Objective: classify the network question
After the identity and infrastructure lessons, separate four questions: where resources sit in a virtual network, where a domain name points, which traffic is allowed, and which identity may perform an API action. VPC defines a logically isolated virtual network for AWS resources. Route 53 supplies DNS routing, among other documented functions. Security groups filter allowed traffic associated with resources. IAM controls authentication and authorization. These controls can be relevant to one project, but correctly answering one question does not establish the other three.
Worked example: a fictional publisher’s requests
A publisher brings three requests to a conceptual planning session. Its public domain must resolve to the intended endpoint. Its AWS resources need an appropriate virtual network context. Its office wants an encrypted connection over its existing internet path. First assign the naming task to DNS routing, such as Route 53; neither a network boundary nor an access policy is a domain record. Next identify VPC as the virtual-network concept. Then evaluate Site-to-Site VPN for the specified on-premises-to-AWS IPsec connection. The conclusion is a separation of purposes, not a set of deployment instructions. Check it with a counterfactual: a browser can know the correct endpoint while traffic rules or application permissions still deny access.
Path choice does not automatically settle encryption
Direct Connect links a local network to a Direct Connect location and can bypass internet service providers in the network path. That differs from the explicitly internet-based VPN choice in this lesson’s case. Direct Connect does not encrypt in transit by default; applicable additional options are needed for encryption. VPN and Direct Connect can also be combined in other designs, so do not memorize an absolute rule that they can never coexist. Compare the actual path and protection requirement given in the case instead of assuming that a dedicated connection means encryption.
Reachability versus authorized action
Security-group rules concern the allowed network traffic for associated resources, including relevant sources/destinations, protocols, and ports. IAM permissions concern a principal’s actions on resources under conditions. A reachable endpoint does not thereby allow every API operation, and an IAM permission does not establish that every network path is permitted. A cost allocation tag adds yet another distinct purpose: categorizing applicable costs. A category label alone is not a grant of access or a traffic-filtering rule. Keep the control type aligned with the question the project actually asks.
Transfer check and check basis
Try before checking: a fictional training portal resolves its domain correctly and uses a dedicated connection. Someone concludes that all users are authorized and all traffic is encrypted. Identify two unsupported leaps. Check basis: DNS resolution does not determine user/API permissions, and Direct Connect is not encrypted in transit by default. The answer should name the missing authorization and transport-protection evidence, rather than assume that the portal is either wholly safe or wholly unusable. Now attempt aws-clf-q-037–040 and retrieve cards aws-clf-card-28–30. This lesson classifies purposes; it does not create a network or certify its security.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
Organizing and tracking costs using AWS cost allocation tags - AWS BillingWhat is Direct Connect? - AWS Direct ConnectEncryption in AWS Direct Connect - AWS Direct ConnectSecurity best practices in IAM - AWS Identity and Access ManagementWhat is IAM? - AWS Identity and Access ManagementWhat is Amazon Route 53? - Amazon Route 53What is Amazon VPC? - Amazon Virtual Private CloudControl traffic to your AWS resources using security groups - Amazon Virtual Private CloudWhat is AWS Site-to-Site VPN? - AWS Site-to-Site VPN