Amazon CLF-C02: Networking & Content Delivery — Study Guide
Part of the AWS Cloud Practitioner CLF-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
VPC fundamentals and design patterns
A Virtual Private Cloud (VPC) is the foundational network construct: it defines IP address space, subnets, route tables, and gateways that determine how resources communicate internally and to the internet. Good VPC design segments workloads into public subnets for internet-facing services and private subnets for application and data layers, with route tables that control north–south traffic. Internet Gateway (IGW) enables IPv4 internet access for public subnets, while NAT Gateway or NAT instance provides outbound internet for private subnets; NAT Gateway is managed and scales automatically but carries hourly and per‑GB processing charges, whereas NAT instances require patching and capacity planning. Route propagation, explicit routes, and use of egress-only internet gateways for IPv6 are core concepts. VPC endpoints—gateway endpoints for S3 and DynamoDB and interface endpoints (PrivateLink) for many AWS APIs—let you avoid internet egress and reduce data‑transfer costs. Common practitioner traps include misconfigured route tables that leave subnets isolated, overuse of NAT instances, and failing to architect for AZ-level redundancy; ensure route tables, IGW/NAT, and health-aware placements remove single points of failure while keeping data transfer cost and performance in mind. Consider EC2 pricing models (on‑demand, Reserved Instances, Savings Plans) when right‑sizing compute across AZs to control cost while meeting availability goals.
Hybrid connectivity and global networking
Connecting on‑premises environments to AWS requires tradeoffs between cost, latency, redundancy, and operational complexity. Site‑to‑Site VPNs are quick to deploy and encrypted over the internet, suitable for low to moderate bandwidth or as backup. AWS Direct Connect provides a private, predictable, low‑latency link and is priced by port‑hour plus data transfer; it suits high‑throughput steady workloads but needs colo and circuit procurement. Transit Gateway simplifies multi‑VPC and hybrid connectivity by centralizing routing and scaling better than many VPC peering links, though it adds per‑attachment and per‑GB charges; VPC peering remains useful for point‑to‑point low-latency VPC connectivity without transitive routing. Use redundant DX connections routed across different locations or combine DX with VPN for resiliency. Route 53 supports global DNS policies (latency, geolocation, failover) to direct users and provide health checks. Practitioner decision criteria hinge on bandwidth predictability, required SLAs, and cost: prefer Direct Connect for high, consistent egress and Transit Gateway for many VPCs to avoid N^2 peering complexity, but budget for DX port fees and Transit Gateway attachments.
Content delivery and global traffic management
Amazon CloudFront is a serverless, global content delivery network (CDN) whose primary purpose is to cache static and dynamic content at edge locations to reduce latency and origin load. CloudFront supports HTTP(s) and integrates with S3, ALB, API Gateway, and custom origins, and can execute code at the edge via Lambda@Edge or fast functions via CloudFront Functions. S3 Transfer Acceleration leverages edge locations and the AWS backbone specifically to speed uploads to S3 from distant clients and is billed per‑GB and by region. AWS Global Accelerator provides static anycast IPs and optimizes TCP/UDP traffic across the AWS global network for non‑HTTP or latency‑sensitive applications; it does not cache content. Choose CloudFront when caching and origin offload produce cost and performance gains; choose Global Accelerator when you need deterministic, optimized routing for TCP/UDP and a fixed entry IP. Pricing differences matter: CloudFront charges per request and per GB with tiered discounts, and Global Accelerator charges an hourly accelerator fee plus data transfer. A common trap is expecting Global Accelerator to provide caching—use it for routing and failover, CloudFront for caching.
Network security, observability, and operational controls
Network security in AWS is layered: security groups are stateful, instance‑level firewalls that control allowed inbound/outbound traffic; network ACLs are stateless, subnet‑level controls for coarse filtering. AWS Network Firewall and managed WAF rules protect against protocol and application threats, while AWS Shield protects against DDoS—Shield Standard is automatic, Shield Advanced adds protections and cost recovery. VPC Flow Logs capture traffic metadata for troubleshooting and audit, and centralizing logs to CloudWatch Logs or S3 supports incident response and compliance. Use PrivateLink and VPC endpoints to minimize public exposure of sensitive APIs, and apply least‑privilege with endpoint policies and IAM. Operational controls include health checks with ELB and Auto Scaling to maintain healthy EC2 fleets, and Route 53 health checks for DNS failover. Typical pitfalls include overly permissive security groups, reliance on NACLs as the main defense, neglecting flow logs or WAF for web workloads, and unexpected data transfer charges when crossing AZs or using internet egress. Design for defense in depth, enable observability early, and model costs for NAT/egress and cross‑AZ traffic.
Practical Problem: Use-Case Scenario
Scenario: AcmeRetail runs a three‑AZ VPC with an application tier on EC2 behind an Application Load Balancer, S3 for static assets, and a legacy data center connected to AWS. They need lower latency for global customers, secure on‑prem connectivity for order processing, and predictable transfer costs for heavy nightly backups.
Challenge: Reduce global user latency for static and dynamic content, secure and stabilize on‑prem connectivity for high throughput backups, and minimize surprise egress fees.
Recommended Approach:
- Deploy Amazon CloudFront with S3 and the ALB as origins to cache static assets and accelerate dynamic responses, enabling origin shield and Lambda@Edge for header-based routing.
- Provision AWS Direct Connect with redundant links and use a Transit Gateway to centralize routing between VPCs and the Direct Connect gateway; keep Site‑to‑Site VPN as failover.
- Configure VPC endpoints (gateway for S3, interface endpoints where needed) to route backups to S3 over the AWS backbone and avoid public internet egress charges.
- Implement Route 53 latency routing and health checks, enable VPC Flow Logs, WAF on the ALB, and use Auto Scaling groups with ELB health checks to maintain healthy EC2 capacity.
Rationale: Edge caching via CloudFront reduces latency and origin load; Direct Connect plus Transit Gateway gives predictable bandwidth and centralized routing for hybrid backup traffic; endpoints and proper routing minimize internet egress and costs while observability and managed security services provide operational resilience and defense in depth.
← Core Database Services · All domains · Security →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →