Amazon AWS SAA-C03: Network Design Essentials

Networking on Amazon AWS SAA-C03 is about understanding packet paths. VPCs, subnets, route tables, gateways, load balancers, DNS, security groups, endpoints, and hybrid links all make more sense when you can explain where a packet starts, which routing decision applies, which security controls inspect it, and how the return path works.

The exam rarely requires obscure networking theory. It rewards a clear model of public versus private reachability, address planning, service exposure, high availability, and the difference between routing and security.

Plan VPC address space before deployment

Choose non-overlapping private address ranges with room for growth. CIDR notation and subnetting determine how addresses are divided among Availability Zones, application tiers, and future expansion. Overlap becomes especially painful when VPCs later need peering, Transit Gateway connectivity, or hybrid routing.

Use subnets to group resources by routing and availability needs. A ‘public subnet’ is not public because of its name; it is public because its route table can reach an internet gateway and the resource has an appropriate public address or endpoint.

Understand route tables as forwarding policy

Each subnet uses a route table to decide where traffic goes. Local VPC routes allow internal communication, while routes can point toward internet gateways, NAT gateways, Transit Gateway attachments, VPNs, network appliances, or other targets. Longest-prefix match determines which route wins.

A security group cannot make traffic take a different path. Likewise, a correct route cannot override a denied security rule. Keeping forwarding and filtering separate prevents many exam mistakes.

Use NAT only for the traffic pattern it solves

Network address translation allows private resources to initiate outbound traffic through translated addresses. In AWS, a NAT gateway commonly provides IPv4 internet egress for private subnets, but it does not accept arbitrary inbound internet connections to those instances.

Design NAT across Availability Zones carefully. Centralizing one NAT gateway can save hourly charges in small environments but create cross-AZ data transfer and an availability dependency. Larger architectures may use one per AZ to align traffic with failure boundaries.

Layer security groups and NACLs appropriately

Security groups are stateful controls attached to network interfaces. Return traffic for an allowed connection is automatically permitted. NACLs are stateless subnet-level controls with ordered rules and separate evaluation for both directions.

Use network controls alongside identity and application authorization. The difference between subnetting and VLAN segmentation reinforces that logical network separation is only one part of security. A private subnet does not make an overly permissive application safe.

Choose load balancers from protocol behavior

Application Load Balancer is designed for HTTP and HTTPS routing, including host and path rules. Network Load Balancer operates at Layer 4 and supports very high performance and static IP-related use cases. Gateway Load Balancer integrates network virtual appliances into traffic paths.

Health checks are part of architecture. A load balancer can route around unhealthy targets only if the health check accurately reflects whether the application can serve requests. A process that is running but disconnected from its database may need a deeper readiness check.

Design DNS as part of application delivery

Amazon Route 53 provides hosted DNS along with routing policies and health checks. Alias records can point to AWS resources, while private hosted zones provide names visible inside associated VPCs. Resolver features help integrate private DNS with on-premises environments.

DNS routing can support failover and latency-sensitive designs, but caching and TTLs matter. Do not assume every client instantly follows a DNS change. The application and recovery design should tolerate propagation behavior.

Use private endpoints to reduce internet exposure

Gateway endpoints provide private connectivity to supported services such as S3 and DynamoDB without requiring NAT. Interface endpoints use PrivateLink to expose supported services through private IP addresses in the VPC. These patterns can improve security and sometimes reduce network complexity.

Endpoint policies and service policies still matter. Private reachability does not imply unrestricted authorization. The architecture should control both the path and the action.

Connect hybrid networks with routing in mind

Site-to-Site VPN and Direct Connect connect on-premises networks to AWS for different performance, deployment, and resilience needs. The architecture of an IPsec site-to-site tunnel still depends on routing, peer reachability, and a valid return path.

BGP can exchange routes dynamically, while static routing may suit simpler environments. For high availability, use redundant devices, links, and locations as appropriate; two logical tunnels that share one physical failure domain are not full resilience.

