Networking & Content Delivery
Difficulty: medium
Overview
AWS networking services provide isolation, connectivity, traffic management, and content delivery for cloud workloads.
Amazon VPC (Virtual Private Cloud):
- Logically isolated virtual network in AWS. You define IP address ranges, subnets, route tables, and gateways.
- Public Subnet — Has a route to an Internet Gateway; resources can be accessed from the internet.
- Private Subnet — No direct internet access; uses NAT Gateway for outbound traffic.
- Internet Gateway (IGW) — Enables bidirectional internet access for resources with public IPs.
- NAT Gateway — Allows private subnet resources to initiate outbound internet traffic; blocks inbound.
- Security Groups — Stateful virtual firewall at the instance/ENI level; ALLOW rules only; return traffic auto-permitted.
- Network ACLs (NACLs) — Stateless firewall at the subnet level; support ALLOW and DENY rules; evaluated in order.
- VPC Peering — Private networking between two VPCs (same or different accounts/regions).
- VPC Endpoints — Private connection to AWS services without internet gateway or NAT.
DNS & Routing:
- Amazon Route 53 — Managed DNS service; supports routing policies: Simple, Weighted, Latency-based, Failover, Geolocation, Geoproximity.
- Amazon CloudFront — Global CDN; caches content at 400+ edge locations; reduces latency; integrates with WAF and Shield.
Connectivity:
- AWS Site-to-Site VPN — Encrypted IPSec tunnel over the public internet between on-premises and AWS VPC.
- AWS Direct Connect — Dedicated private fiber connection from your data center to AWS; bypasses internet; consistent performance.
- AWS Global Accelerator — Routes traffic through AWS's private backbone; improves availability and performance; provides static IPs.
API Management:
- Amazon API Gateway — Managed service to create, publish, and secure REST, HTTP, and WebSocket APIs.
Practice Linked Questions
Q1. What does Amazon VPC (Virtual Private Cloud) provide?
Select one answer before revealing.
Q2. Which VPC component acts as a stateful virtual firewall at the EC2 instance level, controlling inbound and outbound traffic with ALLOW rules only?
Select one answer before revealing.
Q3. What is the key difference between a Security Group and a Network ACL (NACL) in a VPC?
Select one answer before revealing.
Q4. Resources in a private subnet need to download software updates from the internet but should NOT be directly reachable from the internet. Which VPC component enables this?
Select one answer before revealing.
Q5. Which AWS service is a fully managed, global DNS service that also supports routing policies like latency-based routing, failover routing, and geolocation routing?
Select one answer before revealing.
Q6. A company wants a dedicated, private, high-bandwidth connection between their corporate data center and AWS that bypasses the public internet for consistent network performance. Which service should they use?
Select one answer before revealing.
Q7. Which TWO services can establish network connectivity between an on-premises data center and an Amazon VPC? (Select TWO — more than one answer may be correct)
Select one answer before revealing.