12 Networking and Content Delivery · AWS Cloud Practitioner

In this chapter you will learn how Amazon VPC gives you a private network in the AWS Cloud, how subnets, route tables, internet gateways, and NAT gateways decide where traffic can flow, and how security groups and network ACLs filter it. You will compare the ways to connect networks together (VPC peering, AWS Transit Gateway, AWS PrivateLink, VPN, and AWS Direct Connect) and learn the services that bring applications closer to users: Amazon Route 53, Amazon CloudFront, AWS Global Accelerator, Amazon API Gateway, and Elastic Load Balancing. This chapter maps to exam Domain 3, Cloud Technology and Services, Task Statement 3.5: Identify AWS network services, and touches Task Statement 2.4 on network security.

12.1 Networking without the jargon

Networking questions on the Cloud Practitioner exam are conceptual. You will not calculate subnet masks or write routing rules. You need to know what each building block does, which ones make a resource reachable from the internet, and which service connects what to what.

A useful mental model is an office building. The VPC is the building, with walls that keep outsiders out. Subnets are floors. Route tables are the signs in the hallways telling people which door leads where. The internet gateway is the front door. A NAT gateway is the mail room: staff can send letters out, but strangers cannot walk in through it. Security groups are locks on individual office doors, and network ACLs are the security desk at each floor. Keep this picture in mind as we go.

12.2 Amazon VPC basics

Amazon Virtual Private Cloud (Amazon VPC) lets you create a logically isolated network in an AWS Region. You choose its IP address range, divide it into subnets, and control routing and security. Resources such as EC2 instances, RDS databases, and load balancers are launched into your VPC.

Key facts:

A VPC belongs to one Region but spans all Availability Zones in that Region.

Every account gets a default VPC in each Region, already set up with public subnets so beginners can launch an instance and reach it immediately. Production workloads usually use custom VPCs.

There is no charge for the VPC itself. You pay for some components inside it, such as NAT gateways, VPN connections, and certain endpoints.

CIDR in one minute

A VPC’s address range is written in CIDR notation (Classless Inter-Domain Routing), such as 10.0.0.0/16 . The number after the slash says how many bits are fixed; the smaller that number, the bigger the range. A /16 holds 65,536 addresses, and a /24 holds 256. A VPC can range from /16 (largest) to /28 (smallest). You then carve the VPC’s range into smaller blocks for each subnet, such as 10.0.1.0/24 and 10.0.2.0/24 . AWS reserves five addresses in every subnet for its own use. Plan ranges that do not overlap with your other VPCs or your office network, because overlapping ranges cannot be connected later without pain.

12.3 Subnets, route tables, and gateways

Public and private subnets

A subnet is a range of IP addresses within your VPC, and each subnet lives in exactly one Availability Zone. To build a highly available application, you create matching subnets in at least two AZs.

What makes a subnet “public” or “private” is not a checkbox. It is the route table:

A public subnet has a route to an internet gateway. Resources in it that have a public IP address can be reached from the internet and can reach the internet. Load balancers and NAT gateways usually live here. A private subnet has no route to the internet gateway. Application servers and databases belong here, where nothing on the internet can start a connection to them.

Route tables

A route table is a set of rules, called routes, that decide where network traffic from a subnet is directed. Every route table automatically contains a local route so all subnets in the VPC can talk to each other. You add other routes as needed, such as “send everything else ( 0.0.0.0/0 ) to the internet gateway.” Each subnet is associated with exactly one route table.

Internet gateway

An internet gateway (IGW) is a horizontally scaled, highly available component that you attach to a VPC to allow communication between the VPC and the internet. One VPC has at most one internet gateway. On its own it does nothing; a route table must point to it.

NAT gateway

Private servers still need to reach the internet sometimes, for example to download software updates or call a third-party API. A NAT gateway (network address translation) sits in a public subnet and lets resources in private subnets start outbound connections to the internet, while blocking anyone on the internet from starting a connection inbound. The private subnet’s route table sends 0.0.0.0/0 to the NAT gateway, which in turn uses the internet gateway. NAT gateways are managed by AWS, scale automatically, and are billed per hour plus per gigabyte processed. For resilience, place one in each AZ you use. (An older do-it-yourself alternative, a NAT instance on EC2, is something you manage yourself.)

