ExamFinch.com My Study

Study guide

5.1 VPC Architecture — Subnets, Route Tables, and Gateways

Practice this exam

AWS Solutions Architect Associate SAA-C03

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Solutions Architect Associate (SAA-C03) Exam Study Strategies and Exam Tips for SAA-C03 The AWS Well-Architected Framework

2 Domain 1: Design Secure Architectures (30%)

1.1 IAM Fundamentals — Users, Groups, Roles, and Policies 1.2 AWS Organizations, SCPs, and Multi-Account Strategy 1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints 1.4 Encryption, KMS, and Secrets Management 1.5 AWS WAF, Shield, and Network Firewall 1.6 GuardDuty, Inspector, Macie, and Security Hub 1.7 The Shared Responsibility Model for Solutions Architects 1.8 Data Protection, Compliance, and Audit Services

3 Domain 2: Design Resilient Architectures (26%)

2.1 Elastic Load Balancing (ELB) — ALB, NLB, and GWLB 2.2 EC2 Auto Scaling — Dynamic, Predictive, and Scheduled 2.3 Multi-AZ and Multi-Region Architectures 2.4 Disaster Recovery Strategies — RTO and RPO 2.5 Decoupling with SQS, SNS, and EventBridge 2.6 AWS Step Functions and Workflow Orchestration

4 Domain 3: Design High-Performing Architectures (24%)

3.1 EC2 Instance Types, Purchasing Options, and Placement Groups 3.2 Lambda, Serverless Compute, and Container Services 3.3 Amazon S3 - Storage Classes, Lifecycle, and Performance 3.4 Block and File Storage - EBS, EFS, and FSx 3.5 Database Services - RDS, Aurora, DynamoDB, and More 3.6 CloudFront, Route 53, and Global Accelerator 3.7 Data Ingestion and Transformation - Kinesis, Glue, and EMR

5 Domain 4: Design Cost-Optimized Architectures (20%)

4.1 Compute Cost Optimization — Right-Sizing, RIs, Savings Plans, and Spot 4.2 Storage Cost Optimization — S3 Tiers, EBS, and Data Transfer 4.3 Database Cost Optimization 4.4 AWS Cost Management and Monitoring Tools

6 VPC and Networking Deep Dive

5.1 VPC Architecture — Subnets, Route Tables, and Gateways 5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect 5.3 Amazon API Gateway 5.4 CloudFormation and Infrastructure as Code 5.5 AWS PrivateLink and Endpoint Services

7 Migration, Transfer, and Hybrid Services

6.1 The 7 Rs of Cloud Migration 6.2 AWS Snow Family — Snowball Edge Devices 6.3 CloudWatch, CloudTrail, and AWS Config 6.4 Amazon Cognito and Identity Federation 6.5 AWS DataSync and Transfer Family

8 Serverless Architecture and Application Services

7.1 Serverless Architecture Patterns 7.2 Advanced SQS Patterns — DLQ, Backpressure, and FIFO 7.3 Analytics Services — Athena, OpenSearch, and QuickSight 7.4 Container Orchestration — ECS, EKS, and ECR

9 Advanced Topics and Exam Scenarios

8.1 Advanced IAM — Permission Boundaries, Federation, and Cross-Account 8.2 Caching Strategies and ElastiCache Patterns 8.3 Hybrid Architecture — DNS, Storage, and Compute 8.4 SAA-C03 Scenario Practice — Putting It All Together

5.1 VPC Architecture — Subnets, Route Tables, and Gateways

Key Takeaways Explain This Topic AI

A VPC spans a single Region; each subnet lives in exactly one Availability Zone, so a Multi-AZ design needs at least one subnet per AZ.

A subnet is public only because its route table sends 0.0.0.0/0 to an Internet Gateway — the label is determined by routing, not a checkbox.

Private subnets reach the internet outbound-only through a NAT gateway: a zonal NAT gateway sits in a public subnet and needs one per AZ for resilience, while a regional NAT gateway expands across AZs automatically and needs no public subnet.

Security groups are stateful and attach to ENIs (allow-only); Network ACLs are stateless and operate at the subnet boundary with numbered allow/deny rules.

AWS reserves 5 IP addresses in every subnet, so a /24 (256 addresses) yields 251 usable IPs — a frequent capacity-planning trap on the exam.

Last updated: October 2026

Quick Answer: A Virtual Private Cloud (VPC) is your logically isolated network in one AWS Region. A subnet is public only when its route table sends 0.0.0.0/0 to an Internet Gateway (IGW) ; a private subnet reaches the internet outbound-only through a NAT Gateway . A standard (zonal) NAT gateway sits in a public subnet, so deploy one in each Availability Zone for high availability; a regional NAT gateway expands across AZs automatically and needs no public subnet. Also remember that AWS reserves 5 IPs per subnet.