Measure the network symptom before redesigning

Bandwidth, latency, jitter, and packet loss represent different network problems. VPC Flow Logs, load-balancer metrics, CloudWatch, Reachability Analyzer, and application logs can narrow the issue. A slow application does not automatically mean the network needs more bandwidth.

Trace the expected path and validate each decision point. This method distinguishes DNS problems, route errors, security denials, unhealthy targets, asymmetric routing, and application latency far faster than changing multiple controls at once.

Route-table design becomes easier when you think in terms of destinations rather than interfaces. A packet to another subnet uses the local route; a packet to the internet might use an internet gateway or NAT gateway depending on source addressing and direction; a packet to another network might use Transit Gateway or a VPN. The same instance can therefore use multiple paths based on destination prefix.

Elastic network interfaces matter because security groups, private IP addresses, and many network behaviors attach to the interface rather than the abstract instance. Understanding that model helps explain why replacing an EC2 instance can preserve or change addressing depending on how the interface is managed, and why security controls follow the interface.

Load balancer choice should also consider source IP requirements and protocol preservation. Some applications need Layer 7 routing and managed TLS termination; others need very high-throughput Layer 4 forwarding or static endpoint behavior. Choosing a load balancer by name instead of protocol need creates avoidable complexity.

Private DNS can change how interface endpoints behave because the usual public service name can resolve to private endpoint addresses inside the VPC. That is convenient, but it also means hybrid clients and custom DNS resolvers need correct forwarding behavior. A connectivity issue that looks like routing may actually begin with name resolution.

VPC peering is simple for direct connections but does not provide transitive routing. Transit Gateway can centralize many VPC and hybrid attachments. For SAA-C03, know the design implication: if A peers with B and B peers with C, A does not automatically reach C through B. This prevents a common assumption imported from traditional routed networks.

Finally, keep the return path in every troubleshooting story. A security group may allow the forward connection and statefully allow the response, but NACLs and routing still need valid bidirectional behavior. Asymmetric paths through stateful inspection can also create failures. Tracing only the outbound packet is half a network diagnosis.

IPv6 changes some assumptions because globally routable addresses do not require NAT for outbound internet communication. Egress-only internet gateways can provide outbound-only behavior for IPv6, while security groups and NACLs still control reachability. Exam questions may mix IPv4 and IPv6, so identify the address family before assuming a NAT gateway is required.

Multi-AZ network design should avoid sending all traffic through a resource in another Availability Zone unless the architecture accepts that dependency and cost. NAT gateways, load balancer targets, firewalls, and endpoints should be placed with failure boundaries in mind. Zonal awareness is part of both resilience and cost optimization.

Network troubleshooting is faster when DNS is tested first for name-based applications. If the name resolves to an unexpected public address instead of a private endpoint, routing and security investigation can go in the wrong direction. Verify resolution, then route selection, then filters, then target health. That order turns a vague connectivity complaint into a series of falsifiable checks.

AWS networking design also benefits from minimizing unnecessary public addresses. Public IPs are appropriate for components that must be directly reachable, but many workloads can keep compute private and expose only load balancers, edge services, or managed endpoints. Fewer public entry points simplify security review and reduce the number of resources that need internet-facing controls.

Hybrid connectivity questions may also include DNS and authentication dependencies that cross the same network. A VPN can be up while internal applications fail because private names do not resolve or because an identity service is unreachable. Treat connectivity validation as more than a ping test: verify names, routes, security controls, target health, and required application dependencies in the order the client uses them.

A useful lab discipline is to document the expected packet path before troubleshooting it. Write down the source address, destination, DNS result, route target, security-group decision, subnet ACL behavior, load balancer, and return path. When the test fails, compare observation with that model one step at a time. This habit is faster and more reliable than changing several network components together.

Build a packet-path habit for the exam

Before choosing an answer, narrate the request: resolve the name, reach the endpoint, follow the route, pass security controls, arrive at a healthy target, access downstream dependencies, and return successfully. Any missing step can explain the symptom.

For more advanced network design, Amazon AWS SAP-C02 adds multi-account, hybrid, and global routing complexity. SAA-C03 gives you the foundation: know what each networking component decides and do not ask one layer to solve a problem owned by another.