Internet users

AWS Region

Vpc 10.0.0.0/16

Figure 12.1: A typical two-AZ VPC. Users reach the Application Load Balancer through the internet gateway; EC2 instances in private app

subnets reach the internet only outbound through NAT gateways; the RDS database sits in private DB subnets with a Multi-AZ standby.

Exam tip

“Allow instances in a private subnet to download patches without being reachable from the internet” is a NAT gateway. “Allow a VPC to communicate with the internet” is an internet gateway. If a question asks what makes a subnet public, the answer is a route to an internet gateway.

12.4 Security groups and network ACLs (recap)

You met both of these in the security chapter (Chapter 7). Here they are side by side, because networking questions love to compare them.

Feature Security group Network ACL
Applies to Instance (network interface) Subnet
Rules Allow only Allow and deny
State Stateful Stateless
Evaluation All rules together In number order

Stateful means that if you allow a request in, the response is automatically allowed out. Stateless means return traffic must be explicitly allowed too. By default, a new security group denies all inbound traffic and allows all outbound traffic, and the default network ACL allows everything in both directions.

In practice, security groups do most of the work. A common pattern is to reference one security group from another: the database security group allows port 5432 only from the application servers’ security group, so no IP addresses need to be hard-coded. Network ACLs act as an extra, coarse layer, often used to block a specific malicious IP range, something security groups cannot do because they have no deny rules.

Common trap

“Block a specific IP address” is a network ACL task (or AWS WAF for web traffic), not a security group task. Security groups can only allow.

Two related tools you may see: VPC Flow Logs capture information about the IP traffic going to and from network interfaces, useful for troubleshooting and security analysis. AWS Network Firewall adds managed, stateful inspection and filtering for whole VPCs.

12.5 Connecting VPCs together

VPC peering

VPC peering is a private, one-to-one connection between two VPCs, in the same or different accounts and Regions. Traffic stays on the AWS network and resources communicate using private IP addresses as if they were on the same network. Peering is simple and has no hourly charge, but it is not transitive: if VPC A peers with B, and B peers with C, A still cannot reach C through B. Connecting many VPCs this way becomes a tangled mesh; ten VPCs would need 45 separate peering connections.

AWS Transit Gateway

AWS Transit Gateway is a regional network hub. Each VPC, VPN connection, or Direct Connect gateway attaches to the hub once, and the transit gateway routes traffic between them according to its route tables. It scales to thousands of attachments and simplifies large networks into a hub-and-spoke design. Transit gateways in different Regions can be peered to build a global network.

VPC peering mesh vs Transit Gateway hub

Peering: full mesh

Vpc a vpc b

Vpc c vpc d

4 VPCs need 6 peering connections
Not transitive: A-B and B-C does
not let A reach C
Fine for a few VPCs, no hourly hub
Transit Gateway: hub and spoke

Vpc a vpc b

Vpc c vpc d

Figure 12.2: A full mesh of VPC peering connections compared with a Transit Gateway hub that connects VPCs and on-premises networks.

VPC endpoints and AWS PrivateLink

Suppose an EC2 instance in a private subnet needs to read files from Amazon S3. Without help, that traffic would leave through the NAT gateway to S3’s public endpoint. VPC endpoints let you reach AWS services privately, without an internet gateway, NAT gateway, or public IP address:

Gateway endpoints are available for Amazon S3 and DynamoDB. You add them as a target in your route table, and they have no additional charge.

Interface endpoints, powered by AWS PrivateLink, place a private network interface in your subnet for many other AWS services.

AWS PrivateLink also lets a company expose its own service to other VPCs or customers privately. The consumer sees an interface endpoint in their own VPC, without peering whole networks or opening anything to the internet. Software-as-a-service providers use this to offer private connectivity to their customers.