CIDR and IP Address Planning

The VPC primary IPv4 CIDR block ranges from /16 (65,536 addresses) to /28 (16 addresses). Subnets carve smaller ranges out of it. A key numeric trap is that AWS reserves 5 addresses in every subnet : the network address, the VPC router, the DNS/Route 53 Resolver address, one reserved for future use, and the broadcast address.

  • Subnet CIDR Total addresses Usable after 5 reserved
  • /28 16 11
  • /27 32 27
  • /24 256 251
  • /20 4,096 4,091

If a question says "a /24 subnet has filled up at 251 instances," do not assume a bug — that is the architectural ceiling. CIDR blocks of peered or connected VPCs cannot overlap , so allocate non-overlapping ranges (for example 10.0.0.0/16, 10.1.0.0/16) from the start.

Subnets, Route Tables, and the Public/Private Distinction

Each subnet associates with exactly one route table, but a route table can serve many subnets. The longest-prefix-match (most specific route) wins, and the local route covering the VPC CIDR can never be deleted.

  • Destination Target Effect
  • 10.0.0.0/16 local Intra-VPC traffic stays inside the VPC
  • 0.0.0.0/0 igw-xxxx Public subnet — direct internet
  • 0.0.0.0/0 nat-xxxx Private subnet — outbound via NAT
  • pl-xxxx (S3 prefix list) vpce-xxxx Private S3 access via Gateway Endpoint

A reference three-tier layout spans two AZs: public subnets host the Application Load Balancer and NAT Gateways; private app subnets host EC2/ECS; isolated database subnets host RDS with no internet route at all.

Gateways

Internet Gateway (IGW): horizontally scaled, redundant, fully AWS-managed. One per VPC. An instance needs a public IP and an IGW route to be reachable.

NAT Gateway (zonal): managed, highly available within a single AZ , scales to 100 Gbps, costs roughly $0.045/hour plus $0.045/GB processed. A public zonal NAT gateway lives in a public subnet. For cross-AZ resilience, deploy one per AZ and point each AZ's private route table at the local NAT Gateway — otherwise an AZ failure severs outbound traffic for the others and incurs cross-AZ data charges.

NAT Gateway (regional): one NAT gateway ID that automatically expands to each AZ where you have workloads, so one route entry serves subnets in every AZ and no public subnet is needed to host it. It is billed per hour in each AZ it runs in, and it does not support private NAT.

Security Groups vs. Network ACLs

  • Feature Security Group Network ACL
  • Level ENI / instance Subnet
  • State Stateful (return traffic auto-allowed) Stateless (must allow both directions)
  • Rules Allow only Allow and deny, numbered, lowest number first
  • Default Deny all inbound, allow all outbound Default ACL allows all; custom ACL denies all

On the Exam: "Block a specific malicious IP range" → Network ACL deny rule (security groups cannot deny). "Allow web tier to talk to app tier" → reference the web tier's security group as the source in the app tier's group.

Worked Example — Designing a Two-AZ Three-Tier VPC

Suppose you are asked to design a resilient VPC for a web application. Walk through it the way the exam expects. First, choose a VPC CIDR large enough to grow into but small enough to avoid waste: 10.0.0.0/16 gives 65,536 addresses. Second, split each tier across two Availability Zones so a single-AZ outage never takes the whole stack down. A clean layout is:

Public subnets: 10.0.0.0/24 (AZ-a) and 10.0.1.0/24 (AZ-b) — hold the ALB and one NAT Gateway each.

Private app subnets: 10.0.10.0/24 (AZ-a) and 10.0.11.0/24 (AZ-b) — hold EC2/ECS workloads.

Private data subnets: 10.0.20.0/24 (AZ-a) and 10.0.21.0/24 (AZ-b) — hold RDS Multi-AZ.

Third, wire the routing. The two public subnets share a route table whose 0.0.0.0/0 points to the IGW. Each private app subnet gets its own route table sending 0.0.0.0/0 to the NAT Gateway in its own AZ — never to a single shared zonal NAT Gateway, which would create a cross-AZ dependency and data-transfer charges (a regional NAT gateway avoids this with one route entry for every AZ). The data subnets have no 0.0.0.0/0 route at all, so the database can never reach the internet.

Common Traps

  • Trap Reality
  • "Make a subnet public by ticking a box" Public status comes from an IGW route, not a setting

"One NAT Gateway is Multi-AZ" True only for a regional NAT gateway; a zonal NAT gateway is HA only within one AZ, so deploy one per AZ

  • "Use a security group to deny an IP" Security groups allow only; use a Network ACL deny rule
  • "A /24 holds 256 instances" Only 251 usable after the 5 reserved addresses

"NACL change applies instantly to existing connections" NACLs are stateless and evaluate every packet, so changes affect in-flight flows immediately

Keeping security groups stateful (return traffic auto-allowed) and NACLs stateless (you must allow ephemeral return ports 1024–65535 explicitly) straight in your head resolves a large share of networking questions.