IPv4 Addressing, Subnet Masks, and Private Ranges – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

IPv4 addressing is foundational to Amazon VPC design. You need to understand how an address is divided into network and host portions, how subnet masks and CIDR notation express that division, and which address ranges are private and suitable for internal cloud resources.

These concepts support later VPC decisions involving VPC CIDR blocks, subnet sizing, routing, internet connectivity, and network address translation.

Key Concepts

IPv4 address structure

An IPv4 address contains 32 bits divided into four 8-bit sections called octets. It is normally written in dotted-decimal notation, such as:

192.168.0.1

Each octet can represent a decimal value from 0 through 255 because eight bits can represent 256 possible values.

The binary place values within one octet are:

Bit position	Value
1	128
2	64
3	32
4	16
5	8
6	4
7	2
8	1

A binary bit set to 1 contributes its place value; a bit set to 0 contributes nothing. For example, the binary octet 11000000 equals 128 + 64, or 192.

Network ID and host ID

An IPv4 address has two logical parts:

Network ID: Identifies the network to which the address belongs.
Host ID: Identifies a particular device or resource within that network.

For example, with a simplified 192.168.0.0/24 network, addresses share the 192.168.0 network portion while the final octet identifies individual hosts.

The exact boundary between network and host portions is determined by the subnet mask or CIDR prefix—not by the visual position of the dots alone.

Subnet masks

A subnet mask identifies which bits belong to the network portion. In dotted-decimal form, a 255 octet means all eight bits in that octet are part of the network prefix, while a 0 octet means those bits are available for host addressing.

Example:

IP address:  192.168.0.1
Subnet mask: 255.255.255.0

The first 24 bits are the network portion, and the remaining 8 bits are the host portion.

CIDR notation

Classless Inter-Domain Routing, or CIDR, expresses a network address and prefix length together:

192.168.0.0/24

The /24 means that the first 24 of the address’s 32 bits are fixed as the network prefix. The remaining 8 bits are available for host addresses before accounting for platform-specific reservations or other design constraints.

CIDR is the notation commonly used when defining AWS VPC and subnet address ranges.

RFC 1918 private IPv4 ranges

The following IPv4 blocks are reserved for private use under RFC 1918:

Private range	CIDR representation	Scope
`10.0.0.0` through `10.255.255.255`	`10.0.0.0/8`	Large private address space
`172.16.0.0` through `172.31.255.255`	`172.16.0.0/12`	Private address space
`192.168.0.0` through `192.168.255.255`	`192.168.0.0/16`	Common for smaller private networks

Private addresses are not directly routable on the public internet. They are appropriate for internal resources, including many workloads deployed within VPC subnets.

Private-to-public connectivity

Private addresses can still support outbound internet access when a network address translation mechanism is used. In AWS, a common design uses a NAT gateway in a public subnet so resources in private subnets can initiate connections outward without receiving direct inbound internet connections.

Public connectivity can also involve mapping or associating public IP addresses with resources, depending on the service and architecture. The important distinction is that a private IP address itself is not internet-routable.

Exam-Relevant Takeaways

IPv4 addresses contain 32 bits divided into four 8-bit octets.
Each octet ranges from 0 to 255.
The subnet mask determines which bits are network bits and which are host bits.
CIDR notation uses a slash followed by the number of network-prefix bits, such as /24.
A /24 leaves 8 address bits outside the prefix, but usable capacity may be reduced by AWS or service-specific reservations.
The RFC 1918 private ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Private IPv4 addresses are not directly routable across the public internet.
NAT provides translation and outbound connectivity; it does not turn a private address into a publicly routable address.
VPC and subnet CIDR blocks must be planned carefully because overlapping ranges complicate or prevent routing between networks.

Architecture Decision Guide

Requirement	Appropriate addressing approach	Key consideration
Internal VPC resources	Use non-overlapping private CIDR ranges	Leave room for growth and future network connections
Large private address space	Start with an appropriate portion of `10.0.0.0/8`	Subdivide into VPCs, subnets, and other network segments as needed
Smaller isolated network	Use a suitable block from `172.16.0.0/12` or `192.168.0.0/16`	Ensure it does not overlap with on-premises or peered networks
Private subnet workloads requiring outbound internet access	Use a NAT-based design	NAT supports outbound initiation but is not a general inbound access path
Direct internet reachability	Use public addressing and appropriate routing/security controls	A public IP alone does not replace route-table or security configuration
Connecting VPCs or hybrid networks	Allocate non-overlapping CIDR blocks	Overlapping CIDRs are a major connectivity and routing limitation

Common Exam Traps

Confusing a private IP with an internet-routable IP: RFC 1918 addresses are intended for internal use and cannot be routed directly on the public internet.
Assuming every /24 has the same usable capacity everywhere: The prefix describes the address range, but AWS services may reserve addresses or impose service-specific limits.
Treating the subnet mask as an address: The mask defines the boundary; it is not another host address.
Assuming the last octet is always the host portion: That is true for a /24 example, but not for prefixes such as /20, /26, or /28.
Using overlapping private ranges across connected networks: Separate networks may operate independently with overlapping CIDRs, but routing between them becomes problematic.
Assuming NAT allows inbound access: NAT is primarily used to translate and support connections initiated from private resources. Inbound application access requires an intentional public-facing design.
Ignoring address planning: Selecting a CIDR that is too small or overlaps future connectivity targets can force disruptive redesign.