Exam tip

“Access S3 from a private subnet without going over the internet” points to a VPC gateway endpoint. “Privately expose a service to many other VPCs without peering” points to AWS PrivateLink. “Connect hundreds of VPCs and on-premises networks through a central hub” points to Transit Gateway.

12.6 Hybrid connectivity: VPN and Direct Connect

Most organizations do not move everything to the cloud at once. They need their data centers and offices to talk to their VPCs. AWS offers two main paths.

AWS Site-to-Site VPN

AWS Site-to-Site VPN creates encrypted IPsec tunnels over the public internet between your on-premises network and AWS. On the AWS side, the tunnels terminate on a virtual private gateway attached to a VPC, or on a transit gateway. On your side, a customer gateway device (your router or firewall) terminates them. Each connection includes two tunnels for redundancy. A VPN can be up in minutes to hours, costs relatively little, and is encrypted by default, but its performance depends on the internet.

AWS Client VPN

AWS Client VPN is a managed service that lets individual users connect securely from their laptops to AWS and on-premises networks, using OpenVPN-based client software. Think remote employees working from home, not whole offices.

AWS Direct Connect

AWS Direct Connect provides a dedicated, private network connection from your premises to AWS. You (or an AWS partner) run a cable from your network to a Direct Connect location, a colocation facility where AWS has equipment. Because traffic does not cross the public internet, you get more consistent latency and throughput, and data transfer out can be cheaper at high volumes. Dedicated connections are offered at speeds such as 1, 10, and 100 Gbps, and partners offer hosted connections at lower speeds.

Direct Connect takes weeks or longer to set up, and traffic is not encrypted by default. If you need encryption, run a Site-to-Site VPN over the Direct Connect link or use MACsec on supported connections. For resilience, organizations use two Direct Connect connections at different locations, or keep a Site-to-Site VPN as a backup. Hybrid connectivity: Site-to-Site VPN vs Direct Connect

Vpc

Virtual private

gateway / TGW

Ec2, rds, ...

Site-to-Site VPN: encrypted IPsec tunnels
Public internet
shared, variable latency
Direct Connect
location
Direct Connect: private dedicated line
Factor Site-to-Site VPN AWS Direct Connect
Path Over the internet Private physical connection
Setup time Minutes to hours Weeks or more
Performance Varies with internet Consistent, high bandwidth
Encryption Yes, IPsec built in Not by default; add VPN/MACsec
Cost Lower Higher (port hours + data out)

Figure 12.3: Site-to-Site VPN sends encrypted traffic across the public internet; Direct Connect uses a private dedicated line through a Direct Connect location.

Real-world example

Real-world scenario: A regional bank starts its cloud journey with a Site-to-Site VPN because it can be ready this week. Six months later, nightly data transfers to AWS have grown to several terabytes and the VPN’s variable speed is causing missed batch windows. The bank orders two Direct Connect links at different locations for steady, high-bandwidth connectivity, runs IPsec VPN over them to meet its encryption policy, and keeps the original internet VPN as a last-resort backup.

12.7 Amazon Route 53

Amazon Route 53 is AWS’s highly available and scalable Domain Name System (DNS) service. DNS is the internet’s phone book: it translates names like www.example.com into IP addresses. Route 53 is a global service and is designed for 100 percent availability. The name comes from port 53, which DNS uses.

Route 53 does three jobs:

1. Domain registration: buy and renew domain names.
2. DNS hosting and routing: answer DNS queries for your domains using records in hosted zones. Public hosted zones answer the internet; private hosted zones answer only inside your VPCs. Route 53 supports alias records that point a domain name directly at AWS resources such as a load balancer, CloudFront distribution, or S3 static website.
3. Health checks: monitor endpoints and stop sending users to unhealthy ones.

Routing policies

A routing policy decides which answer Route 53 gives when someone looks up your name.

Figure 12.4: Six common Route 53 routing policies and the decision each one makes.

