[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"prev-aws-certified-cloud-practitioner-cloud-technology-and-services-networking-services-vpc-security-en":4,"lesson-aws-certified-cloud-practitioner-cloud-technology-and-services-networking-services-vpc-security-en":323,"next-aws-certified-cloud-practitioner-cloud-technology-and-services-networking-services-vpc-security-en":334},null,{"locked":5,"reason":3,"meta":6,"item":17},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"Amazon VPC Fundamentals","Understand what an Amazon VPC is and how its building blocks fit together: subnets, IP addressing, route tables, internet gateways, and NAT gateways.",true,16,"beginner",[13,14,15,16],"Define what an Amazon VPC is and how it isolates your AWS resources","Explain the role of CIDR blocks and subnets, including the difference between public and private subnets","Describe how route tables, internet gateways, and NAT gateways direct traffic","Identify what the default VPC provides",{"id":18,"title":7,"body":19,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":251,"infographics":252,"isFree":9,"learningObjectives":265,"meta":266,"navigation":9,"path":267,"quiz":268,"seo":320,"stem":321,"__hash__":322},"courses/courses/aws-certified-cloud-practitioner/en/domains/03-cloud-technology-and-services/06-networking-services/01-amazon-vpc-fundamentals.md",{"type":20,"value":21,"toc":238},"minimark",[22,27,31,34,38,41,44,49,53,56,59,62,80,83,87,103,114,117,121,124,131,135,138,145,151,204,208,211,214,218],[23,24,26],"h2",{"id":25},"why-this-matters","Why this matters",[28,29,30],"p",{},"Almost every AWS service you run on servers lives inside a network. Amazon Virtual Private Cloud (Amazon VPC) is that network. It is where your EC2 instances, databases, and load balancers get their private addresses and where you decide what can talk to what.",[28,32,33],{},"On the CLF-C02 exam you do not configure a VPC by hand. You need to recognize the building blocks, know what each one does, and tell a public subnet from a private one. This lesson builds that mental model so the security and connectivity lessons that follow make sense.",[23,35,37],{"id":36},"what-a-vpc-is","What a VPC is",[28,39,40],{},"A VPC is a logically isolated virtual network that you define in the AWS Cloud. It looks and behaves like a traditional network in your own data center, but it runs on AWS infrastructure that you can scale on demand.",[28,42,43],{},"\"Isolated\" is the key word. Your VPC is private to your account. Other AWS customers cannot see into it, and nothing reaches your resources unless you set up a path and allow it. A VPC lives in one AWS Region and can stretch across all the Availability Zones in that Region.",[45,46],"infographic",{"alt":47,"slug":48},"A VPC spanning two Availability Zones, with a public subnet routed to an internet gateway and a private subnet whose outbound traffic flows through a NAT gateway in the public subnet.","vpc-anatomy",[23,50,52],{"id":51},"subnets-and-availability-zones","Subnets and Availability Zones",[28,54,55],{},"A subnet is a range of IP addresses inside your VPC. You launch resources, such as EC2 instances, into subnets. Each subnet sits in exactly one Availability Zone, so a single subnet never spans two zones.",[28,57,58],{},"Because a VPC covers a whole Region, you usually create subnets in several Availability Zones and spread your resources across them. If one zone has a problem, the resources in the other zones keep running. This is the foundation of high availability on AWS.",[28,60,61],{},"Subnets come in two flavors based on how their traffic is routed:",[63,64,65,74],"ul",{},[66,67,68,69,73],"li",{},"A ",[70,71,72],"strong",{},"public subnet"," can reach the internet directly. Its route table sends internet-bound traffic to an internet gateway, and resources in it can have public IP addresses. Web servers and load balancers usually live here.",[66,75,68,76,79],{},[70,77,78],{},"private subnet"," has no direct route to the internet. Databases and application servers usually live here, protected from direct exposure.",[28,81,82],{},"Nothing about the subnet's name, size, or zone makes it public or private. The routing does.",[23,84,86],{"id":85},"ip-addressing-and-cidr","IP addressing and CIDR",[28,88,89,90,94,95,98,99,102],{},"When you create a VPC, you give it a range of IP addresses written in CIDR notation, such as ",[91,92,93],"code",{},"10.0.0.0/16",". CIDR is just a compact way to describe a block of addresses. A smaller number after the slash means a bigger block: a ",[91,96,97],{},"/16"," holds far more addresses than a ",[91,100,101],{},"/24",".",[28,104,105,106,109,110,113],{},"Each subnet takes a slice of the VPC's range, for example ",[91,107,108],{},"10.0.1.0/24"," for one subnet and ",[91,111,112],{},"10.0.2.0/24"," for another. Most resources use private IPv4 addresses that are not reachable from the internet. A resource needs a public IPv4 address (or an IPv6 address) only when it must be reached directly over the internet.",[28,115,116],{},"When you connect a VPC to your own network later, the address ranges must