[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"lesson-aws-certified-cloudops-engineer-associate-networking-content-delivery-vpc-fundamentals-vpc-subnets-and-route-tables-en":4,"prev-aws-certified-cloudops-engineer-associate-networking-content-delivery-vpc-fundamentals-vpc-subnets-and-route-tables-en":892,"next-aws-certified-cloudops-engineer-associate-networking-content-delivery-vpc-fundamentals-vpc-subnets-and-route-tables-en":905},null,{"locked":5,"reason":3,"meta":6,"item":19},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"VPC, Subnets, and Route Tables","A VPC is an address range plus a router, and almost every networking incident traces back to one of those two. This lesson covers CIDR planning that you cannot undo, why a subnet gives you fewer addresses than the math suggests, and how route tables decide where every packet goes.",true,26,"beginner",[13,14,15,16,17,18],"Explain how a VPC CIDR block, subnets, and Availability Zones fit together, and which of those choices you cannot reverse later","Calculate the usable IP addresses in a subnet by accounting for the 5 addresses AWS reserves","Identify what makes a subnet public or private, and why it is never a subnet setting","Distinguish the main route table from a custom route table and predict which one an unassociated subnet uses","Apply longest prefix match and the static-versus-propagated rules to resolve overlapping routes","Size subnets for a multi-AZ workload without exhausting the VPC CIDR",{"id":20,"title":7,"body":21,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":795,"infographics":796,"isFree":9,"learningObjectives":810,"meta":811,"navigation":9,"path":812,"quiz":813,"seo":889,"stem":890,"__hash__":891},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/01-vpc-fundamentals/01-vpc-subnets-and-route-tables.md",{"type":22,"value":23,"toc":785},"minimark",[24,37,40,45,48,59,109,132,135,139,142,156,162,187,194,213,217,220,239,242,288,295,299,306,370,375,378,446,449,455,458,462,465,475,482,485,555,561,565,572,583,589,596,599,603,610,613,657,684,691,707,710,720,731,735,778,781],[25,26,27,28,32,33,36],"p",{},"At 03:00 an Auto Scaling group stops launching. The event log says ",[29,30,31],"code",{},"There are not enough free addresses in subnet subnet-0a1b2c3d to satisfy the requested number of instances",". The subnet is ",[29,34,35],{},"10.0.4.0/27",", the team sized it for 32 instances, and only 27 ever launched. Nothing is broken. The subnet did exactly what AWS documents it will do, and nobody read that part before picking the mask.",[25,38,39],{},"Address planning is the part of VPC design you cannot walk back. You can add a security group rule in 10 seconds and delete it in 10 more. You cannot resize a CIDR block at all. So this lesson starts with the address math, then moves to the route table, which is the other half of every VPC and the first place to look when traffic goes somewhere unexpected.",[41,42,44],"h2",{"id":43},"a-vpc-is-an-address-range-plus-a-router","A VPC is an address range plus a router",[25,46,47],{},"Strip away the console and a VPC is 2 things: a block of IP addresses you claimed, and an implicit router that AWS runs for you inside that block. Everything else in this domain, subnets, gateways, endpoints, peering, is a way of telling that router where to send packets it does not already know about.",[25,49,50,51,54,55,58],{},"When you create a VPC you must give it an IPv4 CIDR block, and the allowed size runs from a ",[29,52,53],{},"/16"," (65,536 addresses) down to a ",[29,56,57],{},"/28"," (16 addresses). AWS recommends a block from the private ranges in RFC 1918:",[60,61,62,75],"table",{},[63,64,65],"thead",{},[66,67,68,72],"tr",{},[69,70,71],"th",{},"RFC 1918 range",[69,73,74],{},"Example VPC CIDR",[76,77,78,89,99],"tbody",{},[66,79,80,84],{},[81,82,83],"td",{},"10.0.0.0 to 10.255.255.255",[81,85,86],{},[29,87,88],{},"10.0.0.0/16",[66,90,91,94],{},[81,92,93],{},"172.16.0.0 to 172.31.255.255",[81,95,96],{},[29,97,98],{},"172.31.0.0/16",[66,100,101,104],{},[81,102,103],{},"192.168.0.0 to 192.168.255.255",[81,105,106],{},[29,107,108],{},"192.168.0.0/20",[25,110,111,112,115,116,119,120,123,124,127,128,131],{},"Four blocks are refused outright: ",[29,113,114],{},"0.0.0.0/8",", ",[29,117,118],{},"127.0.0.0/8"," (loopback), ",[29,121,122],{},"169.254.0.0/16"," (link-local), and ",[29,125,126],{},"224.0.0.0/4"," (multicast). One more is allowed but should be avoided: several AWS services, including AWS Cloud9 and SageMaker AI, use ",[29,129,130],{},"172.17.0.0/16"," internally, and picking it invites conflicts inside those environments that are painful to diagnose.",[25,133,134],{},"You can also run a VPC on publicly routable addresses that you own. AWS still refuses to route from your VPC CIDR straight to the internet, and it never advertises a subnet range to the internet, so you always go through a gateway regardless.",[41,136,138],{"id":137},"the-cidr-decisions-you-cannot-undo","The CIDR decisions you cannot undo",[25,140,141],{},"Three rules make the first CIDR choice expensive to get wrong.",[25,143,144,148,149,151,152,155],{},[145,146,147],"strong",{},"You cannot resize a CIDR block."," Not up, not down. If ",[29,150,88],{}," runs out, you do not turn it into a ",[29,153,154],{},"/15",".",[25,157,158,161],{},[145,159,160],{},"You cannot remove the primary CIDR."," You can associate secondary IPv4 blocks (5 per VPC by default, adjustable up to 50) and disassociate those later. The block you created the VPC with stays for the life of the VPC.",[25,163,164,167,168,171,172,175,176,179,180,183,184,186],{},[145,165,166],{},"Secondary blocks are restricted by the range the primary sits in."," If any CIDR on the VPC comes from ",[29,169,170],{},"10.0.0.0/8",", AWS refuses to add a block from ",[29,173,174],{},"172.16.0.0/12"," or ",[29,177,178],{},"192.168.0.0/16",". The same exclusion applies in each direction. AWS applies these restrictions because cross-VPC and cross-account features on the AWS side need non-conflicting blocks. Two more traps sit in the same rule set: if any associated block falls in ",[29,181,182],{},"10.0.0.0/15",", you cannot add one from ",[29,185,88],{},", and a new secondary block must not be the same size as or larger than any destination CIDR already sitting in one of your route tables.",[25,188,189,190,193],{},"Adding a secondary CIDR does one thing automatically: a new ",[29,191,192],{},"local"," route appears in every route table for that VPC, with the new block as the destination.",[25,195,196,197,200,201,204,205,208,209,212],{},"For IPv6 the shape is different. You request a block from Amazon's pool and you do not choose the range; a typical allocation looks like ",[29,198,199],{},"2001:db8:1234:1a00::/56",". You can associate up to 5 IPv6 blocks per VPC, from ",[29,202,203],{},"/44"," to ",[29,206,207],{},"/60"," in increments of ",[29,210,211],{},"/4",". Every Amazon-provided IPv6 address is globally unique and therefore public by default, which becomes the whole story in the next lesson.",[41,214,216],{"id":215},"a-subnet-lives-in-exactly-one-availability-zone","A subnet lives in exactly one Availability Zone",[25,218,219],{},"A subnet is a slice of the VPC range, and it resides entirely within one Availability Zone. It cannot span zones. That single sentence sets the shape of every VPC you will ever build: to run a 2-tier workload across 3 zones you need 6 subnets, not 2.",[25,221,222,223,204,225,227,228,204,230,208,233,235,236,238],{},"Subnet IPv4 blocks run from ",[29,224,57],{},[29,226,53],{},", they must sit inside the VPC block, and they cannot overlap each other. The default quota is 200 subnets per VPC. For IPv6, subnet netmask lengths run from ",[29,229,203],{},[29,231,232],{},"/64",[29,234,211],{},", and a ",[29,237,232],{}," is the conventional choice.",[25,240,241],{},"The subnet types you will see named in exam questions are defined purely by routing, not by a setting:",[60,243,244,254],{},[63,245,246],{},[66,247,248,251],{},[69,249,250],{},"Subnet type",[69,252,253],{},"What its route table has",[76,255,256,264,272,280],{},[66,257,258,261],{},[81,259,260],{},"Public",[81,262,263],{},"A route to an internet gateway",[66,265,266,269],{},[81,267,268],{},"Private",[81,270,271],{},"No route to an internet gateway (usually a route to a NAT device instead)",[66,273,274,277],{},[81,275,276],{},"VPN-only",[81,278,279],{},"A route to a Site-to-Site VPN connection through a virtual private gateway, and no internet gateway route",[66,281,282,285],{},[81,283,284],{},"Isolated",[81,286,287],{},"No routes to anything outside the VPC",[25,289,290,291,294],{},"One