Practice Questions

Virtual Private Cloud (VPC)

Architecture

VPC fundamentals:

• A VPC is a logically isolated virtual network in an AWS region; you define the IP address space using CIDR notation
• Default limit: 5 VPCs per region per account (soft limit; can be increased)
• A VPC spans all AZs in its region; subnets are scoped to a single AZ
• Every AWS account comes with a default VPC in each region (CIDR: 172.31.0.0/16) with a subnet in every AZ, an Internet Gateway, and a default route table

CIDR math:

• /16 = 65,536 addresses; /24 = 256 addresses; /28 = 16 addresses (minimum subnet size in AWS)
• AWS reserves 5 IPs in every subnet: .0 (network), .1 (VPC router), .2 (DNS), .3 (future use), last address (broadcast)
• Available IPs in a /24 subnet: 256 − 5 = 251

Subnets:

• Public subnet: has a route to an Internet Gateway; instances can have public IPs and communicate with the internet
• Private subnet: no route to an Internet Gateway; instances use a NAT Gateway for outbound internet access
• A subnet's public/private nature is determined entirely by its route table — not by its name

Internet Gateway (IGW):

• Enables communication between the VPC and the internet
• Horizontally scaled, redundant, and highly available — no bandwidth bottleneck or availability concern
• Attach one IGW per VPC