Secure Networking and Edge Protection
This topic covers VPC design, subnets, route tables, security groups, network ACLs, private endpoints, WAF, Shield, CloudFront, and load balancer protection.
How to study for AWS Solutions Architect Associate
Treat each question as an architecture tradeoff: identify security boundaries, failure modes, performance needs, data paths, and cost constraints before choosing services.
Core concepts
Concept 1
Secure Networking and Edge Protection questions reward architecture tradeoff reasoning rather than picking the most familiar AWS service.
Exam cue: Identify the workload requirement, failure mode, data path, access boundary, and operational constraint.
Concept 2
The best answer maps requirements to security, resilience, performance, and cost constraints before choosing services.
Exam cue: Match the AWS service to the Well-Architected pillar the scenario is testing.
Concept 3
Eliminate answers that ignore shared responsibility, single points of failure, data movement, scaling behavior, or total cost.
Exam cue: Prefer managed, durable, least-privilege, multi-AZ, and right-sized designs when requirements call for them.
Risk pitfalls and guardrails
Choosing the most powerful service when a simpler managed service satisfies the requirement.
Guardrail: Avoid answers that use broad permissions, public data paths, single-AZ state, overbuilt compute, or commitment pricing without predictable usage.
Solving performance while ignoring security, availability, or cost constraints stated in the scenario.
Guardrail: Avoid answers that use broad permissions, public data paths, single-AZ state, overbuilt compute, or commitment pricing without predictable usage.
Assuming one Availability Zone, public access, or manual operations are acceptable without justification.
Guardrail: Avoid answers that use broad permissions, public data paths, single-AZ state, overbuilt compute, or commitment pricing without predictable usage.
Memory anchors
VPC
A VPC provides an isolated virtual network boundary for AWS resources.
Private Subnet
A private subnet has no direct route to an internet gateway.
Security Group
A security group is a stateful virtual firewall attached to supported resources.
Network ACL
A network ACL is a stateless subnet-level traffic filter.
VPC Endpoint
A VPC endpoint provides private connectivity to supported AWS services without public internet paths.
PrivateLink
AWS PrivateLink exposes services privately through interface endpoints.
WAF
AWS WAF protects web applications from common HTTP and layer 7 attacks.
Shield
AWS Shield helps protect applications from DDoS attacks.
CloudFront
CloudFront can terminate TLS and cache content at edge locations closer to users.
ALB Security
An Application Load Balancer can integrate with TLS, security groups, WAF, and target groups.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
A three-tier application places an internet-facing ALB in public subnets and EC2 application instances in private subnets. How should inbound application traffic be restricted?
Application instances in private subnets need outbound access to download public software updates, but they must not accept unsolicited internet connections. Which design fits?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”