For a network question, draw source, destination, route, stateful filter, stateless filter, and return path. Most distractors disappear once the packet path is explicit.
Public and private are routing properties
A public subnet has a route to an Internet Gateway. A public IPv4 address alone does not create a route. Private-subnet IPv4 egress commonly uses a NAT Gateway in a public subnet; unsolicited inbound connections cannot use that path. IPv6 egress-only Internet Gateway provides outbound-only behavior without NAT.
Security groups are stateful and attach to resources. NACLs are stateless subnet controls, evaluated in rule order, so return traffic and ephemeral ports matter. Prefer security-group references between application tiers.
Connect networks according to topology
| Need | Choice |
|---|---|
| Two VPCs, simple non-transitive link | VPC peering |
| Many VPCs and on-prem networks | Transit Gateway |
| Private access to one provider service | PrivateLink/interface endpoint |
| Private access to S3 or DynamoDB | Gateway endpoint |
| Encrypted link over internet | Site-to-Site VPN |
| Predictable dedicated capacity | Direct Connect, usually with VPN backup |
Peering is not transitive. Direct Connect is not encrypted by default. NAT Gateway cost can make an endpoint cheaper for heavy AWS-service traffic.
DNS and edge services solve different layers
Route 53 Alias records can target supported AWS resources and work at the zone apex; CNAME cannot be used at the apex. Routing policy follows intent: weighted for traffic proportions, latency for network latency, failover for active/passive, geolocation for user location rules.
CloudFront caches HTTP content at edge locations and protects origins with OAC or suitable private-origin patterns. Global Accelerator provides static anycast IPs and routes TCP/UDP traffic over the AWS global network; it is not a content cache.
Exam lens: CloudFront answers “cache HTTP near users.” Global Accelerator answers “improve and stabilize global network entry.” Route 53 answers “which endpoint name should DNS return?”
Review card
- Route tables create reachability; addresses do not.
- SG is stateful; NACL is stateless.
- Peering is non-transitive; Transit Gateway is a hub.
- PrivateLink exposes a service without joining full networks.
- DNS, CDN, and anycast acceleration solve different problems.