What are the key components of an AWS VPC and their roles?
Region / Availability Zone — Physical AWS locations where VPC resources run.
VPC — Isolated virtual network.
Subnets (Public & Private) — Network segments within a VPC.
Public: Routed to the Internet Gateway
Private: No direct internet routing
Internet Gateway (IGW) — Enables internet access for public subnets.
NAT Gateway — Allows private subnets to reach the internet outbound only.
Route Tables — Control traffic routing for each subnet.
Security Groups — Stateful instance-level firewalls.
Network ACLs (NACLs) — Stateless subnet-level firewalls.
VPC Peering — Private connectivity between VPCs.
VPC Endpoints (S3, DynamoDB, etc.) — Private access to AWS services without IGW/NAT.
VPC Flow Logs — Capture network traffic metadata.
Site-to-Site VPN / Customer Gateway / Virtual Private Gateway — Connect on-prem networks to AWS.
Direct Connect (DX) — Dedicated private network link to AWS.
Transit Gateway — Central hub for connecting multiple VPCs and on-prem networks.
What is CIDR notation in IPv4, and how does it define an IP range?
CIDR (Classless Inter-Domain Routing) is a method of allocating and representing IP address ranges.
Format: Base IP + /Subnet Mask
Example: 192.168.0.0/26
The subnet mask determines how many IPs are included:
/32 → 1 IP
/31 → 2 IPs
/30 → 4 IPs
/29 → 8 IPs
/28 → 16 IPs
/27 → 32 IPs
/26 → 64 IPs, etc.
Used throughout AWS networking (Security Groups, VPCs, Subnets).
What does CIDR notation represent in IPv4, and how does the subnet mask determine the IP range?
CIDR = Classless Inter-Domain Routing
Format: Base IP + /Prefix (example: 192.168.0.0/26)
The /Prefix defines how many IPs are included:
/32 → 1 IP
/31 → 2 IPs
/30 → 4 IPs
/29 → 8 IPs
/28 → 16 IPs
/27 → 32 IPs
/26 → 64 IPs
CIDR is used to allocate and describe IP ranges in AWS networking (VPCs, subnets, SG rules).
What does the subnet mask do in CIDR, and how does it affect the number of IP addresses?
“The Subnet Mask basically allows part of the underlying IP to get additional next values from the base IP.”
This determines how many IPs belong to the range:
192.168.0.0/32 → 1 IP
192.168.0.0/31 → 2 IPs
192.168.0.0/30 → 4 IPs
192.168.0.0/29 → 8 IPs
192.168.0.0/28 → 16 IPs
192.168.0.0/27 → 32 IPs
Formula: Total IPs = 2^(32 − prefix)
What are the differences between public and private IPv4 addresses, and what ranges are reserved for private use?
IANA reserves specific IPv4 ranges for private (LAN) use:
10.0.0.0 – 10.255.255.255 (10.0.0.0/8)
172.16.0.0 – 172.31.255.255 (172.16.0.0/12)
192.168.0.0 – 192.168.255.255 (192.168.0.0/16)
All other IPv4 addresses are public, routable on the Internet.
Private IPs: internal-only, not globally unique.
Public IPs: internet-visible, must be globally unique.
What are the key characteristics of the AWS default VPC?
Every new AWS account automatically includes a default VPC.
EC2 instances launch into the default VPC if no subnet is specified.
The default VPC has internet connectivity by default.
All EC2 instances launched in it receive a public IPv4 address automatically.
Instances get both public and private DNS names.
What are the key IPv4 rules and limits for an AWS VPC?
A VPC = Virtual Private Cloud in AWS.
You can create multiple VPCs per region (default soft limit: 5).
Each VPC can have up to 5 CIDR blocks.
Allowed CIDR block sizes:
Minimum: /28 (16 IPs)
Maximum: /16 (65,536 IPs)
VPCs must use private IPv4 ranges only:
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
No overlapping CIDRs with your other networks.
What IP addresses does AWS reserve inside each IPv4 subnet, and how does this affect usable IP count?
AWS reserves 5 IP addresses in every subnet (first 4 + last 1), so they cannot be assigned to EC2 instances.
Example for subnet 10.0.0.0/24:
10.0.0.0 — Network address
10.0.0.1 — Reserved for VPC router
10.0.0.2 — Reserved for Amazon-provided DNS
10.0.0.3 — Reserved for future use
10.0.0.255 — Network broadcast address (AWS doesn’t support broadcast)
Exam Tip:
If you need 29 usable IPs, a /27 subnet won’t work (32 total − 5 reserved = 27 usable).
Choose /26 instead (64 total − 5 reserved = 59 usable).
What is an Internet Gateway (IGW) in AWS, and what does it enable for a VPC?
An IGW allows resources in a VPC (e.g., EC2 instances) to connect to the Internet.
It is horizontally scalable, highly available, and redundant.
It must be created separately from the VPC.
One VPC ↔ one IGW (a 1:1 attachment).
On its own, an IGW does NOT provide internet access —
route tables must be updated to send 0.0.0.0/0 traffic to the IGW.
What is a Bastion Host in AWS, and how is it used?
A Bastion Host is used to SSH into private EC2 instances.
It is placed in a public subnet, which is connected to all private subnets.
The Bastion Host security group must allow inbound SSH (port 22) from a restricted CIDR (e.g., your corporate public IP range).
Private EC2 instances must allow traffic from the Bastion Host’s security group or its private IP.
What is a NAT Instance in AWS, and how is it configured?
NAT = Network Address Translation
Allows private subnet EC2 instances to access the Internet.
Must be launched in a public subnet.
