Networking, Content Delivery and Hybrid Connectivity

Domain 3 (Cloud Technology and Services) carries 34% of the scored content on CLF-C02, and its task 3.5: "Identify AWS network services": is the most mechanical block of knowledge on the exam. Everything in it is a definition plus a rule: a subnet lives in exactly one Availability Zone, a public subnet is a routing decision rather than a checkbox, a NAT gateway is outbound-only, a security group is stateful while a network ACL is stateless, VPC peering is not transitive, and Direct Connect is dedicated with consistent bandwidth. Add task 3.3's "purposes of load balancers", task 3.2's edge locations, and you have a lesson where nearly every question has exactly one defensible answer: provided you memorised the rules instead of the marketing.

In this lesson you will:

• name every VPC component: subnets, route tables, internet gateways, NAT gateways, Elastic IPs, elastic network interfaces;
• decide public versus private from the route table alone, and explain why NAT is outbound-only;
• separate the default VPC from a custom VPC and know when AWS tells you to build your own;
• win security group versus network ACL on every axis: scope, rule action, state, evaluation, defaults and referencing;
• apply the non-transitive peering rule and the no-edge-to-edge rule;
• choose gateway endpoint vs interface endpoint vs PrivateLink: including the free one;
• separate Site-to-Site VPN from Direct Connect on provisioning time, bandwidth consistency and encryption;
• use Route 53 hosted zones, all eight routing policies and health checks;
• put CloudFront in front of a private S3 origin with Origin Access Control;
• pick ALB over NLB, and know why the Classic Load Balancer is the "previous generation";
• state the Global Accelerator one-liner and the four-way edge choice;
• audit the idle-cost traps: NAT gateways, Elastic IPs, disabled accelerators, Direct Connect ports;
• study four AWS-published case studies, then practise with 12 exam-style questions plus four interactive checks.

---

1. The VPC: an isolated network you design

1.1 The component set

Amazon VPC is a "logically isolated virtual network" that you define inside a Region, and AWS states there is no additional charge for using a VPC (as of Oct 2026). Task 3.5 asks you only to identify the components, but the exam's wording assumes you know exactly what each component does.

1.2 Public versus private is a routing decision

A subnet has no "public" attribute. It is public if and only if its route table carries a route to an internet gateway; otherwise it is private. That single sentence answers more CLF-C02 items than any other networking fact, because it dissolves three related traps at once:

• attaching an IGW to the VPC does not make any subnet public; you still need the route;
• a private subnet with a route to a NAT gateway is still private: NAT gives it outbound internet, not inbound;
• a public subnet with no instances holding public IPv4 addresses is still public; it simply has nothing to route out.

1.3 The NAT gateway is outbound-only

AWS is explicit about the direction: with a NAT gateway in place, "external services can't initiate a connection" with your private instances. A private instance can therefore pull operating-system updates, download packages and call AWS APIs, while nothing on the internet can reach in to it. If a question needs inbound internet traffic to a private workload, the answer is an internet-facing load balancer (or a genuinely public instance): never "open the NAT gateway".

The cost shape matters too (US East Ohio, as of Oct 2026; verify current before use): $0.045 per hour plus $0.045 per GB processed, billed in one-hour increments for partial hours, and a regional NAT gateway is deployed per Availability Zone, so a two-AZ design pays the hourly charge twice.

1.4 The default VPC versus a custom VPC

AWS creates a default VPC in every Region, and it is ready to launch into:

That convenience is exactly why AWS recommends a custom VPC for production: only in a custom VPC do you choose the CIDR, decide which subnets are private, control the routes and decide what is exposed. On the exam, "launch into the default VPC" is a prototyping answer, never an architecture answer.

• 📚 Did you know? Public IPv4 addresses cost money even when idle, $0.005 per hour in use or unused, which is $3.65 per month per address across a 730-hour month (as of Oct 2026; verify current before use). Private IPv4 addresses are never charged, and the Free Tier includes 750 hours per month of public IPv4 with Amazon EC2. Four forgotten, unattached Elastic IPs therefore cost roughly $14.60 per month for absolutely nothing, a line item the exam loves to disguise inside a cost-optimization question.

1.5 Example E1: the three-tier VPC, end to end

Scenario. A web application must be reachable from the internet, must call out to the internet for updates, and must hold a database that is never directly reachable. Design it the way the exam expects.