Real-World Engineer Notes

Select VPC CIDRs with the full connectivity roadmap in mind: on-premises networks, other VPCs, transit connectivity, partner networks, and future acquisitions.
Avoid allocating the smallest possible range just to reduce apparent address waste. Expansion can be difficult if adjacent ranges are already assigned or if the VPC layout is constrained.
Use consistent subnetting conventions across environments and Regions. Predictable ranges make route analysis, incident response, and automation easier.
Separate the concepts of address allocation and reachability. An address may be valid within a subnet but still be unable to communicate because of route tables, security groups, network ACLs, or service policies.
Document both the CIDR block and its intended role. A range such as 10.20.0.0/16 is more useful when its ownership, environment, and connectivity assumptions are recorded.

Quick Reference Summary

IPv4 size: 32 bits.
Octets: Four groups of 8 bits.
Octet range: 0–255.
Subnet mask: Defines network and host portions.
CIDR: address/prefix-length, for example 10.0.0.0/16.
Private ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Private IP limitation: Not directly routable on the public internet.
AWS planning rule: Avoid overlapping CIDRs when networks must communicate.
NAT role: Enables translated outbound connectivity for private resources; it is not equivalent to assigning a public IP.

Flashcards

Q: How many bits are in an IPv4 address?

A: 32 bits, divided into four 8-bit octets.

Q: What is the maximum decimal value of one IPv4 octet?

A: 255.

Q: What does the network ID identify?

A: The network to which an IP address belongs.

Q: What does the host ID identify?

A: A specific device or resource within the network.

Q: What does /24 mean in CIDR notation?

A: The first 24 bits are the network prefix.

Q: What does a 255 octet in a subnet mask indicate?

A: All eight bits in that octet are part of the network portion.

Q: What are the three RFC 1918 private IPv4 ranges?

A: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Q: Can an RFC 1918 address be routed directly over the public internet?

A: No.

Q: Why is CIDR important in Amazon VPC?

A: VPCs and subnets use CIDR blocks to define their address ranges.

Q: What is the primary purpose of NAT for private resources?

A: To translate private source addresses so resources can initiate outbound connections through a public path.

Q: Why are overlapping CIDR ranges dangerous?

A: They make routing between the affected networks ambiguous or unsupported.

Q: Is the final IPv4 octet always the host ID?

A: No. The subnet prefix can end at any bit position, depending on the CIDR length.

Practice Questions

Question 1

A company is designing a VPC that must connect to its corporate network through hybrid connectivity. Which requirement should be prioritized when selecting the VPC CIDR block?

A. Use the largest possible RFC 1918 range regardless of corporate addressing
B. Select a CIDR block that does not overlap with the corporate network
C. Use a public IPv4 range to avoid route conflicts
D. Use 192.168.0.0/24 because it is the most common private range

Correct answer: B

Explanation: Connected networks need non-overlapping address spaces for routing to work reliably. The size and location of the VPC CIDR should be chosen with existing and planned network connectivity in mind.

Question 2

An application runs on instances with private IPv4 addresses in a private subnet. The instances must download software updates from the internet, but unsolicited inbound internet connections must not be permitted. Which design best matches this requirement?

A. Assign public IP addresses to all instances
B. Use a NAT gateway and appropriate routing for the private subnet
C. Use overlapping CIDR blocks to isolate the instances
D. Remove the subnet route table

Correct answer: B

Explanation: A NAT gateway can provide translated outbound connectivity for private resources without making those instances directly internet-addressable. Routes and security controls must still be configured correctly.

Question 3

Which statement accurately describes 172.20.0.0/16?

A. It is a public IPv4 range
B. It is part of the RFC 1918 private address space
C. It contains only 16 total addresses
D. It identifies a single host rather than a network

Correct answer: B

Explanation: 172.20.0.0/16 falls within 172.16.0.0/12, one of the three RFC 1918 private ranges. The /16 is a prefix length, not a statement that the network contains only 16 addresses.

Question 4

A network engineer sees the address 192.168.10.25/26. Which conclusion is correct?

A. The first 26 bits define the network prefix
B. The first 26 octets define the network prefix
C. The entire address is a network identifier
D. The final octet is always entirely the host identifier

Correct answer: A

Explanation: CIDR /26 means 26 of the 32 address bits are part of the network prefix. The boundary does not align with a complete octet, so the final octet is only partially part of the host portion.

Question 5

A solutions architect plans to peer two VPCs. Both VPCs currently use 10.0.0.0/16. What is the primary concern?

A. Private IP addresses cannot be used in VPCs
B. A /16 prefix is too small for VPC peering
C. The overlapping CIDRs prevent straightforward routing between the VPCs
D. VPC peering automatically converts both ranges to public addresses

Correct answer: C

Explanation: Overlapping CIDR blocks create ambiguity because the same destination addresses exist in both networks. VPCs that must communicate should use non-overlapping ranges.