What's changed: Deepened SOA-C02 Chapter 5 to Associate depth (tables, scenarios, FAQ, traps; localized figures)
5.1Operating VPC Networking
Understand operating a VPC: public/private subnets, IGW and NAT gateway, security groups vs. NACLs, VPC endpoints, and troubleshooting with VPC flow logs. The starting point for "Networking and Content Delivery" in SOA-C02.
Network connectivity issues are common in operations. Correctly understanding VPC subnets, routing, and security groups vs. NACLs is key to isolating them.
5.1.1Connectivity and controls
- IGW: internet access for public subnets. NAT gateway: outbound-only for private subnets.
- Security group: instance (ENI)/stateful/allow-only. NACL: subnet/stateless/allow+deny.
- VPC endpoint: private connectivity to AWS services (e.g., S3) without the internet.
- VPC flow logs: record accepted/rejected traffic for isolating connectivity issues.
Common on SOA: isolate a connectivity failure = check SG/NACL/route table/flow logs, NACL is stateless so return traffic needs explicit allow, private access to AWS services = VPC endpoint.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.