Must disable Source/Destination Check on the instance.
Must attach an Elastic IP (EIP).
Route tables must route outbound traffic from private subnets to the NAT Instance.
What are key considerations and limitations of using a NAT Instance in AWS?
A pre-configured Amazon Linux NAT AMI is available.
That AMI reached end of standard support on Dec 31, 2020.
NAT Instances are not highly available by default.
Requires ASG in multi-AZ + resilient user-data script.
Bandwidth depends on EC2 instance type.
You must manage Security Groups & rules manually:
Inbound: allow HTTP/HTTPS from private subnets; allow SSH from your home network (via IGW).
Outbound: allow HTTP/HTTPS to the Internet.
What is a NAT Gateway in AWS, and what are its key characteristics?
AWS-managed NAT service — no administration required.
Provides higher bandwidth and high availability within an AZ.
Billed per hour plus data processed.
Created in a specific Availability Zone and uses an Elastic IP.
Cannot be used by EC2 instances in the same subnet—only by instances in other subnets.
Requires an Internet Gateway (path: Private Subnet → NAT GW → IGW).
Supports 5 Gbps bandwidth with automatic scaling up to 100 Gbps.
No Security Groups to manage.
How do you achieve high availability with NAT Gateways in AWS?
A NAT Gateway is resilient within a single Availability Zone.
To achieve fault tolerance, you must create multiple NAT Gateways—one in each AZ.
No cross-AZ failover is needed; if an AZ fails, workloads in that AZ don’t use NAT from other AZs.
Each private subnet should route internet-bound traffic to the NAT Gateway in the same AZ.
How do NAT Gateways and NAT Instances differ in AWS?
NAT Gateway
Highly available within an AZ
Up to 100 Gbps bandwidth
Managed by AWS (no maintenance)
Cost: hourly + data processing
Uses an Elastic IP
No Security Groups required
Not usable by instances in the same subnet
NAT Instance
Requires scripts for multi-AZ failover
Bandwidth depends on EC2 instance type
You manage OS, patches, scaling
Cost depends on EC2 instance type + network charges
Must configure Security Groups
Can optionally be used as a Bastion Host
What is a Network ACL in AWS, and how does it control traffic?
A NACL acts as a firewall for subnets, controlling inbound and outbound traffic.
One NACL per subnet; new subnets get the default NACL.
You define numbered rules (1–32766); lower numbers = higher precedence.
First matching rule wins.
The final rule (*) denies all unmatched traffic.
New NACLs deny everything until rules are added.
Great for blocking specific IPs at the subnet level.
AWS recommends adding rules in increments of 100.
What are the characteristics and rules of the Default NACL in AWS?
Allows all inbound and outbound IPv4 traffic by default.
AWS recommends: Do NOT modify the Default NACL — create custom NACLs instead.
Inbound rules include:
Rule 100: Allow all IPv4 traffic
*Rule : Deny all
Outbound rules include:
Rule 100: Allow all IPv4 traffic
*Rule : Deny all
Automatically associated with new subnets unless you specify otherwise.
What are ephemeral ports, and why are they required for network connections?
For two endpoints to communicate, both must use ports.
A client connects to a server’s fixed port (e.g., 443) and receives the response on an ephemeral port.
Ephemeral port ranges vary by OS:
IANA & Windows 10: 49152–65535
Many Linux kernels: 32768–60999
Ephemeral ports must be explicitly allowed in NACLs because NACLs are stateless.
How do Security Groups differ from Network ACLs in AWS?
Security Groups (SGs)
Operate at the instance level
Stateful: return traffic is automatically allowed
Support allow rules only
All rules are evaluated before deciding
Apply only to instances explicitly attached to the SG
Network ACLs (NACLs)
Operate at the subnet level
Stateless: return traffic must be explicitly allowed
Support allow and deny rules
Rules evaluated in order, lowest number first; first match wins
Automatically apply to all instances in the associated subnet
What is VPC Peering in AWS, and what are its key properties?
Privately connects two VPCs using AWS’s internal network.
Makes VPCs communicate as if on the same network.
CIDR blocks must NOT overlap.
Not transitive — each pair of VPCs must have its own peering connection.
Route tables must be updated in each VPC’s subnets so EC2 instances can reach each other.
What important details should you remember about VPC Peering?
You can peer VPCs across different AWS accounts.
You can peer VPCs across different regions.
You can reference a security group in a peered VPC, as long as it is in the same region, even across accounts.
What are VPC Endpoints (AWS PrivateLink), and why are they used?
Allow you to privately connect your VPC to supported AWS services without using IGWs, NAT, VPN, or Direct Connect.
Traffic never leaves the Amazon network.
Two types:
Interface Endpoints → Elastic Network Interfaces (ENIs) in subnets
Gateway Endpoints → For S3 and DynamoDB only
Provide secure, scalable, private connectivity.
What are the two types of VPC Endpoints in AWS, and how do they differ?
Interface Endpoints (PrivateLink-powered)
Create an ENI with a private IP as the entry point
Require a Security Group
Support most AWS services
Cost: hourly + per-GB data processing
Gateway Endpoints
Create a gateway used as a route table target
Do NOT use Security Groups
Support S3 and DynamoDB only
Cost: free
When should you use a Gateway Endpoint vs. an Interface Endpoint for Amazon S3?
Gateway Endpoint (preferred for exam)
Default recommended option
Free
Use it for almost all in-VPC access to S3
Interface Endpoint
Costs money (hourly + per GB)
Preferred when S3 access is required from:
On-premises networks (VPN or Direct Connect)
Another VPC
Another AWS Region