1.6 Example E2: the NAT bill

A two-AZ design runs two NAT gateways for 730 hours, egresses 500 GB through NAT processing, and sends a further 500 GB out to the internet at $0.09 per GB (as of Oct 2026; verify current before use):

$$2 \times 730 \times 0.045 = 65.70, \quad 500 \times 0.045 = 22.50, \quad 500 \times 0.09 = 45.00$$ $$\text{Total} = 65.70 + 22.50 + 45.00 = \$133.20 \text{ per month}$$

The lesson is not the arithmetic, it is the three separate charges: hourly, NAT processing per GB, and internet data transfer out. Any option that quotes a single-charge total is testing whether you noticed all three.

---

2. Security groups versus network ACLs: the classic item

Task 3.5 says "Understanding security in a VPC (network ACLs, security groups, Amazon Inspector)". The security-group-versus-NACL comparison is the most reliable networking question on CLF-C02, and it is decided on seven axes.

Two consequences follow from the state row alone. With a stateful security group you open 443 inbound and the replies flow back untouched. With a stateless NACL you must also allow the ephemeral return ports, or the connection never completes: the classic "my NACL broke my application" failure.

2.1 The packet walk

2.2 Defaults are permissive, not secure

• The default security group allows all outbound and inbound only from itself: usable, but not a security posture.
• The default network ACL allows all traffic in and out.

And the rule students forget most often: security groups cannot deny. If a question demands that you block one partner CIDR regardless of what instance rules permit, the answer is a network ACL deny rule (or an IAM / bucket-policy deny): never "add a deny rule to the security group".

2.3 Example E3: deny one CIDR, subnet-wide

Scenario. The partner network 203.0.113.0/24 must be blocked from reaching an entire subnet immediately, without touching a single instance.

• 📚 Did you know? A security group rule can reference another security group instead of an IP range, that is how the tiered pattern in Example E1 works with zero hard-coded CIDRs, and why moving an application tier to a new subnet requires no rule edits at all. Network ACLs, by contrast, are subnet-bound and IP-based by nature. Both remain free of charge (as of Oct 2026; per-account and per-VPC quotas apply, verify current before use).

---

3. VPC peering: pairwise, never transitive

VPC peering is a private network connection between two VPCs that lets instances in one behave "as if they were in the same network". AWS is unusually blunt about its limits, and those limits are the exam.

3.1 Example E4: the peering trap

Scenario. VPC A is peered to VPC B, and VPC A is also peered to VPC C. A new service in B must reach a service in C.

Transit Gateway is charged per attachment ($0.05 per attachment-hour ≈ $36.50/month) plus $0.02 per GB processed, with an MTU of 8500 bytes (as of Oct 2026; verify current before use). Six attachments plus 1 TB of processing works out to:

$$6 \times 0.05 \times 730 + 1024 \times 0.02 = 219.00 + 20.48 = \$239.48 \text{ per month}$$

Peering is free but pairwise; the hub costs money but scales. "How do these VPCs talk?" is answered by counting them: two → peering, many plus on-premises → Transit Gateway.

• 📚 Did you know? Peering has no hourly charge but is not free of data transfer charges: same-AZ traffic through a peering connection is free, while cross-AZ traffic is $0.01 per GB (as of Oct 2026; verify current before use). A "free peering" option in a cost question is therefore only half true, and an unaccepted peering request silently expires after 7 days, which is exactly the kind of operational detail AWS likes to bury in a distractor.

---

4. VPC endpoints and PrivateLink: reaching AWS without the internet

An AWS service you reach through the public internet needs a NAT gateway or an internet gateway. A VPC endpoint gives your VPC a private path to the service instead, and the two endpoint types differ on precisely the axes the exam asks about.

AWS PrivateLink is the technology behind interface endpoints: consumers reach a provider's service "as if they were in your VPC", traffic never leaves the AWS network, and consumers cannot see each other. Note the boundary: PrivateLink exposes a service, not a whole VPC: for whole-VPC connectivity the answer is still peering or Transit Gateway.

4.1 Example E5: gateway versus interface endpoint arithmetic

A workload in three Availability Zones processes 200 GB per month to Amazon S3.

$$\text{Interface endpoint} = 3 \times 730 \times 0.01 + 200 \times 0.01 = 21.90 + 2.00 = \$23.90 \text{ per month}$$ $$\text{Gateway endpoint for S3} = \$0.00 \text{ per month}$$

Same destination, same traffic: $23.90 versus nothing (as of Oct 2026; verify current before use). That gap is the entire exam point: if the service is S3 or DynamoDB, the gateway endpoint is the default answer, and "create an interface endpoint to reach S3" is the distractor.