not overlap. That is why teams plan their CIDR blocks carefully before they build.",[23,118,120],{"id":119},"route-tables","Route tables",[28,122,123],{},"A route table is a set of rules, called routes, that decide where traffic goes. Each route pairs a destination (a CIDR block) with a target (where to send traffic for that destination).",[28,125,126,127,130],{},"Every subnet is associated with a route table. A route for the subnet's own VPC range is always present, so resources inside the VPC can talk to each other by default. To reach anything outside the VPC, you add a route that points at a gateway. For example, a route that sends ",[91,128,129],{},"0.0.0.0/0"," (all other traffic) to an internet gateway is what makes a subnet public.",[23,132,134],{"id":133},"internet-gateway-and-nat-gateway","Internet gateway and NAT gateway",[28,136,137],{},"These two components both deal with internet traffic, but they are not the same, and the exam likes to test the difference.",[28,139,140,141,144],{},"An ",[70,142,143],{},"internet gateway"," connects your VPC to the internet. It allows resources in a public subnet that have a public IP address to send and receive internet traffic in both directions. You attach one internet gateway to a VPC.",[28,146,68,147,150],{},[70,148,149],{},"NAT gateway"," lets instances in a private subnet start outbound connections to the internet, for example to download patches, while stopping the internet from starting connections back to them. You place a NAT gateway in a public subnet and point the private subnet's route table at it. Unlike the VPC and internet gateway, a NAT gateway has an hourly charge plus a data processing charge.",[152,153,154,173],"table",{},[155,156,157],"thead",{},[158,159,160,164,167,170],"tr",{},[161,162,163],"th",{},"Component",[161,165,166],{},"Direction",[161,168,169],{},"Where it sits",[161,171,172],{},"Typical use",[174,175,176,191],"tbody",{},[158,177,178,182,185,188],{},[179,180,181],"td",{},"Internet gateway",[179,183,184],{},"Inbound and outbound",[179,186,187],{},"Attached to the VPC",[179,189,190],{},"Public subnets reach the internet both ways",[158,192,193,195,198,201],{},[179,194,149],{},[179,196,197],{},"Outbound only",[179,199,200],{},"In a public subnet",[179,202,203],{},"Private subnets reach the internet for updates, stay unreachable from it",[23,205,207],{"id":206},"the-default-vpc","The default VPC",[28,209,210],{},"Every AWS account comes with a default VPC in each Region, already set up with subnets, a route table, and an internet gateway. This is why you can launch an EC2 instance and reach it without building a network first.",[28,212,213],{},"The default VPC is convenient for learning and quick tests. For real workloads, teams usually create their own VPCs so they control the address ranges, subnet layout, and routing from the start.",[23,215,217],{"id":216},"exam-tips","Exam tips",[63,219,220,223,226,229,232,235],{},[66,221,222],{},"A VPC is a logically isolated virtual network in one Region; it can span all the Availability Zones in that Region.",[66,224,225],{},"A subnet lives in one Availability Zone. Spread subnets across zones for high availability.",[66,227,228],{},"Public versus private is decided by routing: a route to an internet gateway makes a subnet public.",[66,230,231],{},"Internet gateway = two-way internet access for public subnets. NAT gateway = outbound-only internet access for private subnets.",[66,233,234],{},"There is no charge for the VPC itself, but a NAT gateway costs money per hour and per gigabyte processed.",[66,236,237],{},"Plan non-overlapping CIDR ranges, especially before you connect a VPC to another network.",{"title":239,"searchDepth":240,"depth":240,"links":241},"",3,[242,244,245,246,247,248,249,250],{"id":25,"depth":243,"text":26},2,{"id":36,"depth":243,"text":37},{"id":51,"depth":243,"text":52},{"id":85,"depth":243,"text":86},{"id":119,"depth":243,"text":120},{"id":133,"depth":243,"text":134},{"id":206,"depth":243,"text":207},{"id":216,"depth":243,"text":217},"md",[253],{"slug":48,"concept":254,"style":255,"aspectRatio":256,"labels":257},"A containment diagram of one VPC in a Region, with subnets nested inside Availability Zones inside the VPC boundary and each subnet living in exactly one AZ. The public subnet holds the NAT gateway and routes to an internet gateway at the VPC edge for two-way traffic; the private subnet has no direct internet route and sends outbound-only traffic through that NAT gateway. The orange accent follows the route from the public subnet to the internet gateway, the single route that makes a subnet public. Takeaway: the route table, not the name, decides whether a subnet is public or private.","diagram","16:9",[258,259,260,261,262,263,264],"VPC: isolated network in one Region","Public subnet: route to internet gateway","Private subnet: no direct internet route","Internet gateway: two-way internet access","NAT gateway: outbound only, sits public","Route table decides public or private","Each subnet lives in one