What's changed: In-scope coverage: added other-category overview (API Gateway/Global Accelerator/PrivateLink/Transit Gateway/Client VPN/EventBridge/SNS/SQS/Step Functions/SES/Amplify/AppSync/IoT Core/WorkSpaces/AppStream/DocumentDB/SageMaker AI/CLI/CodeBuild/CodePipeline/X-Ray) and migration & transfer (Migration Hub/Discovery/Evaluator/MGN/DMS/SCT/Snow Family) to §4.3
4.1Networking Services
Understand AWS networking basics: the VPC and subnets, security groups, Route 53 (DNS), and CloudFront (content delivery).
AWS resources need to connect securely—to each other and the outside. The foundation is the VPC (Virtual Private Cloud), your own private network inside AWS. You divide a VPC with subnets, control traffic with security groups, and connect to on-premises as needed. We also cover Route 53 (DNS) and CloudFront (content delivery).
4.1.1VPC, subnets, and firewalls
- VPC: a private network inside AWS with an address range, where you place resources securely.
- Subnets: divide a VPC into public (internet-facing via an internet gateway, e.g., web) and private (no direct internet, e.g., databases).
- Security groups: instance-level virtual firewalls—stateful (return traffic auto-allowed), allow rules only.
- Network ACLs (NACLs): subnet-level firewalls—stateless, supporting both allow and deny rules.
| Aspect | Security group | Network ACL |
|---|---|---|
| Scope | Per instance (ENI) | Per subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow and deny |
4.1.2Connecting to on-premises
Know how to link a VPC to your on-premises network: AWS Site-to-Site VPN connects over the internet (encrypted), while AWS Direct Connect is a dedicated line that avoids the internet for consistent low latency and high bandwidth (analogous to VPN Gateway / ExpressRoute in other clouds).
4.1.3DNS and content delivery
- Amazon Route 53: DNS (name resolution) and domain registration, with health checks and routing policies.
- Amazon CloudFront: a CDN that caches at edge locations for low-latency delivery, also offloading origin load and adding front-line security.
Scenario: a three-tier web app. Put web servers in a public subnet and the DB in a private subnet, with a security group so the DB is reachable only from the web tier. Resolve the domain via Route 53 and deliver static content globally with CloudFront, connecting to the on-prem system via Direct Connect. Each tier gets its own exposure.
Watch the mix-ups: (1) security group (per instance, stateful, allow-only) vs NACL (per subnet, stateless, allow/deny). (2) Route 53 = DNS vs CloudFront = CDN—different roles. (3) Site-to-Site VPN (over the internet) vs Direct Connect (dedicated line).
Common points: VPC = private network in AWS / subnets = public vs private / security group = instance-level firewall / NACL = subnet-level / Route 53 = DNS / CloudFront = CDN / Direct Connect = dedicated line.
4.1.4Section summary
- Divide a VPC into public/private subnets; control traffic with security groups/NACLs
- On-prem: Site-to-Site VPN (internet) / Direct Connect (dedicated line)
- Route 53 = DNS, CloudFront = CDN (edge cache delivery)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which is the private network in AWS where you place resources?
Q2. Which AWS service provides DNS (resolving domain names to IPs)?
Q3. Which CDN caches content at edge locations for low-latency delivery?
Q4. Which virtual firewall is per-instance, stateful, and allow-rules-only?
Q5. Which connects on-premises to AWS via a dedicated line that avoids the internet?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.