4.2 Example E6: the private-subnet S3 pattern

Scenario. Instances in a private subnet must read objects from a bucket: no public IP, no NAT gateway, no internet path.

1. Create a gateway VPC endpoint for S3 in the VPC.
2. Accept the route it adds to the subnet's route table (the prefix-list route).
3. Scope an endpoint policy to exactly what is needed, for example s3:GetObject.
4. Leave the bucket private: the traffic never leaves the Amazon network.

Result: zero hourly charge, zero per-GB charge, no NAT gateway to pay for, and no inbound exposure. This is the canonical "reduce NAT costs" answer.

4.3 Scenario: the SaaS provider's private service

A provider wants to sell one internal microservice to several customer accounts without publishing it to the internet.

Contrast on the exam: a public API → API Gateway; whole VPCs talking to each other → peering or Transit Gateway; one service, privately, many accounts → PrivateLink.

---

5. Hybrid connectivity: Site-to-Site VPN versus Direct Connect

Task 3.5 names the pair directly: "Identifying network connectivity options to AWS (AWS VPN, AWS Direct Connect)". One is fast and encrypted over the internet; the other is dedicated, consistent and not encrypted by default.

Related in-scope options: AWS Client VPN for individual remote users (managed OpenVPN), and AWS VPN CloudHub for hub-and-spoke routing among several Site-to-Site VPN connections. AWS Transit Gateway is the answer when the requirement is many VPCs and on-premises networks inside one hub.

5.1 Example E7: DX versus VPN, the price of consistency

For a full 730-hour month (as of Oct 2026; verify current before use):

Neither number is "the right answer" by itself. The exam wants you to read the requirement: "dedicated private connection with consistent bandwidth" → Direct Connect; "encrypted tunnel, established quickly" → Site-to-Site VPN; "laptop" → Client VPN; "many VPCs plus on-premises" → Transit Gateway.

• 📚 Did you know? Every Site-to-Site VPN connection offers two VPN tunnels, which is why "configure both tunnels" is the standard high-availability answer: AWS documents the per-tunnel ceiling as up to 1.25 Gbps, so a single tunnel is never sold as a guaranteed 1.25 Gbps of application throughput (as of Oct 2026; verify current before use). Direct Connect ports, meanwhile, bill whether or not traffic flows: an idle 10 Gbps port still costs about $1,642.50 per month.

---

6. Amazon Route 53: DNS, hosted zones, routing policies and health checks

Task 3.5 says only "Understanding the purpose of Amazon Route 53", but AWS defines that purpose as three functions in one service: a highly available, scalable Domain Name System (DNS) web service, domain name registration, and health checking.

6.1 Hosted zones

A hosted zone is a container for records.

Two record rules are exam staples: a CNAME cannot sit at the zone apex (the root of the domain) while an alias record can, and alias records that point at AWS targets, load balancers, CloudFront distributions, S3 website endpoints, incur no charge for the queries.

Standard query pricing, if you need it (as of Oct 2026; verify current before use): $0.40 per million standard queries, $0.60 per million for latency, $0.70 per million for geolocation and geoproximity, $0.80 per million for IP-based routing.

6.2 The eight routing policies

6.3 Health checks drive failover

A Route 53 health check monitors "the health and performance of your resources" and can be pointed at an endpoint, another health check, or a CloudWatch alarm. Its two exam jobs: drive DNS failover and filter multivalue answer records so that only healthy ones are returned.

Charging (as of Oct 2026; verify current before use): the first 50 AWS-endpoint health checks are free, then $0.50 per month for AWS endpoints or $0.75 per month for non-AWS endpoints; while checks against Elastic Load Balancing endpoints and S3 website endpoints are free and automatic.

6.4 Example E8: the global storefront

Scenario. A storefront needs low latency worldwide, a private S3 origin, EU data residency and a disaster-recovery path.

