Networking

10 AWS Networking terms and services covered in certification exams, with exam-focused explanations.

Amazon VPC

A service that creates a logically isolated virtual network within your AWS account. You define the IP address range, subnets, route tables, and gateways. The foundation of network design — subnet layout, routing, and gateway combinations are tested across all exam levels.

サブネット

A segment of a VPC's IP address range, residing in a single Availability Zone. Public subnets have a route to an Internet Gateway; private subnets do not. Distributing subnets across multiple AZs for high availability is a standard exam topic.

セキュリティグループ

A stateful virtual firewall applied at the instance (ENI) level. Only allow rules are defined; return traffic is automatically permitted. The contrast with the stateless network ACL (subnet-level, supports deny rules, no automatic return traffic) is a classic exam question.

ネットワークACL

A stateless virtual firewall applied at the subnet level. Both allow and deny rules are evaluated in numbered order; return traffic must be explicitly allowed. The comparison with security groups (stateful, instance-level) is a core exam topic.

Amazon Route 53

A DNS service that resolves domain names to IP addresses, with domain registration and health checking. Supports multiple routing policies — failover, latency, weighted, geolocation — for availability and traffic control. Frequently tested in disaster recovery and multi-region designs.

Amazon CloudFront

A CDN (Content Delivery Network) that caches content at edge locations worldwide to reduce latency and offload origin (S3, ELB) traffic. Tested in questions about delivery acceleration, DDoS resilience, and secure S3 integration.

NAT Gateway

A managed service enabling private subnet resources to make outbound internet connections without accepting inbound connections. Used when servers need internet access (e.g., for software updates) but should not be publicly reachable. A standard component of private subnet design.

VPCエンドポイント

A private gateway into AWS services without traversing the internet. Gateway endpoints (S3 and DynamoDB) add a route to the route table at no charge; Interface endpoints (PrivateLink) use an ENI. Tested in designs that keep traffic within the AWS network to enhance security and avoid NAT costs.

AWS Direct Connect

A dedicated physical connection between on-premises environments and AWS that bypasses the internet, delivering stable bandwidth, consistent low latency, and reliable network quality. Compared with VPN (internet-based, encrypted) in hybrid connectivity questions where bandwidth and reliability matter.

AWS Transit Gateway

A hub that aggregates multiple VPCs and on-premises networks for interconnection. Solves the full-mesh VPC peering management problem (which grows as N×(N-1)/2) with centralized routing. Tested in large-scale multi-VPC connection designs.

Last updated: 2026-06-24

This page is created from AWS official documentation and reviewed/edited by the operator. See our editorial & quality policy for details.