For a network question, draw source, destination, route, stateful filter, stateless filter, and return path. Most distractors disappear once the packet path is explicit.
Public and private are routing properties
A public subnet has a route to an Internet Gateway. A public IPv4 address alone does not create a route. Private-subnet IPv4 egress commonly uses a NAT Gateway in a public subnet; unsolicited inbound connections cannot use that path. IPv6 egress-only Internet Gateway provides outbound-only behavior without NAT.
Security groups are stateful and attach to resources. NACLs are stateless subnet controls, evaluated in rule order, so return traffic and ephemeral ports matter. Prefer security-group references between application tiers.
Connect networks according to topology
| Need | Choice |
|---|---|
| Two VPCs, simple non-transitive link | VPC peering |
| Many VPCs and on-prem networks | Transit Gateway |
| Private access to one provider service | PrivateLink/interface endpoint |
| Private access to S3 or DynamoDB | Gateway endpoint |
| Encrypted link over internet | Site-to-Site VPN |
| Predictable dedicated capacity | Direct Connect, usually with VPN backup |
Peering is not transitive. Direct Connect is not encrypted by default. NAT Gateway cost can make an endpoint cheaper for heavy AWS-service traffic.
DNS and edge services solve different layers
Route 53 Alias records can target supported AWS resources and work at the zone apex; CNAME cannot be used at the apex. Routing policy follows intent: weighted for traffic proportions, latency for network latency, failover for active/passive, geolocation for user location rules.
CloudFront caches HTTP content at edge locations and protects origins with OAC or suitable private-origin patterns. Global Accelerator provides static anycast IPs and routes TCP/UDP traffic over the AWS global network; it is not a content cache.
Exam lens: CloudFront answers “cache HTTP near users.” Global Accelerator answers “improve and stabilize global network entry.” Route 53 answers “which endpoint name should DNS return?”
Review card
- Route tables create reachability; addresses do not.
- SG is stateful; NACL is stateless.
- Peering is non-transitive; Transit Gateway is a hub.
- PrivateLink exposes a service without joining full networks.
- DNS, CDN, and anycast acceleration solve different problems.
網路題先畫 source、destination、route、stateful filter、stateless filter 與 return path。Packet path 一明確，大多數 distractor 會自己消失。
Public/private 是 routing property
Public subnet 有指向 Internet Gateway 的 route。只有 public IPv4 不會自動可上網。Private-subnet IPv4 egress 通常經 public subnet 裡的 NAT Gateway；外部不能用它發起 unsolicited inbound connection。IPv6 的 egress-only Internet Gateway 提供不需 NAT 的 outbound-only behavior。
Security group 是 stateful resource control；NACL 是 stateless subnet control，依 rule order 評估，所以 return traffic 與 ephemeral port 都要考慮。Application tiers 之間優先以 SG reference 放行。
根據 topology 選連線
| 需求 | 選擇 |
|---|---|
| 兩個 VPC，簡單非 transitive | VPC peering |
| 多 VPC 與 on-prem | Transit Gateway |
| Private access 單一 provider service | PrivateLink/interface endpoint |
| Private access S3/DynamoDB | Gateway endpoint |
| 走 Internet 的 encrypted link | Site-to-Site VPN |
| 穩定 dedicated capacity | Direct Connect，通常加 VPN backup |
Peering 不 transitive。Direct Connect 預設不加密。大量存取 AWS service 時，NAT Gateway 費用可能讓 endpoint 更便宜。
DNS 與 edge service 處理不同 layer
Route 53 Alias 可指向支援的 AWS resource，並可用在 zone apex；CNAME 不行。Routing policy 看 intent：weighted 分流量、latency 看 network latency、failover 做 active/passive、geolocation 依 user location 套規則。
CloudFront 在 edge cache HTTP content，並用 OAC 或合適 private-origin pattern 保護 origin。Global Accelerator 提供 static anycast IP，把 TCP/UDP 導入 AWS global network；它不 cache content。
考試視角： CloudFront 是「把 HTTP cache 靠近 user」；Global Accelerator 是「穩定並加速 global network entry」；Route 53 是「DNS 要回哪個 endpoint」。
複習卡
- Reachability 由 route table 建立，不是 address。
- SG stateful；NACL stateless。
- Peering 非 transitive；Transit Gateway 是 hub。
- PrivateLink 能暴露單一 service，無需打通整個 network。
- DNS、CDN、anycast acceleration 解決不同問題。