Common trap

Latency-based and geolocation routing are easy to mix up. Latency routing picks the fastest Region for the user, which is usually but not always the closest. Geolocation routing picks based on where the user is, which matters for language, content licensing, or data-residency rules, even if another Region would be faster.

12.8 Amazon CloudFront

Amazon CloudFront is AWS’s content delivery network (CDN). It caches copies of your content in edge locations, of which AWS operates hundreds around the world, so users download from a nearby location instead of from your origin Region. That means lower latency, less load on your servers, and often lower data transfer costs. You create a distribution and point it at one or more origins: an S3 bucket, an Application Load Balancer, EC2 instances, or any HTTP server, even one outside AWS. When a viewer requests a file, DNS steers them to the nearest edge location. If the object is in the cache (a cache hit), it is returned immediately. If not (a cache miss), CloudFront checks a larger regional edge cache, then fetches from the origin over the AWS global network and caches the result for next time. Each object stays cached for its time to live (TTL).

Alb / ec2

dynamic content
1 3 4
2 / 5

1. DNS sends the viewer to the nearest edge location (lowest latency).
2. Cache hit: the edge returns the object immediately. Fastest path.
3. Cache miss: the edge asks a regional edge cache.
4. Still a miss: CloudFront fetches from the origin over the AWS network.
5. The object is cached on the way back (for its TTL) and returned.

The next viewer near that edge gets a cache hit.

Figure 12.5: A CloudFront request goes to the nearest edge location; cache misses are fetched from the origin through a regional edge cache and stored for later viewers.

CloudFront is about more than speed:

Security: AWS Shield Standard protects every distribution against common DDoS attacks at no extra charge, and you can attach AWS WAF rules. CloudFront serves content over HTTPS with free certificates from AWS Certificate Manager.

Origin protection: origin access control (OAC) lets a private S3 bucket serve content only through CloudFront, so users cannot bypass it.

Edge code: CloudFront Functions and Lambda@Edge run small pieces of code at the edge, for example to rewrite URLs or add security headers.

Dynamic content and video: CloudFront accelerates APIs and dynamic pages, not just static files, and streams video.

Exam tip

“Reduce latency for global users downloading images, videos, or web pages” and “cache content at edge locations” both mean CloudFront. “Serve a private S3 bucket’s content only through the CDN” means origin access control.

12.9 AWS Global Accelerator

AWS Global Accelerator also uses the AWS edge network, but in a different way. It gives your application two static anycast IP addresses. Users connect to the nearest edge location, and from there their traffic rides the AWS global network to your application endpoints (load balancers, EC2 instances, or Elastic IP addresses) in one or more Regions. Global Accelerator continuously checks endpoint health and shifts traffic to healthy endpoints within seconds.

CloudFront Global Accelerator
Main idea Cache contentat the edge Route traffic over AWS network
Caching Yes No
Protocols HTTP and HTTPS TCP and UDP
Entry point DNS name Two static IP addresses

Choose Global Accelerator for non-HTTP workloads such as gaming (UDP), IoT, or voice over IP, when clients need fixed IP addresses to allow-list, or for fast multi-Region failover.

12.10 Amazon API Gateway

Amazon API Gateway is a fully managed service for creating, publishing, securing, and monitoring APIs at any scale. It acts as the “front door” for applications to reach business logic running on AWS Lambda, EC2, containers, or other HTTP endpoints. It handles the undifferentiated work of an API: accepting and routing requests, authorization (for example with Amazon Cognito or IAM), throttling to protect your backend, caching, and monitoring. API Gateway supports REST APIs, lighter and cheaper HTTP APIs, and WebSocket APIs for real-time two-way communication such as chat apps. The classic serverless pattern on the exam is API Gateway + AWS Lambda + DynamoDB: no servers to manage anywhere.

12.11 Elastic Load Balancing (recap)

Elastic Load Balancing (ELB) distributes incoming traffic across multiple targets, such as EC2 instances, containers, IP addresses, and Lambda functions, in multiple Availability Zones. It performs health checks and stops sending traffic to unhealthy targets, and it scales automatically with demand. You met these types in the compute chapter (Chapter 9): Application Load Balancer (ALB): layer 7 (HTTP/HTTPS). Routes by URL path, host name, or headers. The usual choice for web applications and microservices.

