Amazon DOP-C02: Networking and Content Delivery — Study Guide

By Laurynas Brazys · 4 August 2026 · #amazon #dop-c02 #certification #exam-prep #study-guide

Part of the AWS DevOps Engineer Professional DOP-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.

Overview

Networking and content delivery on AWS span foundational VPC constructs, interconnect choices for multi-account and hybrid topologies, and edge services that front, protect, and accelerate applications globally. Mastery requires understanding of how packets move in a VPC (subnets, route tables, gateways, and filtering), how to interconnect VPCs and on-premises networks (peering, Transit Gateway, PrivateLink, Direct Connect, VPN), and how to distribute and protect traffic at the edge (CloudFront, AWS WAF, AWS Global Accelerator). Application entry points such as Amazon API Gateway then integrate with these primitives through custom domains, certificates, and endpoint types.

VPC Architecture and Security Controls

A VPC is a regional, logically isolated network with one or more subnets in each Availability Zone. Design subnets along fault domains and functions: public subnets for internet-facing load balancers and NAT gateways; private application subnets for EC2/ECS/EKS nodes; and private data subnets for databases. Assign distinct route tables per subnet type to keep intent explicit and to support zonal egress design.

Internet connectivity is provided by an internet gateway (IGW) attached at the VPC level. A subnet becomes “public” when its route table has a default route to the IGW and resources have public IPs or Elastic IPs. For outbound-only internet access from private subnets, use NAT gateways. Place one NAT gateway per Availability Zone, route each private subnet to the NAT gateway in the same AZ, and disable cross-AZ NAT to avoid single points of failure and to reduce cross-AZ data processing charges. For IPv6, egress-only internet gateways provide outbound-only connectivity without NAT.

Route tables determine next hops for destination prefixes. Common targets include IGW, NAT gateway, VPC peering attachments, Transit Gateway attachments, and local. Keep route tables simple: a default route for egress and explicit routes for private interconnects. Prefer prefix lists to reference shared destinations across accounts and to reduce human error.

Security groups and network ACLs provide network filtering, but with different mechanics:

Security groups are stateful, attached to ENIs, and evaluated only for allow rules. Return traffic is automatically allowed. They support references to other security groups to express application topology securely.
Network ACLs are stateless, applied at the subnet boundary, evaluated by rule order with explicit allow/deny for inbound and outbound. Return traffic must be explicitly allowed. Use NACLs sparingly for coarse subnet-level deny or compliance patterns; maintain the ephemeral port ranges required by your operating systems and load balancers.

Stateful vs stateless filtering matters for troubleshooting. If both are used, both must permit the flow. Enable VPC Flow Logs to CloudWatch Logs or S3 to analyze accepted/denied traffic and to validate security posture.

Inter-VPC and Hybrid Connectivity

VPC peering connects two VPCs privately with no single point of failure and no bandwidth bottleneck, but it is non-transitive and requires non-overlapping CIDRs. Each VPC must add static routes for the peer via the peering attachment. Security group references across peered VPCs are not supported; filter with CIDRs. Cross-Region peering is available and encrypted by default.

AWS Transit Gateway (TGW) simplifies network scale and segmentation. It acts as a regional hub for VPCs and hybrid attachments, supports transitive routing, and scales to tens of Gbps per attachment. Use TGW route tables to implement segmentation (e.g., dev vs prod vs shared services) and to control propagation and association. Attachments include VPCs, Site-to-Site VPNs, and Direct Connect via a Transit VIF and Direct Connect Gateway. For centralized egress, attach an egress VPC and propagate/selectively share routes. Plan for multi-Region by connecting TGWs with inter-Region peering.

AWS PrivateLink provides consumer-initiated, private, L4 access to services across VPC/account/Region boundaries without exposing provider subnets or requiring routing. The service provider places an NLB in front of endpoints; consumers create interface VPC endpoints in their VPCs with assigned private IPs and DNS names. PrivateLink is not transitive and supports only TCP. Use PrivateLink to publish internal services or to consume AWS services privately. Prefer PrivateLink over peering/TGW when you need service-level exposure, DNS-based consumption, or tighter producer isolation.

