AWS Certified Solutions Architect – Associate Networking & Content Delivery Syllabus

What is a Network ACL (NACL) and at what level does it operate?

A stateless firewall that operates at the subnet level, controlling inbound and outbound traffic with both allow and deny rules, evaluated by rule number in order.

Why are NACLs called stateless?

Return traffic is not automatically allowed; you must create explicit rules for both inbound and outbound directions (including ephemeral ports for responses).

How are conflicting rules resolved in a NACL?

Rules are evaluated in ascending order by rule number; the first matching rule is applied and evaluation stops. Lower-numbered rules take precedence.

Compare Security Groups vs NACLs in three key dimensions.

Security Group: instance/ENI level, stateful, allow rules only, all rules evaluated. NACL: subnet level, stateless, allow and deny rules, evaluated in order by rule number.

What is the default behavior of the default Security Group vs the default NACL?

Default Security Group: denies all inbound, allows all outbound (and allows traffic between members). Default NACL: allows all inbound and all outbound traffic.

What are VPC Flow Logs?

A feature that captures information about the IP traffic going to and from network interfaces in your VPC, for monitoring, troubleshooting, and security analysis.

At what three levels can VPC Flow Logs be enabled?

At the VPC level, the subnet level, or the individual network interface (ENI) level.

Where can VPC Flow Logs be published?

To Amazon CloudWatch Logs, an Amazon S3 bucket, or Amazon Data Firehose (Kinesis Data Firehose).

Do VPC Flow Logs capture packet contents?

No. Flow Logs capture metadata about traffic (source/dest IP, ports, protocol, bytes, action ACCEPT/REJECT) but not the actual packet payload.

What is VPC Peering?

A networking connection between two VPCs that lets them route traffic privately using private IP addresses as if they were on the same network.

What is a key limitation of VPC Peering regarding transitivity?

VPC Peering is NOT transitive. If A is peered with B and B with C, A cannot reach C through B. Each pair needs its own direct peering connection.

Can you create a VPC Peering connection between VPCs with overlapping CIDR blocks?

No. The VPCs must have non-overlapping CIDR blocks to be peered.

What is AWS Transit Gateway?

A regional network transit hub that connects VPCs and on-premises networks through a central gateway, using a hub-and-spoke model to simplify connectivity and avoid complex peering meshes.

What advantage does Transit Gateway have over VPC Peering for many VPCs?

Transit Gateway supports transitive routing through a single hub, scaling to thousands of VPCs without a full mesh of peering connections, and supports route tables for segmentation.

Does Transit Gateway support cross-Region connectivity?

Yes, via Transit Gateway peering, which can connect Transit Gateways in different Regions (traffic stays on the AWS backbone and is encrypted).

What is a VPC Endpoint and what problem does it solve?

It enables private connectivity from your VPC to supported AWS services without traversing the internet, NAT Gateway, or IGW, keeping traffic on the AWS network.

What is the difference between a Gateway Endpoint and an Interface Endpoint?

A Gateway Endpoint adds a route to your route table (target = the service) and is only for S3 and DynamoDB, with no charge. An Interface Endpoint (powered by AWS PrivateLink) creates an ENI with a private IP in your subnet, works for most AWS services, and incurs hourly + data charges.

Which two AWS services use Gateway VPC Endpoints?

Amazon S3 and Amazon DynamoDB.

What technology powers Interface VPC Endpoints?

AWS PrivateLink, which provisions an Elastic Network Interface (ENI) with a private IP address as the entry point to the service.

What are the main options for hybrid connectivity between on-premises and AWS?

AWS Site-to-Site VPN (IPsec over the internet) and AWS Direct Connect (dedicated private physical connection).

Compare AWS Direct Connect vs Site-to-Site VPN.

Direct Connect = dedicated private physical link, consistent low latency/high bandwidth, not encrypted by default, longer to provision. Site-to-Site VPN = encrypted IPsec tunnel over the public internet, quick to set up, lower cost, variable latency.

How do you add encryption to a Direct Connect connection?

Run a Site-to-Site VPN over the Direct Connect connection (combining private connectivity with IPsec encryption), or use MACsec on supported DX connections.

How many tunnels does an AWS Site-to-Site VPN connection provide and why?

Two tunnels, terminating in different AWS endpoints/AZs, to provide redundancy and high availability for the connection.

What is the typical solution to keep a backup path if Direct Connect fails?

Configure a Site-to-Site VPN as a backup/failover connection to maintain connectivity if the Direct Connect link goes down.

What is AWS Client VPN?

A managed, client-based VPN service that lets users securely access AWS resources and on-premises networks from any location using an OpenVPN-based client.

What authentication methods does AWS Client VPN support?

Active Directory authentication, mutual (certificate-based) authentication, and federated/SAML-based (SSO) authentication.

How does Client VPN differ from Site-to-Site VPN?

Client VPN connects individual remote users/devices to AWS (remote access VPN), while Site-to-Site VPN connects an entire network/data center to AWS (network-to-network).

What is Amazon Route 53?

A highly available and scalable DNS web service that also provides domain registration and health checking, with the '53' referring to DNS port 53.

What is the difference between an A record, AAAA record, and CNAME in Route 53?

A record maps a name to an IPv4 address; AAAA maps a name to an IPv6 address; CNAME maps a name to another domain name (cannot be used for the zone apex/root).

What is a Route 53 Alias record and how does it differ from a CNAME?

An Alias record maps a name to an AWS resource (ELB, CloudFront, S3 website, etc.). Unlike a CNAME, it works at the zone apex (root domain), is free for AWS resource queries, and resolves natively to the target.

List the Route 53 routing policies.

Simple, Weighted, Latency-based, Failover, Geolocation, Geoproximity, Multivalue answer, and IP-based routing.

When would you use Route 53 Latency-based routing vs Geolocation routing?

Latency-based routes users to the Region with the lowest network latency for best performance. Geolocation routes based on the user's physical location (for content localization, compliance, or licensing).

What is Route 53 Failover routing combined with health checks used for?

Active-passive disaster recovery: traffic goes to the primary resource while healthy and automatically fails over to a secondary resource when the health check on the primary fails.

What is Amazon CloudFront?

A global Content Delivery Network (CDN) that caches content at edge locations close to users to reduce latency and improve delivery of static and dynamic content.

What is an Origin in CloudFront, and what types are supported?

The source of the content CloudFront distributes. Origins include S3 buckets, MediaStore/MediaPackage, EC2/ALB or any custom HTTP origin (custom origin).

What is Origin Access Control (OAC) in CloudFront?

A feature that restricts direct access to an S3 origin so content is only reachable through CloudFront, replacing the older Origin Access Identity (OAI).

What is the difference between CloudFront and Global Accelerator at the network layer?

CloudFront caches and serves HTTP/HTTPS content at edge locations (Layer 7, content delivery). Global Accelerator routes TCP/UDP traffic over the AWS backbone using anycast static IPs (Layer 4, no caching), improving performance for non-cacheable/global apps.

What is AWS Global Accelerator?

A networking service that provides two static anycast IP addresses as a fixed entry point and routes user traffic over the AWS global backbone to the optimal application endpoint for improved performance and availability.

What two static IP addresses does Global Accelerator provide and why are they useful?

Two static anycast IPs that serve as a fixed front door to your application. They don't change, simplifying allow-listing and DNS, while traffic is routed to the nearest healthy endpoint.

How does Global Accelerator improve availability during regional failure?

It continuously health-checks endpoints and instantly reroutes traffic to the next-closest healthy endpoint/Region without requiring DNS changes (since the IPs are static).