Network Load Balancer (NLB): layer 4 (TCP/UDP/TLS). Extreme performance, very low latency, and static IP addresses per AZ.

Gateway Load Balancer (GWLB): deploys and scales third-party virtual appliances such as firewalls and intrusion detection systems.

Classic Load Balancer: previous generation; avoid for new designs.

Load balancers pair naturally with the rest of this chapter: Route 53 points your domain to the load balancer with an alias record, CloudFront can use the load balancer as its origin, and the load balancer sits in public subnets while its targets sit in private subnets.

Hands-on lab

Mini lab: build a two-AZ VPC with the VPC wizard

1. In the AWS Management Console, open VPC and choose Create VPC.
2. Under Resources to create, choose VPC and more.
3. Enter a name tag such as lab-vpc and keep the IPv4 CIDR block 10.0.0.0/16 .
4. Set Number of Availability Zones to 2, public subnets to 2, and private subnets to 2.
5. For NAT gateways, choose None to avoid hourly charges in this lab (production designs would use one per AZ).
6. For VPC endpoints, choose S3 Gateway, which is free.
7. Review the preview diagram, which shows the subnets, route tables, and internet gateway, then choose Create VPC.
8. Open Route tables and confirm that the public route table has a 0.0.0.0/0 route to the internet gateway while the private ones do not.
9. When finished, delete the VPC (from Your VPCs, choose Actions, Delete VPC) to clean up.

console (illustration) / VPC / Create VPC
Console Services Search services Region: Europe (Ireland)
VPC dashboard

Virtual private cloud

Security

Network ACLs

Security groups

Connectivity

Private subnets

NAT gateways
None v
VPC endpoints
S3 Gateway v
Preview

Vpc

Figure 12.6: A simplified VPC creation screen using the “VPC and more” option, with a preview of the resources it will create. (Illustration, not an actual AWS screenshot.)

12.12 Putting it together

Picture a global online store. Route 53 answers lookups for shop.example.com with latency-based records, sending each customer to the nearer of two Regions, and fails over if a Region’s health check fails. Product images come from CloudFront edge locations, with a private S3 bucket as the origin. Web requests hit an Application Load Balancer in public subnets, which spreads them across EC2 instances in private subnets in two AZs. Those instances reach the internet for updates through NAT gateways and reach S3 through a gateway endpoint. An Aurora database sits in private DB subnets, locked down by a security group that only admits the application tier. A Transit Gateway links this VPC with shared-services VPCs, and two Direct Connect links connect it to the company’s warehouse systems on premises. Every service in this chapter has a clear job, and on the exam your task is simply to match the job to the service.

Chapter 12 summary

A VPC is a logically isolated network in one Region that spans all of its AZs; each subnet lives in exactly one AZ. A subnet is public when its route table sends 0.0.0.0/0 to an internet gateway; private subnets use a NAT gateway for outbound-only internet access.

Security groups are stateful, allow-only, instance-level firewalls; network ACLs are stateless, subnet-level, and support deny rules.

VPC peering connects two VPCs one-to-one and is not transitive; Transit Gateway is a hub for many VPCs and on-premises networks. Gateway endpoints (S3, DynamoDB) and interface endpoints (PrivateLink) reach AWS services privately; PrivateLink also exposes your own services privately.

Site-to-Site VPN is quick, cheap, and encrypted over the internet; Client VPN serves individual users; Direct Connect is a private, dedicated, consistent connection that takes longer to set up.

Route 53 provides domain registration, DNS, health checks, and routing policies such as weighted, latency, failover, and geolocation.

CloudFront caches content at hundreds of edge locations; Global Accelerator provides static anycast IPs and routes TCP/UDP traffic over the AWS network without caching.

API Gateway is the managed front door for APIs; Elastic Load Balancing spreads traffic across healthy targets in multiple AZs.

