VPC Fundamentals

Every other topic in this domain assumes the VPC underneath it is built correctly. This topic builds it. You will plan an address range you cannot resize later, carve it into subnets that each live in one Availability Zone, point route tables at the right gateway, and put the 2 firewalls in front of the result. These are the pieces skill 5.1.1 names directly, and the pieces skill 5.3.1 asks you to troubleshoot when a connection fails.

What This Topic Covers

• VPC CIDR planning: the allowed block sizes, the ranges AWS refuses, the secondary CIDR restrictions, and why the first choice is close to permanent
• Subnets and Availability Zones, including the 5 addresses AWS reserves in every subnet and the capacity errors that follow from ignoring them
• Route tables: main versus custom, implicit versus explicit association, the local route, and longest prefix match against the static-versus-propagated priority ladder
• Internet gateways: the one-to-one NAT they perform for IPv4 and the public address requirement that comes with it
• NAT gateways: public against private connectivity, the zonal availability trap, the 55,000 connections per destination ceiling, the 350-second idle timeout, and regional NAT gateways
• Egress-only internet gateways, and why IPv6 needs a different device rather than a NAT gateway
• Security groups: allow-only rules, stateful return traffic, group referencing, and connection tracking
• Network ACLs: numbered rules evaluated to first match, stateless return traffic, and the ephemeral port ranges that decide whether replies get home

Why It Matters

Most VPC incidents are not exotic. A subnet ran out of addresses during a scaling event, a route table sends traffic to the wrong gateway, a NAT gateway in one Availability Zone became a single point of failure, or a network ACL allows a request in and never lets the answer out. Each of those has a fixed diagnostic path, and this topic gives you the path along with the mechanism behind it.

The exam concentrates on the boundaries between things that look interchangeable. Internet gateway against NAT gateway against egress-only internet gateway. Public NAT gateway against private. Security group against network ACL. In every case one constraint in the scenario, the direction of the connection, the IP version, or the need to deny rather than allow, separates them. Learn to spot that constraint and this domain's questions become short.