• 📚 Did you know? Multivalue answer routing returns up to eight healthy records at random: a detail AWS states explicitly, and the reason the policy is sometimes described as a poor person's load balancer. It still cannot do what a real load balancer does: no cross-zone balancing logic, no connection draining, no Layer 7 rules. When the stem mentions path-based routing or health-checked target groups, the answer is Elastic Load Balancing, not Route 53.

---

7. Amazon CloudFront and edge locations

Task 3.2 names edge locations and the benefits of edge locations. CloudFront is built on a "worldwide network of data centers called edge locations": the nearest edge location serves a cached copy, which produces lower latency, higher data-transfer rates and better reliability for viewers.

7.1 The private S3 pattern, and the two wrong versions

7.2 Example E9: the CloudFront bill

A site delivers 2 TB (2,048 GB) and 30 million HTTPS requests in a month from the United States (as of Oct 2026; verify current before use). The free allowance absorbs 1 TB and 10,000,000 requests:

$$\text{Data transfer} = (2048 - 1024) \times 0.085 = 1024 \times 0.085 = \$87.04$$ $$\text{Requests} = \frac{30{,}000{,}000 - 10{,}000{,}000}{10{,}000} \times 0.0100 = 2{,}000 \times 0.0100 = \$20.00$$ $$\text{Total} = 87.04 + 20.00 = \$107.04 \text{ per month}$$

Note what is not in that bill: origin fetches from S3 are $0, and the first 1,000 invalidation paths are free. The recurring exam line is that CloudFront in front of S3 saves money on the origin side while charging at the edge.

• 📚 Did you know? CloudFront prices HTTPS requests separately from HTTP: $0.0100 versus $0.0075 per 10,000 requests after the free allowance (as of Oct 2026; verify current before use). For 20 million post-free-tier requests that difference alone is $5.00 per month, which makes "force HTTPS" simultaneously a security answer and a pricing observation. And because origin fetches are free with AWS origins, an origin that is already an S3 bucket never charges you twice for the same bytes.

---

8. Elastic Load Balancing: ALB versus NLB

Task 3.3 requires "Identifying the purposes of load balancers". AWS's own definition of that purpose is one sentence with two halves: a load balancer distributes traffic across targets in at least one Availability Zone and routes traffic only to the healthy targets.

Three rules decide most ELB questions:

1. "URL path" / "host header" / "HTTP method" / "AWS WAF" → ALB.
2. "Static or fixed source IP" / "UDP" / "millions of requests per second" → NLB.
3. "Previous generation" / "migrate" → Classic Load Balancer.

And one counter-intuitive fact: both internet-facing and internal load balancers reach their targets over private IP addresses (as of Oct 2026). "Internet-facing" describes the load balancer's own endpoint, not the path to your instances, so a multi-tier design is internet-facing ALB → web tier → internal ALB → application tier.

8.1 Example E10: ALB versus NLB arithmetic

For a full 730-hour month (as of Oct 2026; verify current before use):

The NLB is cheaper here, but a cheaper bill is never the answer to "which load balancer do I need?". Choose by capability first (Layer 7 rules and WAF → ALB; static IPs and UDP → NLB), then read the bill.

• 📚 Did you know? An Elastic Load Balancing DNS entry has a TTL of 60 seconds, which is why replacing an entire fleet behind a load balancer propagates in about a minute rather than instantly: a rare case where the exam expects you to know that DNS, not the load balancer, is the slow part. Separately, the ALB requires at least two enabled Availability Zones (as of Oct 2026), so an ALB inside a single-AZ VPC is an invalid configuration by design, not a cost saving.

---

9. AWS Global Accelerator and the four-way edge choice

The one-liner to memorise: Global Accelerator gives you two static anycast IPv4 addresses announced from AWS edge locations, then carries TCP and UDP traffic over the AWS global network to the nearest healthy regional endpoint: an ALB, NLB, EC2 instance or Elastic IP. It is a fixed entry point with fast failover and no caching, built for non-cacheable TCP/UDP workloads such as gaming, IoT and VoIP.

9.1 Example E11: the disabled accelerator still bills

An accelerator is created, tested, then disabled for a full 730-hour month with zero traffic (as of Oct 2026; verify current before use):

$$\text{Accelerator} = 0.025 \times 730 = \$18.25, \qquad \text{Two static IPs} = 2 \times 0.005 \times 730 = \$7.30$$ $$\text{Total with zero traffic} = 18.25 + 7.30 = \$25.55 \text{ per month}$$

Two exam habits come out of this: "disabled" does not mean "free", and any static address, Elastic IP or Global Accelerator IP, is an ongoing charge. Paired with Example E2's NAT gateway and Example E7's idle Direct Connect port, these form the exam's idle-resource trap family.