Key terms
Term Meaning
VPC Your isolated virtual network in a Region
CIDR block IP address range, such as 10.0.0.0/16
Subnet Address range in one AZ insidea VPC
Route table Rules that direct traffic from subnets
Internet gateway Connectsa VPC to the internet
NAT gateway Outbound-only internet for private subnets
VPC peering Private one-to-one VPC connection
Transit Gateway Regional hub connecting many networks
VPC endpoint Privateaccess to AWS services
PrivateLink Private connectivity to services viainterfaces
Site-to-Site VPN Encrypted tunnels over the internet
Direct Connect Dedicated private line to AWS
Route 53 Managed DNS, domains, and health checks
CloudFront Content delivery network with edge caching
Global Accelerator Static anycast IPs over the AWS network
Practice questions

1. Which component must a VPC have, and be referenced in a route table, for resources in a public subnet to communicate with the internet?

A. NAT gateway B. Internet gateway
C. Virtual private gateway D. VPC endpoint

2. A company’s application servers run in private subnets and need to download operating system updates from the internet. They must not be reachable from the internet. What should the company use?

A. An internet gateway route in the private subnets’ route

table

B. A NAT gateway in a public subnet
C. A public IP address on each server D. VPC peering

3. A security engineer needs to block traffic from a specific malicious IP address range to all instances in a subnet. Which feature should be used?

A. Security group B. Network ACL
C. IAM policy D. Route table

4. Which statements about security groups are correct? (Choose two.)

A. They are stateful. B. They support explicit deny rules.
C. They operate at the instance (network interface) level. D. They are evaluated in rule-number order.
E. They apply to all instances in a Region automatically.

5. A company has 40 VPCs across several accounts and needs them, plus its on-premises network, to communicate through a central, scalable hub. Which service fits?

A. VPC peering B. AWS Transit Gateway
C. Amazon CloudFront D. AWS Client VPN

6. VPC A is peered with VPC B, and VPC B is peered with VPC C. What is true?

A. VPC A can reach VPC C through VPC B automatically. B. VPC A cannot reach VPC C unless A and C are peered directly or another solution is used.
C. Peering only works within one account. D. Peering traffic travels over the public internet.

7. EC2 instances in a private subnet must read objects from Amazon S3 without traffic going through a NAT gateway or the internet, at no additional charge. What should be used?

A. A gateway VPC endpoint for S3 B. AWS Direct Connect
C. Amazon CloudFront D. An internet gateway

8. A SaaS provider wants to offer its application privately to customers’ VPCs without VPC peering and without exposing the service to the internet. Which service should it use?

A. AWS PrivateLink B. AWS Global Accelerator
C. Amazon Route 53 D. NAT gateway

9. A company needs an encrypted connection between its data center and a VPC that can be set up today at low cost. Which option is best?

A. AWS Direct Connect B. AWS Site-to-Site VPN
C. VPC peering D. AWS Snowball

10. A media company transfers large volumes of data daily between its data center and AWS and needs consistent network performance that does not travel over the public internet. What should it choose?

A. AWS Site-to-Site VPN B. AWS Direct Connect
C. Amazon CloudFront D. AWS Client VPN

11. A company’s remote employees need to securely connect from their laptops to resources in a VPC. Which service is designed for this?

A. AWS Client VPN B. AWS Direct Connect
C. AWS Transit Gateway D. Amazon API Gateway

12. A company wants to send 10 percent of users to a new version of its website and 90 percent to the current version, using DNS. Which Route 53 routing policy should it use?

A. Simple B. Failover
C. Weighted D. Geolocation

13. A streaming service must show users in France content licensed for France, regardless of which AWS Region would respond fastest. Which Route 53 routing policy fits?

A. Latency-based B. Geolocation
C. Multivalue answer D. Weighted

14. Which Route 53 feature, combined with a failover routing policy, detects that the primary site is unavailable?

A. Hosted zones B. Health checks
C. Domain registration D. Alias records

15. A company serves images and videos from an S3 bucket in one Region to users around the world and wants to reduce latency. Which service should it use?