real subnet setting does exist and is worth knowing because it is often confused with the public/private distinction: ",[145,292,293],{},"auto-assign IP settings",", which decides whether a network interface created in that subnet automatically receives a public IPv4 address, and an IPv6 address if applicable. You can override it per instance at launch. It controls whether the instance has a public address, not whether traffic can reach the internet. Both are required, and they are configured in 2 different places.",[41,296,298],{"id":297},"where-5-addresses-go-in-every-subnet","Where 5 addresses go in every subnet",[25,300,301,302,305],{},"Back to the 03:00 page. In a subnet with CIDR ",[29,303,304],{},"10.0.1.0/28",", AWS reserves the first 4 addresses and the last 1:",[60,307,308,318],{},[63,309,310],{},[66,311,312,315],{},[69,313,314],{},"Address",[69,316,317],{},"Reserved for",[76,319,320,330,340,350,360],{},[66,321,322,327],{},[81,323,324],{},[29,325,326],{},"10.0.1.0",[81,328,329],{},"Network address",[66,331,332,337],{},[81,333,334],{},[29,335,336],{},"10.0.1.1",[81,338,339],{},"The VPC router",[66,341,342,347],{},[81,343,344],{},[29,345,346],{},"10.0.1.2",[81,348,349],{},"The Amazon DNS server",[66,351,352,357],{},[81,353,354],{},[29,355,356],{},"10.0.1.3",[81,358,359],{},"Future use by AWS",[66,361,362,367],{},[81,363,364],{},[29,365,366],{},"10.0.1.15",[81,368,369],{},"Network broadcast address (broadcast is not supported in a VPC)",[371,372],"infographic",{"alt":373,"slug":374},"The 16 addresses of subnet 10.0.1.0/28 laid out in order, with the first 4 and the last 1 marked as reserved by AWS and the 11 in between marked as usable.","subnet-reserved-addresses",[25,376,377],{},"Sixteen addresses in, 11 out. The overhead is a flat 5 at every size, so it hurts small subnets badly and large ones barely at all:",[60,379,380,393],{},[63,381,382],{},[66,383,384,387,390],{},[69,385,386],{},"Subnet CIDR",[69,388,389],{},"Total addresses",[69,391,392],{},"Usable",[76,394,395,407,420,433],{},[66,396,397,401,404],{},[81,398,399],{},[29,400,57],{},[81,402,403],{},"16",[81,405,406],{},"11",[66,408,409,414,417],{},[81,410,411],{},[29,412,413],{},"/27",[81,415,416],{},"32",[81,418,419],{},"27",[66,421,422,427,430],{},[81,423,424],{},[29,425,426],{},"/24",[81,428,429],{},"256",[81,431,432],{},"251",[66,434,435,440,443],{},[81,436,437],{},[29,438,439],{},"/20",[81,441,442],{},"4,096",[81,444,445],{},"4,091",[25,447,448],{},"This is where the predictable misconception lives. On premises you learn that a subnet loses 2 addresses, the network address and the broadcast address, and that rule is correct nearly everywhere except AWS. AWS takes 3 more. If you size a subnet by subtracting 2, you will be short by 3 exactly when it matters, during a scaling event.",[25,450,451,452,454],{},"A note on ",[29,453,346],{},". The Route 53 Resolver that your instances actually query lives at the base of the VPC range plus 2, and for a VPC with several CIDR blocks it sits in the primary block. AWS still reserves base-plus-2 in every subnet of every block, which is why the address is unavailable in each subnet even though only one of them hosts the resolver.",[25,456,457],{},"Two more consumers of subnet addresses surprise people during capacity planning: a NAT gateway takes a private address from the subnet it sits in, and every interface VPC endpoint takes one per subnet it is enabled in. Neither shows up as an instance.",[41,459,461],{"id":460},"sizing-a-real-vpc","Sizing a real VPC",[25,463,464],{},"Take a workload with a web tier and a database tier across 2 Availability Zones, expected to grow.",[466,467,472],"pre",{"className":468,"code":470,"language":471},[469],"language-text","VPC            10.0.0.0/16      65,536 addresses\n\nPublic  AZ-a   10.0.0.0/24         251 usable  (ALB nodes, NAT gateway)\nPublic  AZ-b   10.0.1.0/24         251 usable\n\nPrivate AZ-a   10.0.16.0/20      4,091 usable  (application instances)\nPrivate AZ-b   10.0.32.0/20      4,091 usable\n\nData    AZ-a   10.0.48.0/24        251 usable  (RDS subnet group)\nData    AZ-b   10.0.49.0/24        251 usable\n","text",[29,473,470],{"__ignoreMap":474},"",[25,476,477,478,481],{},"Two things about this layout are deliberate. Public subnets are small because load balancer nodes and a NAT gateway need very few addresses, and private subnets are generous because that is where scaling happens. The blocks are also spaced out rather than packed end to end, leaving room to carve ",[29,479,480],{},"10.0.64.0/20"," and beyond for a third zone or a new tier without renumbering anything.",[25,483,484],{},"Verify capacity from the CLI rather than from a spreadsheet:",[466,486,490],{"className":487,"code":488,"language":489,"meta":474,"style":474},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","aws ec2 describe-subnets \\\n  --filters \"Name=vpc-id,Values=vpc-0abc123def4567890\" \\\n  --query \"Subnets[].