Hybrid connectivity often blends Direct Connect (DX) and Site-to-Site VPN. Direct Connect provides dedicated, private, consistent bandwidth with 1/10 Gbps ports (and hosted capacities). Use BGP for dynamic routing and failover. Virtual interface (VIF) types:

Private VIF: private IP reachability to VPCs via a virtual private gateway (VGW) or via a Transit Gateway with Transit VIF.
Public VIF: public IP reachability to AWS public services; advertise your public prefixes; AWS advertises its global public prefixes.
Transit VIF: connects a Direct Connect gateway to one or more TGWs for scalable multi-VPC/multi-Region connectivity. Design redundancy using two physical DX connections in separate DX locations and devices, with separate LAGs if needed, and dual routers on-premises. Add a VPN as backup (VPN over the internet to VGW or TGW) with BGP so routes fail over automatically when DX BGP sessions drop. For VPN, use two tunnels per connection for HA; prefer BGP over static routes; validate inside tunnel CIDRs and security.

Edge Networking, Security, and Acceleration

Amazon CloudFront is a global CDN that accelerates static and dynamic content with edge caching and optimized network paths. A distribution defines:

Origins: S3, custom origins (ALB/NLB/EC2/API Gateway), or origin groups for failover. Enable Origin Shield for an extra mid-tier cache to reduce origin load.
Behaviors: path- and method-based routing to origins, cache and origin request policies (headers/cookies/query forwarding), viewer protocol policies (HTTP→HTTPS), compression, signed URLs/cookies, and function hooks (CloudFront Functions for lightweight viewer requests; Lambda@Edge for request/response manipulation).
Caching: tune TTLs via cache policies, vary keys only on necessary dimensions, and use origin request policies to minimize cache fragmentation. For APIs, avoid forwarding unnecessary headers/cookies/queries. Use field-level encryption where needed.
Invalidation: issue invalidations for changed paths or use versioned object keys for zero-downtime cache updates. Automate invalidations post-deploy for non-versioned assets.

AWS WAF protects applications at L7. A web ACL contains rules and rule groups evaluated in order, with a default action. Use AWS Managed Rules for baseline protections (e.g., CommonRuleSet, WordPress, SQLi/XSS), and curated partner rule groups when needed. Add custom rules using match statements (IP set, header, URI, body JSON, label matching), and combine with logical operators. Rate-based rules throttle clients that exceed a configured request rate in a window, optionally with scope-down statements to target specific paths or headers. Associate web ACLs with CloudFront distributions, Application Load Balancers, API Gateway (REST/HTTP), and AppSync. Monitor capacity (WCU), enable sampled logs to CloudWatch Logs or Kinesis Data Firehose, and use CAPTCHA/Challenge actions to mitigate bots without blocking legitimate traffic.

AWS Global Accelerator provides static anycast IPs that front regional endpoints and accelerates TCP/UDP traffic over the AWS global network. It operates at L4/7 with health-based routing and rapid failover. Configure:

Endpoint groups per Region with health checks and weights.
Traffic dials to control the percentage of traffic sent to a Region (e.g., 1% canary or 0% during maintenance) independent of endpoint weights. Supported endpoints include ALB, NLB, EC2 instances, and Elastic IPs. Use Global Accelerator for non-HTTP or latency-sensitive, stateful protocols, or when static IPs and deterministic failover are required. CloudFront remains the primary choice for HTTP/S caching and function execution at the edge; the two are complementary.

API Front Doors: Domains, Certificates, and Endpoint Strategy

Amazon API Gateway provides REST and HTTP APIs with three endpoint types:

Edge-optimized (REST APIs only): API Gateway creates and manages a CloudFront distribution; optimal for global clients with TLS termination at edge locations. Custom domain certificates must be in us-east-1 (N. Virginia) via ACM.
Regional: clients in the same Region or when you want to front API Gateway with your own CloudFront distribution or Global Accelerator. Custom domain certificates must be in the same Region as the API.
Private: reachable only within your VPCs via interface VPC endpoints; no public internet path.

Custom domains unify routing and TLS across stages and APIs. Use base path mappings to map paths to stages. Store certificates in ACM; choose RSA/ECDSA per client support. For edge-optimized, request/import the certificate in us-east-1. For Regional, request/import in the Region. Enforce TLS policies that match your compliance posture. Integrate with WAF by associating a web ACL directly to Regional APIs or by protecting the CloudFront distribution that fronts the API. For lowest latency global APIs with advanced caching and header normalization, place a CloudFront distribution in front of a Regional API, use origin access control and signed requests if needed, and tune cache and origin request policies to avoid cache bloat. Combine with Lambda authorizers or Amazon Cognito for auth and leverage throttling and usage plans to protect backends in addition to WAF rate-based rules.