• 📚 Did you know? The four-way choice collapses to one question: does the client need a cache or a fixed IP? Cacheable web content → CloudFront; a fixed IP for non-cacheable TCP/UDP → Global Accelerator; a human-readable name → Route 53; spreading a regional workload across targets by health → Elastic Load Balancing. Global Accelerator's per-GB data-transfer premium varies by Region and edge, and AWS publishes the accelerator hourly rate but not a single flat per-GB figure: treat any specific per-GB Global Accelerator number as unverified.

---

10. Network cost: what is free and what quietly bills you

Half of Domain 3's pricing questions concern services that are free by design, and the other half concern resources that bill while idle.

The trap family is consistent: a question describes a quiet, unused, or deleted-but-still-attached resource and asks for the monthly impact. The pattern to memorise is:

---

11. 2026 updates that touch networking, edge and data transfer

2026 Updates (as of October 2026)

• 📚 Did you know? The 100 GB per month free data-transfer-out allowance is routinely described in newer prep material as a 2025 Free Tier change; it is not. AWS published it in 2021 (effective 2021-12-01) and it is still current as of Oct 2026; the genuinely new mechanism is the approval-based move-off credit with a 90-day window for customers migrating away from AWS entirely. Three different numbers: 100 GB out of a Region, 1 TB through CloudFront, 90 days to leave: describe three different rules, and only the first two are monthly allowances.

---

Real-World Case Studies

AWS publishes what these patterns look like in production. Every figure below is customer- or AWS-claimed and unaudited, quoted with its source so you can check it: the examinable point is the pattern (which edge service was chosen, which data-transfer charge was engineered away, which failover was automated), not the marketing number.

Case A, Amazon Prime Video, Thursday Night Football: six Regions and an edge CDN

Exam lesson: the question is never "how many fans", it is which service did the delivery work. When the stem is about caching objects near global viewers, the answer is CloudFront edge locations; when it is about the origin surviving a Regional failure, the answer is multi-AZ plus multi-Region with health checks. Live video that cannot be cached belongs to the same family, that is where Global Accelerator (static IPs, no caching) earns its one-liner.

Case B, Box: $2.23 million found in the data-transfer bill

Exam lesson: Box's two networking lines, $438,000 of inter-AZ transfer and $1.1 million of egress, are the same arithmetic as Example E2's NAT bill and Example E9's CloudFront bill, just at enterprise scale. The pattern: keep traffic inside an Availability Zone where possible, use a gateway endpoint instead of NAT for S3, and let CloudFront absorb the public egress: its origin fetches are free with AWS origins.

Case C, Capital One: Route 53 failover and automated Regional recovery

Exam lesson: when the stem says the primary fails its health check and the secondary must answer, the answer is Route 53 failover routing plus a health check (Section 6.2), and the case is what that looks like at enterprise scale. Two qualifiers travel with it: multi-Region protects a Region, multi-AZ protects an AZ; they are different requirements; and because a DNS answer is cached for its TTL, "recovery in minutes" is a designed outcome, not a DNS-failover instant. When a stem demands sub-second failover, the answer is still Global Accelerator or an Elastic Load Balancing health check (Section 6.3).

Case D, athenahealth: hundreds of VPCs behind one Transit Gateway hub

Exam lesson: a case study's service list is not the exam's in-scope list. The names on this page include AWS Network Firewall, which now sits on the CLF-C02 out-of-scope list (as of Oct 2026), so it can only appear as a distractor; while the same paragraph names Transit Gateway and Direct Connect, both squarely in scope. Read the paragraph for the pattern (centralize the hub, fan out one policy), then answer only with in-scope services.

• 📚 Did you know? The current exam guide added four networking services that the launch-era V1.0 guide did not list, AWS PrivateLink, AWS Transit Gateway, AWS Site-to-Site VPN and AWS Client VPN, and moved AWS Network Firewall out to the out-of-scope list (in-scope and out-of-scope service lists, accessed Oct 2026). Revision notes written before those lists were rebuilt will tell you the opposite, which is why the guide you download today is the only authority on what is examinable.

What the two cases share

What cases C and D add

---

Practice Questions