{Subnet:SubnetId,AZ:AvailabilityZone,CIDR:CidrBlock,Free:AvailableIpAddressCount}\" \\\n  --output table\n","bash",[29,491,492,512,531,546],{"__ignoreMap":474},[493,494,497,501,505,508],"span",{"class":495,"line":496},"line",1,[493,498,500],{"class":499},"sbgvK","aws",[493,502,504],{"class":503},"s_sjI"," ec2",[493,506,507],{"class":503}," describe-subnets",[493,509,511],{"class":510},"s_hVV"," \\\n",[493,513,515,519,523,526,529],{"class":495,"line":514},2,[493,516,518],{"class":517},"stzsN","  --filters",[493,520,522],{"class":521},"sjJ54"," \"",[493,524,525],{"class":503},"Name=vpc-id,Values=vpc-0abc123def4567890",[493,527,528],{"class":521},"\"",[493,530,511],{"class":510},[493,532,534,537,539,542,544],{"class":495,"line":533},3,[493,535,536],{"class":517},"  --query",[493,538,522],{"class":521},[493,540,541],{"class":503},"Subnets[].{Subnet:SubnetId,AZ:AvailabilityZone,CIDR:CidrBlock,Free:AvailableIpAddressCount}",[493,543,528],{"class":521},[493,545,511],{"class":510},[493,547,549,552],{"class":495,"line":548},4,[493,550,551],{"class":517},"  --output",[493,553,554],{"class":503}," table\n",[25,556,557,560],{},[29,558,559],{},"AvailableIpAddressCount"," is the number that matters during an incident. It already accounts for the 5 reserved addresses and for everything currently deployed.",[41,562,564],{"id":563},"route-tables-decide-where-packets-go","Route tables decide where packets go",[25,566,567,568,571],{},"Every subnet must be associated with a route table. Associate one explicitly, or the subnet is implicitly associated with the VPC ",[145,569,570],{},"main route table",", which AWS creates with the VPC.",[25,573,574,575,578,579,582],{},"Each route has a ",[145,576,577],{},"destination"," (a CIDR block or a prefix list) and a ",[145,580,581],{},"target"," (an internet gateway, NAT gateway, network interface, peering connection, transit gateway, and so on). The router compares a packet's destination address against the destinations in the table and hands the packet to the matching target.",[25,584,585,586,588],{},"Every route table also contains a ",[145,587,192],{}," route, one per associated CIDR block, IPv4 and IPv6 counted separately. It covers traffic inside the VPC, it is added automatically, and you cannot delete it. You can replace or restore its target, and you can add a route more specific than the local route as long as the destination matches an entire subnet CIDR and the target is a NAT gateway, a network interface, or a Gateway Load Balancer endpoint. That exception exists so you can force traffic between 2 subnets through an inspection appliance.",[25,590,591,592,595],{},"The main route table has its own rules. You can edit its routes but not delete it, you cannot make a gateway route table the main table, and you can replace it by making a custom table the main one. AWS recommends leaving it with only the local route and associating every subnet explicitly, and there is a sharp reason for that recommendation. Put a ",[29,593,594],{},"0.0.0.0/0"," route to an internet gateway in the main route table and every subnet you create from then on, until someone associates it elsewhere, is a public subnet. Nobody sets out to do that. It happens when a route is added to the table that happened to be open in the console.",[25,597,598],{},"Quotas worth remembering: 200 route tables per VPC, 500 non-propagated routes per route table (adjustable to 1,000), and 100 propagated routes, which is not adjustable.",[41,600,602],{"id":601},"two-routes-match-now-what","Two routes match. Now what?",[25,604,605,606,609],{},"Route tables are not firewall rule lists. They are not evaluated top to bottom, and there is no rule order to reason about. AWS picks the ",[145,607,608],{},"most specific matching route",", which is the longest prefix match.",[25,611,612],{},"Walk one table:",[60,614,615,625],{},[63,616,617],{},[66,618,619,622],{},[69,620,621],{},"Destination",[69,623,624],{},"Target",[76,626,627,635,646],{},[66,628,629,633],{},[81,630,631],{},[29,632,88],{},[81,634,192],{},[66,636,637,641],{},[81,638,639],{},[29,640,98],{},[81,642,643],{},[29,644,645],{},"pcx-11223344556677889",[66,647,648,652],{},[81,649,650],{},[29,651,594],{},[81,653,654],{},[29,655,656],{},"igw-12345678901234567",[25,658,659,660,663,664,666,667,669,670,672,673,676,677,679,680,683],{},"A packet for ",[29,661,662],{},"172.31.5.10"," matches both ",[29,665,98],{}," and ",[29,668,594],{},". The ",[29,671,53],{}," is more specific, so the packet goes to the peering connection. A packet for ",[29,674,675],{},"93.184.216.34"," matches only ",[29,678,594],{}," and goes to the internet gateway. A packet for ",[29,681,682],{},"10.0.4.19"," matches the local route and never leaves the VPC.",[25,685,686,687,690],{},"When 2 routes have the ",[145,688,689],{},"same"," destination, the tie is broken by a priority ladder:",[692,693,694,698,701,704],"ol",{},[695,696,697],"li",{},"Longest prefix (this settles most cases before the rest matter)",[695,699,700],{},"Static routes",[695,702,703],{},"Prefix list routes",[695,705,706],{},"Propagated routes, in the order Direct Connect BGP routes, then VPN static routes, then VPN BGP routes",[25,708,709],{},"Static routes are the ones you create, plus those created by an internet gateway, NAT gateway, network interface, instance ID, gateway VPC endpoint, transit gateway, VPC peering connection, or Gateway Load Balancer endpoint. Propagated routes are the ones that appear automatically when you attach a virtual private gateway and enable route propagation.",[25,711,712,713,716,717,719],{},"This ladder produces one of the quieter production failures in AWS networking. A hybrid VPC propagates ",[29,714,715],{},"172.31.0.0/24"," from the on-premises network through a virtual private gateway. Someone later adds a static route for the same ",[29,718,715],{}," to an internet gateway. Nothing errors. The static route wins, and traffic that should have crossed the VPN heads for the public internet instead. If a scenario says traffic bound for a data center is \"leaving through the internet gateway\", check for a static route that shadows the propagated one.",[25,721,722,723,726,727,730],{},"Two ranges cannot be routed at all: ",[29,724,725],{},"169.254.168.0/22"," for IPv4 and ",[29,728,729],{},"fd00:ec2::/32"," for IPv6. AWS reserves them for services reachable only from instances, such as the Instance Metadata Service and the Amazon DNS server. A larger overlapping block is accepted, but packets aimed inside the reserved range are not forwarded.",[41,732,734],{"id":733},"exam-tips","Exam tips",[736,737,738,747,754,757,760,763,766,769,772,775],"ul",{},[695,739,740,741,743,744,746],{},"Subnet address math: subtract 5, never 2. A ",[29,742,426],{}," gives 251 usable addresses, a ",[29,745,57],{}," gives 11. Insufficient-address errors during scaling are this calculation.",[695,748,749,750,753],{},"Public versus private is a property of the ",[145,751,752],{},"route table",", never of the subnet. A question that says \"the subnet was configured as private\" is describing a route table, and the fix is always routing.",[695,755,756],{},"Reaching the internet takes both a route to an internet gateway and a public IPv4 or IPv6 address on the resource. Missing either one produces the same symptom.",[695,758,759],{},"A subnet with no explicit route table association uses the main route table. This is how subnets accidentally become public.",[695,761,762],{},"Longest prefix match settles overlapping routes. Route tables have no evaluation order, so \"the first matching route\" is always a wrong answer.",[695,764,765],{},"Identical destinations: static beats propagated. Watch for this in hybrid scenarios where traffic is going out the wrong gateway.",[695,767,768],{},"You cannot resize a CIDR block or remove the primary CIDR. If an option offers to expand a VPC CIDR in place, it is wrong.",[695,770,771],{},"Secondary CIDR restriction: a VPC using one RFC 1918 range cannot add a block from a different RFC 1918 range.",[695,773,774],{},"A