CLF-C02
Deep Dive
AWS networking services form the foundation of every cloud architecture. The CLF-C02 especially tests the difference between Security Groups and NACLs, and the use cases for Route 53 vs CloudFront.
Contents
Your isolated private network inside AWS
Amazon VPC lets you launch AWS resources into a virtual network that you define. You get full control over the virtual networking environment: IP address range selection, subnet creation, route table configuration, and network gateways.
Key VPC components
Subnets
Divisions of the VPC. Public: has a route to the Internet Gateway. Private: no direct internet access.
Internet Gateway (IGW)
Allows resources in public subnets to communicate with the internet. Attached to the VPC (1 per VPC).
NAT Gateway
Allows instances in PRIVATE subnets to initiate outbound connections to the internet, without allowing inbound connections from the internet.
Route Tables
Define where network traffic is routed. Each subnet has an associated route table.
VPC Peering
Connects two VPCs together (can be in different accounts or regions). Traffic never leaves to the internet.
VPC Endpoints
Connects the VPC to AWS services (S3, DynamoDB) without going over the public internet.
Typical 3-tier VPC architecture
Public Subnet
Web servers, load balancers, NAT Gateway
Private Subnet (App)
Application servers, APIs. Reach the internet via the NAT GW.
Private Subnet (Data)
RDS, ElastiCache, databases. No internet access.
Best practice
Never place databases in public subnets. RDS instances should live in private subnets, reachable only from the application tier.
This question shows up in nearly every CLF-C02 exam
You need to know when each applies and which one is stateful vs stateless.
| Dimension | Security Groups | Network ACLs |
|---|---|---|
| Level | Instance (EC2, RDS, etc.) | Subnet |
| Stateful / Stateless | ✅ Stateful — outbound response allowed automatically | ❌ Stateless — you must define inbound AND outbound rules |
| Rule type | Allow only (no Deny rules) | Allow and Deny. Evaluated in numeric order. |
| Default | No inbound access. All outbound access allowed. | Default VPC NACL: allows all inbound and outbound traffic. |
| Evaluation | Evaluates ALL rules before deciding | Evaluated in numeric order (the first match applies) |
| Where it attaches | To individual instances/ENIs | To subnets. Applies to ALL traffic in that subnet. |
| Use case | Control access for a specific instance | Block IP ranges at the subnet level, explicit Deny rules |
Stateful (Security Groups)
If you allow inbound traffic on port 80, the outbound response is automatically allowed. You don't need to create an explicit outbound rule for that connection.
Analogy: like a phone call — if you answer, you can talk in both directions.
Stateless (Network ACLs)
You must create inbound AND outbound rules separately. If you allow inbound on 80, you must also explicitly allow the outbound response (ephemeral ports 1024-65535).
Analogy: like a security guard who checks every person both entering AND leaving, without remembering who already passed.
Scalable, highly available DNS service
Amazon Route 53 is a highly available and scalable cloud DNS (Domain Name System) web service. It translates human-readable domain names (e.g. www.example.com) into numeric IP addresses (e.g. 192.0.2.1).
Route 53 routing policies
Simple
Responds with one or more resource records. No health checks.
Use: Basic: one domain → one IP
Weighted
Distributes traffic across resources based on weights you define.
Use: A/B testing, gradual traffic shifting in deployments
Latency
Routes users to the AWS Region with the lowest latency from their location.
Use: Multi-region apps for a better user experience
Failover
Routes traffic to a primary resource; if it fails, to the secondary.
Use: Active-passive disaster recovery
Geolocation
Routes traffic based on the geographic location of the user.
Use: Data residency compliance, localized content
Geoproximity
Routes traffic based on the location of users and resources, with bias.
Use: Fine-grained control over geographic distribution
Multivalue Answer
Responds with multiple records and performs health checks.
Use: Basic DNS with health checks (not a replacement for a load balancer)
Create a hosted zone and a record to point a subdomain at an AWS resource.
+1 more...
Content Delivery Network (CDN) with 400+ global Edge Locations
Amazon CloudFront delivers content (HTML, CSS, JS, images, video) to end users with low latency and high transfer speeds, using a global network of Edge Locations.
Origin types
Advanced features
Create a CDN distribution that caches content at global edge locations, bringing it closer to your users.
+1 more...
AWS Direct Connect
A dedicated, private network connection between your on-premises datacenter and AWS. It never touches the public internet. High speed (1 Gbps to 100 Gbps) and consistently low latency.
Site-to-Site VPN
An encrypted connection between your on-premises network and your AWS VPC over the public internet. It's set up quickly and is cheaper than Direct Connect.
When to use each — Exam question
Direct Connect: large data volumes (TBs), critical low latency, mission-critical workloads, compliance.
Site-to-Site VPN: fast and affordable connectivity, Direct Connect backup, tolerable latency, lighter workloads.
Elastic Load Balancing automatically distributes incoming application traffic across multiple targets (EC2, containers, IPs, Lambda functions) in one or more Availability Zones.
| Type | OSI layer | Protocols | Use cases |
|---|---|---|---|
| ALB (Application) | L7 (Application) | HTTP, HTTPS, WebSocket | Microservices, web apps, routing by URL/headers |
| NLB (Network) | L4 (Transport) | TCP, UDP, TLS | Ultra-low latency, millions of req/sec, gaming, VoIP |
| CLB (Classic) | L4/L7 | HTTP, HTTPS, TCP | Legacy. Use ALB or NLB for new apps. |
Create an ALB that distributes traffic across several EC2 instances, and understand its role in high availability.
+1 more...
Create a virtual private cloud (VPC) with public and private subnets.
+1 more...
Did you get this topic?
Test what you just learned
A network administrator needs to block access from a specific IP range (203.0.113.0/24) to an entire VPC subnet. Which AWS service or feature should they use?
Put what you learned to the test with original CLF-C02 exam questions.
Start CLF-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.