AZ",[13,14,15,16],{},"/courses/aws-certified-cloud-practitioner/en/domains/03-cloud-technology-and-services/06-networking-services/01-amazon-vpc-fundamentals",{"passingScore":269,"questions":270},70,[271,280,288,296,306,314],{"question":272,"type":273,"options":274,"correctAnswer":275,"explanation":279},"What is an Amazon VPC?","single",[275,276,277,278],"A logically isolated virtual network in the AWS Cloud that you define and control","A physical data center that AWS rents to a single customer","A managed firewall service that filters web requests","A global content delivery network for static files","A VPC is a virtual network that you define inside AWS, isolated from other customers. It resembles a traditional on-premises network but runs on AWS infrastructure. It is not a physical data center, a firewall, or a CDN.",{"question":281,"type":273,"options":282,"correctAnswer":284,"explanation":287},"What makes a subnet a 'public' subnet?",[283,284,285,286],"It is created in the first Availability Zone of the Region","Its route table has a route to an internet gateway","It uses IPv6 addresses instead of IPv4","It has more than 256 IP addresses","A subnet is public when its associated route table sends internet-bound traffic to an internet gateway. The Availability Zone, IP version, and size of the subnet do not determine whether it is public or private.",{"question":289,"type":273,"options":290,"correctAnswer":294,"explanation":295},"A team has EC2 instances in a private subnet that need to download software updates from the internet, but those instances must never be reachable from the internet. Which component solves this?",[291,292,293,294],"An internet gateway attached directly to the private subnet","A second VPC","A larger CIDR block","A NAT gateway in a public subnet","A NAT gateway lets instances in a private subnet start outbound connections to the internet while blocking inbound connections from the internet. It sits in a public subnet and uses an Elastic IP. Attaching an internet gateway to the subnet would make it public, defeating the goal.",{"question":297,"type":298,"options":299,"correctAnswers":304,"explanation":305},"Which statements about subnets and Availability Zones are correct? (Select all that apply.)","multiple",[300,301,302,303],"A subnet must reside in a single Availability Zone","A subnet can span multiple Availability Zones for high availability","Spreading subnets across Availability Zones helps you build for high availability","A VPC can have subnets in several Availability Zones in the same Region",[300,302,303],"Each subnet lives in exactly one Availability Zone, so a subnet cannot span zones. A VPC spans a whole Region, so you place subnets in multiple zones and spread resources across them for high availability.",{"question":307,"type":273,"options":308,"correctAnswer":311,"explanation":313},"What is the job of a route table in a VPC?",[309,310,311,312],"It stores backups of your data","It encrypts traffic between instances","It decides where network traffic from a subnet or gateway is directed","It assigns public IP addresses to instances","A route table holds rules (routes) that send traffic toward a destination, such as an internet gateway, NAT gateway, or peering connection. It does not back up data, encrypt traffic, or assign IP addresses.",{"question":315,"type":273,"options":316,"correctAnswer":318,"explanation":319},"There is an additional charge just for creating a VPC.",[317,318],"True","False","There is no charge for the VPC itself. You pay for some components you add, such as NAT gateways and traffic that flows through them, but creating the VPC, subnets, route tables, and an internet gateway carries no direct fee.",{"title":7,"description":8},"courses/aws-certified-cloud-practitioner/en/domains/03-cloud-technology-and-services/06-networking-services/01-amazon-vpc-fundamentals","63sGJxcJ8bYapIwbS5mLP9VRWVW-s4qV-QusbaPcFAk",{"locked":9,"reason":324,"meta":325,"item":3},"paywall",{"title":326,"description":327,"isFree":5,"estimatedMinutes":328,"difficulty":11,"learningObjectives":329},"VPC Security: Security Groups and Network ACLs","Learn the two firewalls built into every VPC: security groups at the instance level and network ACLs at the subnet level, and how stateful and stateless filtering differ.",14,[330,331,332,333],"Explain how a security group controls traffic at the instance level and why it is stateful","Describe how a network ACL controls traffic at the subnet level and why it is stateless","Compare security groups and network ACLs across their key differences","Identify how the two work together as layered defense",{"locked":9,"reason":324,"meta":335,"item":3},{"title":336,"description":337,"isFree":5,"estimatedMinutes":10,"difficulty":11,"learningObjectives":338},"Amazon Route 53 and DNS","Understand how DNS turns a domain name into an IP address, what Amazon Route 53 does, its main routing policies, and how health checks support failover.",[339,340,341,342],"Explain what DNS does and how a domain name resolves to an IP address","Describe the three main functions of Amazon Route 53","Compare the main Route 53 routing policies and when to use each","Explain how health checks support DNS failover"]