A. Amazon CloudFront B. AWS Direct Connect
C. Amazon Route 53 private hosted zone D. NAT gateway

16. A multiplayer game uses UDP and needs two static IP addresses that route players over the AWS global network to the healthiest Regional endpoint. Which service fits?

A. Amazon CloudFront B. AWS Global Accelerator
C. Application Load Balancer D. Amazon API Gateway

17. A development team wants to expose AWS Lambda functions to mobile apps as a secure, throttled REST API without managing servers. Which service should it use?

A. Amazon API Gateway B. Network Load Balancer
C. AWS PrivateLink D. Amazon Route 53

18. A web application needs a load balancer that routes requests to different target groups based on URL path, such as /images and /checkout . Which should it use?

A. Network Load Balancer B. Gateway Load Balancer
C. Application Load Balancer D. AWS Global Accelerator

Answers and explanations

1. B. An internet gateway attached to the VPC and targeted by a route in the subnet’s route table enables internet communication. A NAT gateway provides outbound-only access for private subnets, and a virtual private gateway is for VPN connections.
2. B. A NAT gateway in a public subnet gives private instances outbound internet access while blocking inbound connections. Routing private subnets to the internet gateway or adding public IPs would make the servers reachable.
3. B. Network ACLs support deny rules at the subnet level. Security groups only allow traffic, IAM policies control API permissions rather than network traffic, and route tables direct traffic rather than filtering it.
4. A, C. Security groups are stateful and attach to network interfaces of instances. They have allow rules only, are evaluated together rather than in order, and must be associated explicitly.
5. B. Transit Gateway is a hub that connects many VPCs and on-premises networks at scale. Peering 40 VPCs would require hundreds of connections and is not transitive.
6. B. VPC peering is not transitive, so A and C need their own peering or a hub such as Transit Gateway. Peering works across accounts and Regions and stays on the AWS network.
7. A. A gateway endpoint for S3 keeps traffic on the AWS network and has no additional charge. Direct Connect is for on-premises connectivity, CloudFront is a CDN, and an internet gateway would use the internet.
8. A. PrivateLink lets providers expose services to consumers’ VPCs through interface endpoints, privately and without peering. The other services do not provide this private service exposure.
9. B. Site-to-Site VPN uses encrypted IPsec tunnels over the internet and can be set up quickly and cheaply. Direct Connect takes weeks and is not encrypted by default; peering connects VPCs, not data centers.
10. B. Direct Connect provides a dedicated private connection with consistent performance. A VPN uses the public internet, CloudFront is a CDN, and Client VPN is for individual users.
11. A. AWS Client VPN is a managed service for individual users to connect securely from their devices. Direct Connect and Transit Gateway connect networks, and API Gateway publishes APIs.
12. C. Weighted routing splits traffic by assigned weights such as 90/10. Simple routing has no traffic split, failover is active-passive, and geolocation routes by user location.
13. B. Geolocation routing answers based on the user’s location, which supports licensing and language requirements. Latency-based routing optimizes speed and might choose a different Region.
14. B. Route 53 health checks monitor endpoints so failover routing can switch to the secondary. Hosted zones hold records, and alias records point to AWS resources but do not detect failure by themselves.
15. A. CloudFront caches content at edge locations near users, reducing latency. Direct Connect links on-premises networks, a private hosted zone only works inside VPCs, and NAT gateways handle outbound traffic.
16. B. Global Accelerator provides two static anycast IPs, supports UDP, and routes over the AWS global network with health-based failover. CloudFront focuses on HTTP caching, and an ALB is a regional layer 7 load balancer.
17. A. API Gateway is a managed service to create, secure, and throttle APIs in front of Lambda. A Network Load Balancer does not provide API features such as throttling and authorization, and PrivateLink is for private connectivity.
18. C. An Application Load Balancer works at layer 7 and supports path-based routing. NLB works at layer 4, GWLB is for virtual appliances, and Global Accelerator is not a path-based router.