AWS VPC Networking Basics for the SAA-C03 Exam

AWS VPC Networking Basics for the SAA-C03 Exam

VPC (Virtual Private Cloud) is the networking foundation almost every other AWS service sits inside, and it threads through all four SAA-C03 domains — not just the security one. If you're vague on subnets, route tables and the security-group-vs-NACL distinction, it'll cost you questions across the whole exam, not just one section. This is part of our SAA-C03 study guide.

What a VPC actually is

A VPC is an isolated, logically-separated network inside AWS, scoped to a single region, that you carve into subnets. Everything else — EC2 instances, RDS databases, load balancers — is launched inside a VPC (either yours or an AWS-managed default one).

CIDR blocks: how big can a VPC or subnet be?

Per AWS's VPC documentation, a VPC's IPv4 CIDR block can be sized anywhere from a /16 netmask (65,536 addresses) down to a /28 netmask (16 addresses). Subnets use that same range: a subnet's CIDR block can be /16 to /28, and it must be equal to or a subset of the VPC's own range — subnets inside the same VPC can never overlap with each other.

A common design: a /16 VPC (e.g. 10.0.0.0/16) split into several /24 subnets (256 addresses each) — one public and one private per Availability Zone, for a resilient two-AZ design.

Every subnet loses 5 addresses — always

This trips people up on the exam: AWS reserves 5 IP addresses in every subnet, regardless of size — the first 4 addresses and the last 1. They're used for the network address, the VPC router, DNS, a future-use reservation, and the broadcast address. A /24 subnet with 256 total addresses only has 251 usable for your instances.

Public vs. private subnets

A subnet is "public" or "private" based entirely on its route table, not anything inherent to the subnet itself:

• Public subnet — its route table has a route to an Internet Gateway (IGW), so resources with a public IP can reach the internet directly.
• Private subnet — no route to an IGW. Outbound-only internet access (for things like OS updates) goes through a NAT Gateway sitting in a public subnet instead — inbound connections from the internet still can't reach it directly.

The typical resilient pattern: public subnets hold load balancers and NAT Gateways; private subnets hold application servers and databases, reachable only from inside the VPC.

Security groups vs. network ACLs — the exam's favorite trap

This distinction shows up constantly, and the exam guide's "Design Secure Architectures" domain leans on it heavily:

	Security groups	Network ACLs
Scope	Instance-level (attached to ENIs)	Subnet-level
State	Stateful — return traffic is automatically allowed	Stateless — inbound and outbound rules are evaluated independently
Rules	Allow rules only	Allow and deny rules
Evaluation	All rules evaluated together	Rules evaluated in order, lowest number first

The stateful/stateless distinction is the one to really internalize: if a security group allows inbound traffic on a port, the response traffic is automatically allowed out — you don't write a matching outbound rule. A NACL allowing the same inbound traffic does not automatically allow the response; you need an explicit outbound rule too, because NACLs don't track connection state.

Practice it, don't just read it

Reading this list is a start; the exam asks you to apply it to a scenario ("a web tier needs outbound-only internet access and must not be reachable directly from the internet — what do you configure?"). AWS Certification Prep has structured VPC lessons and practice questions built around exactly this kind of scenario — see how to approach AWS scenario-based exam questions for how to break them down.

Frequently asked questions

What's the smallest and largest CIDR block AWS allows for a VPC?

A /28 (16 addresses) is the smallest, and a /16 (65,536 addresses) is the largest, per AWS's VPC documentation. Subnets use the same /28–/16 range and must fit within the VPC's own CIDR block.

How many IP addresses does AWS reserve in every subnet?

Five — the first four and the last one in the subnet's range. A /24 subnet (256 total addresses) therefore has 251 usable addresses.

Are security groups stateful or stateless?

Stateful. If inbound traffic is allowed, the response is automatically allowed out, with no separate outbound rule needed. Network ACLs are the opposite — stateless, so inbound and outbound rules are evaluated independently.

What makes a subnet "public" instead of "private"?

Its route table. A subnet is public only if its route table sends internet-bound traffic (0.0.0.0/0) to an Internet Gateway. Without that route, it's private, and any outbound-only internet access has to go through a NAT Gateway.