subnet sits in one Availability Zone. Multi-AZ means more subnets, not bigger ones.",[695,776,777],{},"The local route cannot be deleted. It can have its target replaced, and it can be overridden by a more specific route whose destination is an entire subnet CIDR and whose target is a NAT gateway, network interface, or Gateway Load Balancer endpoint.",[25,779,780],{},"The habit to carry forward is that a VPC answers exactly 2 questions about any packet: does this address belong to me, and if not, which target do I hand it to? Address planning answers the first, route tables answer the second, and almost every connectivity ticket in this domain is one of those 2 answers being wrong. The next lesson takes the most common target you will put in a route table, the gateways that connect a VPC to the internet, and shows why 3 of them exist instead of one.",[782,783,784],"style",{},"html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":474,"searchDepth":533,"depth":533,"links":786},[787,788,789,790,791,792,793,794],{"id":43,"depth":514,"text":44},{"id":137,"depth":514,"text":138},{"id":215,"depth":514,"text":216},{"id":297,"depth":514,"text":298},{"id":460,"depth":514,"text":461},{"id":563,"depth":514,"text":564},{"id":601,"depth":514,"text":602},{"id":733,"depth":514,"text":734},"md",[797],{"slug":374,"concept":798,"style":799,"aspectRatio":800,"labels":801},"A single horizontal band representing every address in the subnet 10.0.1.0/28, drawn as 16 equal cells left to right in address order. The first 4 cells and the final cell are shaded as unavailable and each carries a callout naming what AWS reserves it for; the 11 cells between them are shaded as usable and carry one shared bracket label. A footer strip states the rule that generalizes to every subnet size. Emphasis goes on the visual asymmetry, 4 lost at the start and 1 at the end, because that asymmetry is what learners miscount.","diagram","16:9",[802,803,804,805,806,807,808,809],"Subnet 10.0.1.0/28: 16 addresses, 11 usable","10.0.1.0: network address","10.0.1.1: reserved for the VPC router","10.0.1.2: reserved for the Amazon DNS server","10.0.1.3: reserved by AWS for future use","10.0.1.4 through 10.0.1.14: yours, 11 addresses","10.0.1.15: network broadcast address","Every subnet loses its first 4 addresses and its last 1, at every size",[13,14,15,16,17,18],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/01-vpc-fundamentals/01-vpc-subnets-and-route-tables",{"passingScore":814,"questions":815},70,[816,825,833,841,851,859,867,875,881],{"question":817,"type":818,"options":819,"correctAnswer":822,"explanation":824},"An Auto Scaling group in a private subnet with CIDR 10.0.4.0/27 fails to launch its 28th instance with an insufficient free addresses error. The subnet also holds a NAT gateway network interface. How many addresses were ever available to your instances in that subnet?","single",[820,821,822,823],"32, because a /27 contains 32 addresses","31, because only the network address is reserved","27, because AWS reserves the first 4 addresses and the last 1","30, because the network and broadcast addresses are reserved","A /27 holds 32 addresses, but AWS takes the first 4 (network, VPC router, Amazon DNS, future use) and the last 1 (broadcast), leaving 27. The two-reserved-address answer is the on-premises convention and is the most common wrong assumption people bring to AWS. Anything else consuming addresses in the subnet, such as the NAT gateway interface or an interface VPC endpoint, comes out of those 27 as well.",{"question":826,"type":818,"options":827,"correctAnswer":829,"explanation":832},"You created a subnet, launched an instance into it with a public IPv4 address, attached an internet gateway to the VPC, and the instance still cannot reach the internet. What is the most likely cause?",[828,829,830,831],"The subnet's public IP addressing attribute is disabled","The subnet's route table has no route with the internet gateway as the target","The subnet was created as a private subnet and must be recreated as public","The internet gateway needs an Elastic IP address before it can pass traffic","There is no public or private flag on a subnet. A subnet is public only because the route table associated with it sends 0.0.0.0/0 to an internet gateway, so a missing or wrong route table