AWS Certified Solutions Architect – Associate Networking & Content Delivery Syllabus

Networking & Content Delivery syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Networking & Content Delivery in AWS Certified Solutions Architect – Associate, not a summary of it.

1. 1

   Amazon VPC Core

   5 topics

   • VPC, subnets and CIDR planning
     • Public vs private subnets
     • IPv4 and IPv6 addressing
   • Route tables, Internet Gateway and egress-only IGW
   • NAT Gateway and NAT Instance
   • Network security controls
     • Security Groups (stateful)
     • Network ACLs (stateless)
   • VPC Flow Logs
2. 2

   VPC Connectivity & Hybrid Networking

   4 topics

   • VPC Peering and Transit Gateway
   • VPC Endpoints
     • Gateway endpoints (S3, DynamoDB)
     • Interface endpoints and PrivateLink
   • Hybrid connectivity
     • Site-to-Site VPN
     • AWS Direct Connect and Direct Connect Gateway
   • AWS Client VPN
3. 3

   DNS, Routing & Content Delivery

   3 topics

   • Amazon Route 53
     • Hosted zones and record types
     • Routing policies (simple, weighted, latency, failover, geolocation, geoproximity, multivalue)
     • Health checks and DNS failover
   • Amazon CloudFront
     • Origins, behaviors and cache policies
     • Origin Access Control and signed URLs/cookies
   • AWS Global Accelerator

Networking & Content Delivery flashcards for AWS Certified Solutions Architect – Associate

24 of 60 cards from the Networking & Content Delivery deck — real questions with worked answers.

1. What is an Amazon VPC?

   A logically isolated virtual network within an AWS Region where you launch resources. It spans all Availability Zones in that Region and gives you control over IP addressing, subnets, route tables, and gateways.

2. What are the allowed size limits for a VPC IPv4 CIDR block?

   The CIDR netmask must be between /16 (65,536 addresses) and /28 (16 addresses).

3. How many IP addresses in each subnet are reserved by AWS, and what is the usable count?

   AWS reserves 5 addresses per subnet (the first 4 and the last). So a /24 subnet (256 addresses) has 251 usable addresses.

4. What are the 5 reserved addresses in a VPC subnet (for a 10.0.0.0/24 example)?

   .0 = network address, .1 = VPC router, .2 = DNS (Amazon-provided/base+2), .3 = reserved for future use, .255 = network broadcast address (broadcast not supported but reserved).

5. Can a subnet span multiple Availability Zones?

   No. A subnet resides entirely within a single Availability Zone. A VPC spans all AZs in the Region, but each subnet maps to exactly one AZ.

6. What distinguishes a public subnet from a private subnet?

   A public subnet has a route table with a route (0.0.0.0/0) pointing to an Internet Gateway. A private subnet has no direct route to the IGW.

7. What does CIDR notation /20 represent in terms of host addresses?

   /20 leaves 12 host bits, giving 2^12 = 4,096 IP addresses (4,091 usable in a VPC subnet).

8. Can the CIDR blocks of two subnets in the same VPC overlap?

   No. Subnet CIDR blocks within a VPC must not overlap with each other.

9. What is an Internet Gateway (IGW) and what are its two functions?

   A horizontally scaled, redundant, highly available VPC component that allows communication between the VPC and the internet. It performs (1) routing for internet-bound traffic and (2) NAT for instances with public IPv4 addresses.

10. What is required for an EC2 instance to reach the internet via an IGW?

    The instance needs a public IPv4 (or Elastic IP) address, the subnet's route table must route 0.0.0.0/0 to the IGW, and security groups/NACLs must permit the traffic.

11. What is an egress-only Internet Gateway and when is it used?

    An IPv6-only gateway that allows outbound IPv6 traffic from the VPC to the internet while preventing inbound IPv6 connections initiated from the internet. It is the IPv6 equivalent of a NAT Gateway (since IPv6 addresses are public/globally routable).

12. Why can't you use a NAT Gateway for IPv6 outbound-only access?

    NAT is a concept for IPv4 (translating private to public addresses). IPv6 addresses are globally unique/public, so AWS provides the egress-only Internet Gateway instead to allow outbound-only IPv6 traffic.

13. What is the purpose of a NAT Gateway?

    It enables instances in a private subnet to initiate outbound connections to the internet (or other AWS services) while preventing the internet from initiating inbound connections to those instances.

14. Where must a NAT Gateway be placed and what does it require?

    In a public subnet, and it requires an Elastic IP address. Private subnet route tables then point 0.0.0.0/0 to the NAT Gateway.

15. Compare NAT Gateway vs NAT Instance on availability and management.

    NAT Gateway is AWS-managed, highly available within an AZ, auto-scales bandwidth (up to 100 Gbps), and needs no patching. A NAT Instance is a self-managed EC2 instance you must size, patch, and make HA yourself.

16. How do you make a NAT Gateway architecture highly available across AZs?

    Deploy a separate NAT Gateway in each Availability Zone and configure each AZ's private subnet route table to use the NAT Gateway in its own AZ. This avoids cross-AZ dependency and charges.

17. What is one capability a NAT Instance has that a NAT Gateway does not?

    A NAT Instance can be used as a bastion host, can support port forwarding, and can have security groups applied to it. A NAT Gateway cannot use security groups and cannot be a bastion host.

18. What setting must be disabled on a NAT Instance for it to forward traffic?

    The Source/Destination Check must be disabled, because the instance forwards traffic that is not addressed to itself.

19. What is a Security Group in a VPC?

    A stateful virtual firewall applied at the instance/ENI level that controls inbound and outbound traffic. It supports allow rules only.

20. What does it mean that Security Groups are stateful?

    If inbound traffic is allowed, the response (return) traffic is automatically allowed regardless of outbound rules, and vice versa. You don't need explicit rules for return traffic.

21. What is a Network ACL (NACL) and at what level does it operate?

    A stateless firewall that operates at the subnet level, controlling inbound and outbound traffic with both allow and deny rules, evaluated by rule number in order.

22. Why are NACLs called stateless?

    Return traffic is not automatically allowed; you must create explicit rules for both inbound and outbound directions (including ephemeral ports for responses).

23. How are conflicting rules resolved in a NACL?

    Rules are evaluated in ascending order by rule number; the first matching rule is applied and evaluation stops. Lower-numbered rules take precedence.

24. Compare Security Groups vs NACLs in three key dimensions.

    Security Group: instance/ENI level, stateful, allow rules only, all rules evaluated. NACL: subnet level, stateless, allow and deny rules, evaluated in order by rule number.

See more Networking & Content Delivery flashcards →

Planning Networking & Content Delivery for AWS Certified Solutions Architect – Associate

Networking & Content Delivery (AWS Certified Solutions Architect – Associate) FAQ