN over Direct Connect when encryption is required.

12. Where can VPC Flow Logs be enabled?

At the VPC, subnet, or network interface level.

Practice Questions

Question 1

A company runs application servers in private subnets across three Availability Zones. The servers require outbound access to download operating-system updates. The company wants to avoid cross-AZ dependencies and maintain connectivity if one AZ fails. What is the best design?

Correct answer: Deploy a NAT gateway in each AZ and route each AZ’s private subnet to the NAT gateway in the same AZ.

Explanation: A NAT gateway provides outbound IPv4 access for private resources. Deploying one per AZ avoids a single-AZ dependency and reduces cross-AZ traffic. A single centralized NAT gateway is less resilient and can introduce additional cross-AZ data-transfer costs.

Question 2

An organization has three VPCs: VPC-A is peered with VPC-B, and VPC-B is peered with VPC-C. Resources in VPC-A must communicate privately with resources in VPC-C. What should the architect conclude about the current design?

Correct answer: VPC peering is non-transitive, so an additional direct connection or centralized routing service is required.

Explanation: Traffic cannot automatically transit VPC-B through two peering connections. The organization can create a direct A-to-C peering connection, provided CIDRs do not overlap, or migrate the topology to a centralized service such as AWS Transit Gateway.

Question 3

Instances in a private subnet must access Amazon S3 without using public IP addresses or a NAT gateway. Which solution meets the requirement with the least operational overhead?

Correct answer: Create an S3 gateway VPC endpoint and associate it with the private subnet’s route table.

Explanation: Gateway endpoints for S3 use route-table entries and AWS-managed prefix lists. They provide private access without NAT processing or interface endpoint ENIs. An endpoint policy can further restrict which S3 resources and actions are permitted.

Question 4

A security engineer adds an inbound allow rule to a network ACL for TCP port 443. Clients can establish a connection, but responses never reach them. The security groups allow the traffic. What is the likely cause?

Correct answer: The network ACL does not have a corresponding outbound rule for the return traffic and ephemeral client ports.

Explanation: Network ACLs are stateless. Both directions must be allowed explicitly. Security groups are stateful, but they do not override a blocking network ACL.

Question 5

A company needs a high-bandwidth connection between its data center and AWS with predictable performance. Its compliance team also requires traffic to be encrypted. Which architecture best satisfies both requirements?

Correct answer: Use Direct Connect for the dedicated path and establish an encrypted VPN tunnel over that connection.

Explanation: Direct Connect provides dedicated, predictable connectivity but does not inherently encrypt traffic. A VPN over Direct Connect adds encryption while retaining the private connectivity path, at the cost of additional configuration and operational complexity.