association is the standard cause. The instance already has a public IP, which rules out the addressing attribute, and internet gateways never take an Elastic IP of their own.",{"question":834,"type":818,"options":835,"correctAnswer":836,"explanation":840},"A subnet in your VPC was never explicitly associated with any route table. Which route table controls its traffic?",[836,837,838,839],"The main route table for the VPC","No route table, so the subnet drops all traffic until you associate one","The route table of the first subnet created in the same Availability Zone","A private route table that AWS creates automatically for each subnet","Every subnet must be associated with a route table, and a subnet with no explicit association is implicitly associated with the VPC main route table. This is why adding an internet gateway route to the main route table quietly makes every unassociated subnet public. The recommended practice is to leave the main route table with only its local route and associate every subnet explicitly.",{"question":842,"type":843,"options":844,"correctAnswers":849,"explanation":850},"Which statements about the local route in a VPC route table are correct? (Choose 2.)","multiple",[845,846,847,848],"A VPC with 2 IPv4 CIDR blocks has 2 local routes in each route table","The local route can be deleted if you want to isolate a subnet from the rest of the VPC","You can add a route more specific than the local route if its destination matches an entire subnet CIDR and its target is a NAT gateway, network interface, or Gateway Load Balancer endpoint","The local route appears only in the main route table",[845,847],"Every route table gets a local route per associated CIDR block, IPv4 and IPv6 counted separately, and they appear in all route tables rather than just the main one. You cannot delete a local route, though you can replace or restore its target, and you can override it with a more specific route under the stated conditions, which is how middlebox inspection between subnets is built.",{"question":852,"type":818,"options":853,"correctAnswer":857,"explanation":858},"A subnet route table contains 0.0.0.0/0 pointing to an internet gateway and 172.31.0.0/16 pointing to a VPC peering connection. Where does traffic destined for 172.31.5.10 go?",[854,855,856,857],"To the internet gateway, because the default route is evaluated first","It is dropped, because the two routes conflict","To both targets, and the first response wins","To the peering connection, because /16 is more specific than /0","AWS routes using longest prefix match, so the most specific matching route wins regardless of the order the routes appear in the table. Route tables are not evaluated top to bottom like a firewall rule list, which is the misreading behind the first option. Only when 2 routes have identical destinations do the static-versus-propagated rules come into play.",{"question":860,"type":818,"options":861,"correctAnswer":862,"explanation":866},"Your route table has a propagated route for 172.31.0.0/24 to a virtual private gateway and a static route for 172.31.0.0/24 to an internet gateway. Which one wins?",[862,863,864,865],"The static route to the internet gateway","The propagated route to the virtual private gateway, because BGP routes reflect live reachability","Neither, because AWS rejects a static route that duplicates a propagated destination","Whichever route was created most recently","When destinations are identical, a static route takes priority over a propagated one, and internet gateways, NAT gateways, network interfaces, gateway VPC endpoints, transit gateways, peering connections, and Gateway Load Balancer endpoints all create static routes. Among propagated routes only, the order is Direct Connect BGP routes, then VPN static routes, then VPN BGP routes. AWS accepts both entries without complaint, which is exactly why this silently misroutes traffic.",{"question":868,"type":818,"options":869,"correctAnswer":873,"explanation":874},"You created a VPC with the primary CIDR 10.0.0.0/16 and are running out of space. Which secondary CIDR block can you associate?",[870,871,872,873],"172.20.0.0/16, because it is a different RFC 1918 range","192.168.0.0/16, because it does not overlap the primary","10.0.0.0/15, to widen the existing block","10.1.0.0/16, because