Practical Problem Scenario

Shopify is rolling out a new global checkout microservice to serve merchants worldwide. Requirements: private east–west traffic between microservices across 20+ accounts, zero public exposure for internal APIs, deterministic low latency for end users on checkout, strong L7 protections with adaptive rate limiting, and resilient hybrid connectivity to on-premises risk engines.

Step-by-step approach:

Segment the network with a hub-and-spoke Transit Gateway design

Create a centralized networking account with a regional AWS Transit Gateway. Attach all workload VPCs (spokes) from each account via RAM-shared TGW attachments. Use multiple TGW route tables to enforce segmentation (prod vs shared-services vs dev) and propagate only required routes.
Why TGW: Scales transitive routing and simplifies route management compared to a full-mesh of peering; supports hybrid attachments.

Publish internal microservices with AWS PrivateLink

In each producer VPC, place an NLB in front of internal microservice target groups and create a VPC endpoint service. In consumer VPCs, create interface endpoints for those services and enable endpoint-specific private DNS.
Why PrivateLink: Service-level, TCP-only, non-transitive connectivity with no route exposure; producers remain isolated and do not need inbound SG allowances to entire CIDR blocks.

Establish redundant hybrid connectivity with Direct Connect and VPN

Provision two 10 Gbps Direct Connect connections in separate DX locations, terminate on separate on-premises routers. Create a Direct Connect Gateway with a Transit VIF to the TGW. Configure BGP on both sides with distinct ASNs and MED/local-pref policies. Add a Site-to-Site VPN attachment to the TGW as backup with two tunnels, BGP-enabled.
Why this mix: DX provides deterministic bandwidth and lower jitter; BGP plus VPN backup delivers automatic failover and high availability.

Front the public checkout with AWS Global Accelerator

Create an accelerator with two listeners (80/443 → 443). Define endpoint groups in us-east-1 and eu-west-1, each pointing to ALBs for the checkout service. Set traffic dials to 50/50 for steady-state and enable health checks on the ALB health endpoints. Enable client affinity if session pinning is required.
Why Global Accelerator: Anycast static IPs, fast regional failover, and TCP optimization for low-latency, stateful checkout flows.

Protect at the edge with CloudFront and AWS WAF

Place CloudFront in front of the Regional API Gateway (for idempotent GETs and static assets) and directly in front of ALBs serving dynamic content that can benefit from header normalization and TLS offload. Configure cache policies to restrict variance to necessary headers/queries, enable Origin Shield to reduce origin load, and automate invalidations for non-versioned assets.
Attach an AWS WAF web ACL to CloudFront with AWS Managed Rules, a custom rule group for business logic filtering, and a rate-based rule with a scope-down statement on checkout paths. Enable CAPTCHA for suspicious spikes and log to Kinesis Data Firehose for analytics.
Why CloudFront + WAF: Global TLS termination, caching where safe, edge-based L7 controls, and DDoS absorption via AWS Shield.

Expose APIs with custom domains and robust TLS

Use API Gateway Regional endpoints for write-heavy API methods, protected behind CloudFront. Create custom domains in ACM per Region, apply strict TLS policies, and map base paths to stages. For internal admin APIs, deploy Private APIs and access via interface VPC endpoints; associate least-privilege security groups.
Why this split: Regional endpoints plus CloudFront deliver flexibility with edge controls; Private APIs keep internal surfaces off the internet.

Lock down VPCs with layered controls

Apply least-privilege, stateful security groups referencing producer/consumer SGs where possible. Keep NACLs simple (allow all) except for targeted subnet denies needed for compliance. Enable VPC Flow Logs with CloudWatch metric filters to detect anomalous sources. Place one NAT gateway per AZ and route private subnets to the local NAT to avoid cross-AZ dependencies.
Why layered controls: SGs handle most intent with connection tracking; NACLs provide coarse safety rails; zonal NAT improves resilience and cost.

This design delivers private, segmented east–west connectivity (Transit Gateway + PrivateLink), resilient north–south hybrid paths (DX + VPN with BGP), globally accelerated and protected public entry (Global Accelerator + CloudFront + WAF), and operational controls aligned with AWS best practices for VPC routing, gateways, and filtering.

← Storage · All domains · Systems Manager →

Practice these questions → · Timed practice on ExamRoll.io →