3.4 AWS Networking and Content Delivery

AWS Certified Cloud Practitioner CLF-C02

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Cloud Practitioner (CLF-C02) Exam Study Strategies and Exam Tips

2 Domain 1: Cloud Concepts (24%)

1.1 What Is Cloud Computing? 1.2 Cloud Deployment Models 1.3 AWS Well-Architected Framework 1.4 Cloud Migration Strategies 1.5 Cloud Economics

3 Domain 2: Security and Compliance (30%)

2.1 The AWS Shared Responsibility Model 2.2 AWS Identity and Access Management (IAM) 2.3 AWS Security Services 2.4 Compliance and Governance 2.5 Network Security

4 Domain 3: Cloud Technology and Services (34%)

3.1 AWS Compute Services 3.2 AWS Storage Services 3.3 AWS Database Services 3.4 AWS Networking and Content Delivery 3.5 Management and Governance Services 3.6 AI/ML and Analytics Services 3.7 Application Integration and Other Services

5 Domain 4: Billing, Pricing, and Support (12%)

4.1 AWS Pricing Models 4.2 Billing and Cost Management Tools 4.3 AWS Support Plans 4.4 Additional Billing Concepts and Services

6 AWS Services Deep Dive

5.1 Compute Services Deep Dive 5.2 Storage and Database Deep Dive 5.3 Security Services Deep Dive 5.4 Architecture Best Practices and Design Principles 5.5 Practice Exam — Mixed Domain Questions

3.4 AWS Networking and Content Delivery

Key Takeaways Explain This Topic AI

Amazon VPC lets you create an isolated virtual network in the cloud with complete control over IP addressing, subnets, routing, and security.

Amazon CloudFront is a global CDN that caches content at edge locations worldwide for low-latency delivery to end users.

Amazon Route 53 is a highly available DNS service that routes users to applications with domain registration, DNS routing, and health checking.

Elastic Load Balancing distributes incoming traffic across multiple targets (EC2, containers, Lambda) in one or more AZs.

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet.

Last updated: October 2026

Quick Answer: AWS networking lets you build an isolated virtual network ( Amazon VPC ), deliver content fast worldwide ( CloudFront ), route DNS intelligently ( Route 53 ), spread traffic across servers ( Elastic Load Balancing ), and connect on-premises privately ( Direct Connect ) or encrypted over the internet ( AWS VPN ). The CLF-C02 tests purpose, not configuration.

Amazon VPC (Virtual Private Cloud)

Amazon VPC lets you launch AWS resources in a logically isolated virtual network you define, with full control over IP ranges, subnets, route tables, and gateways.

VPC Components

• Component Purpose
• Subnets Divide the VPC into public/private segments within AZs
• Route Tables Direct where network traffic flows
• Internet Gateway (IGW) Enables internet access for public subnets
• NAT Gateway Lets private-subnet resources reach the internet outbound only
• VPC Endpoints Private access to AWS services without traversing the internet
• VPC Peering Privately connect two VPCs
• Transit Gateway Central hub connecting many VPCs and on-premises networks
• Security Groups / NACLs Instance-level (stateful) and subnet-level (stateless) firewalls
• Security Groups vs. Network ACLs

This pair is heavily tested. Security Groups operate at the instance/ENI level, are stateful (return traffic is automatically allowed), and support allow rules only. Network ACLs (NACLs) operate at the subnet level, are stateless (you must allow both directions), and support both allow and deny rules.

VPC Endpoint Types

• Type Description Example
• Gateway Endpoint Free; for S3 and DynamoDB Private subnet reaches S3 without internet

Interface Endpoint (PrivateLink) Uses an elastic network interface with a private IP Private access to CloudWatch, SNS, SQS, and many services

Amazon CloudFront (CDN)

Amazon CloudFront is a content delivery network that caches content at 750+ points of presence (POPs) worldwide for low-latency delivery.

• Feature Detail
• Edge Locations 750+ POPs globally
• Origins S3 buckets, EC2, ALB, custom HTTP servers
• Content Types Static assets, dynamic content/APIs, video streaming
• Security Integrates with AWS WAF, AWS Shield, and ACM for HTTPS
• DDoS Protection AWS Shield Standard is automatic and free

On the Exam: CloudFront = CDN = low-latency global delivery via edge caching. Any scenario about "reduce latency for global users" or "cache static content closer to users" points to CloudFront.

Amazon Route 53 (DNS)

Amazon Route 53 is a highly available DNS web service offering domain registration, DNS routing, and health checking.

Routing Policies

• Policy Description Use Case
• Simple One resource Single-server site
• Weighted Split by assigned weights A/B testing, gradual rollout
• Latency-based Lowest-latency Region Global apps
• Failover Primary, then backup if unhealthy Disaster recovery
• Geolocation Based on user location Localization, compliance
• Geoproximity Resource location with bias Fine-tuned geographic routing
• Multivalue answer Multiple healthy records Simple DNS-level balancing
• Elastic Load Balancing (ELB)

Elastic Load Balancing distributes incoming traffic across multiple targets (EC2, containers, IPs, Lambda) in one or more AZs, improving availability and scalability.

• Type OSI Layer Best For
• Application Load Balancer (ALB) Layer 7 (HTTP/HTTPS) Web apps, microservices, path/host routing
• Network Load Balancer (NLB) Layer 4 (TCP/UDP) Extreme performance, static IP, low latency
• Gateway Load Balancer (GWLB) Layer 3 (IP) Third-party virtual appliances (firewalls, IDS/IPS)

On the Exam: ALB = HTTP/HTTPS web apps with smart routing. NLB = ultra-high-performance TCP/UDP and static IP. GWLB = inline virtual security appliances.

• Connectivity Services
• AWS Direct Connect

A dedicated private physical connection from on-premises to AWS that bypasses the public internet, offering consistent low latency and 1–100 Gbps bandwidth. It is not encrypted by default — pair it with a VPN if encryption is required.

AWS VPN

An encrypted connection over the public internet . Site-to-Site VPN links a network to a VPC over IPSec; Client VPN connects individual users. VPN is quick to set up and cheaper than Direct Connect, but performance depends on the internet.

AWS Transit Gateway

A central hub that connects many VPCs, VPNs, and on-premises networks, replacing a tangle of peering connections with hub-and-spoke routing.

AWS Global Accelerator

Routes user traffic over the AWS global backbone (not the public internet) to the optimal endpoint, and provides static anycast IP addresses as a fixed entry point — ideal for non-HTTP, latency-sensitive global apps.

• Service Best For
• Direct Connect Dedicated private bandwidth, hybrid, compliance
• VPN Quick, encrypted connection over the internet
• Transit Gateway Connecting many VPCs and networks centrally
• Global Accelerator Performance via the AWS backbone + static IPs
• CloudFront Caching content at edge for low-latency delivery

On the Exam: Distinguish CloudFront (caches content at edge) from Global Accelerator (routes live traffic over the AWS backbone to your origins). Both improve global performance but solve different problems.

Default Networking Behavior

Every AWS account starts with a default VPC in each Region, complete with a default subnet in each Availability Zone, an internet gateway, and a route table — so you can launch an instance immediately. For production, organizations typically build a custom VPC with carefully designed public and private subnets across multiple AZs.

A common secure pattern places internet-facing resources (a load balancer) in public subnets and application/database tiers in private subnets , with a NAT Gateway giving the private tier outbound-only internet access for updates. This layered design supports the Security pillar's "defense in depth" and the Reliability pillar's multi-AZ guidance. Knowing that public subnets route to an internet gateway while private subnets do not is a frequently tested distinction.