it comes from the same 10.0.0.0/8 range","When an existing VPC CIDR sits in one RFC 1918 range, AWS restricts you from adding blocks from the other RFC 1918 ranges, so 172.20.0.0/16 and 192.168.0.0/16 are both refused. You also cannot resize an existing CIDR block, which rules out widening 10.0.0.0/16 to a /15. Any non-restricted block from 10.0.0.0/8 between /16 and /28 is permitted, and 10.1.0.0/16 qualifies.",{"question":876,"type":818,"options":877,"correctAnswer":879,"explanation":880},"True or False: a subnet can span 2 Availability Zones for higher availability.",[878,879],"True","False","A subnet resides entirely within one Availability Zone and cannot span zones, which is why multi-AZ designs mean one subnet per zone per tier rather than one wide subnet. This constraint drives most VPC address planning: the number of subnets you need is tiers multiplied by zones. It is also why a single NAT gateway or a single zonal resource becomes an availability problem for the subnets in other zones.",{"question":882,"type":818,"options":883,"correctAnswer":884,"explanation":888},"A team asks for a VPC CIDR that will not collide with anything. Which range should you avoid even though AWS technically allows it?",[884,885,886,887],"172.17.0.0/16, which several AWS services such as AWS Cloud9 and SageMaker AI use internally","10.0.0.0/16, because it is the AWS default and is always in use elsewhere","192.168.0.0/20, because it is too small for production","172.31.0.0/16, because AWS blocks it outright","AWS explicitly warns that some services use 172.17.0.0/16 internally and that overlapping it can produce IP address conflicts inside those environments. The blocks AWS refuses outright are 0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16, and 224.0.0.0/4. 172.31.0.0/16 is the default VPC range, which is worth avoiding for peering reasons but is not blocked, and 10.0.0.0/16 is merely conventional.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/01-vpc-fundamentals/01-vpc-subnets-and-route-tables","-PO9VNcRoRwdFQEf50Iy-tWgNcHnw8sLaXuJuQZmJOk",{"locked":9,"reason":893,"meta":894,"item":3},"paywall",{"title":895,"description":896,"isFree":5,"estimatedMinutes":10,"difficulty":897,"learningObjectives":898},"Security Hub and Automated Response","How to turn scattered findings from GuardDuty, Inspector, Macie, and Config into one prioritized queue and then act on it without a human in the loop: Security Hub CSPM aggregation and scoring, automation rules, EventBridge remediation, and where exposure findings and AWS Security Agent fit.","intermediate",[899,900,901,902,903,904],"Explain what Security Hub CSPM adds on top of the individual detectors and why AWS Config recording is a prerequisite","Calculate how a standard's security score responds to passed, failed, unknown, and suppressed controls","Configure cross-Region aggregation and choose between central and local configuration for an organization","Distinguish automation rules from EventBridge rules and pick the right one for a stated requirement","Build an automated remediation loop from finding to action to closed workflow status","Place AWS Security Agent and Security Hub exposure findings against the runtime detectors covered so far",{"locked":9,"reason":893,"meta":906,"item":3},{"title":907,"description":908,"isFree":5,"estimatedMinutes":909,"difficulty":897,"learningObjectives":910},"Internet, NAT, and Egress-Only Gateways","Three devices connect a VPC to the internet, and each one exists because the other two cannot do its job. This lesson covers what an internet gateway actually translates, why NAT gateways fail in ways that look like application bugs, and why IPv6 needs a fourth answer entirely.",28,[911,912,913,914,915,916],"Explain the 2 jobs an internet gateway performs and why a route to it is not enough on its own","Compare public and private NAT gateways by the traffic each one is designed to carry","Predict the failure modes of a zonal NAT gateway during an Availability Zone event and during a traffic spike","Diagnose NAT gateway problems from the ErrorPortAllocation, IdleTimeoutCount, and connection-count metrics","Choose an egress-only internet gateway over a NAT gateway based on IP version","Identify the 2 largest sources of NAT gateway cost and the standard ways to reduce them"]