VPC Study Guide

Master AWS VPC

Topic paling banyak keluar dalam SAA-C03. Faham konsep ni dan banyak soalan lain akan jadi senang.

🏘️

Mental Model — VPC Macam Apa?

Bayangkan VPC sebagai kawasan perumahan gated kau sendiri dalam AWS cloud — kau yang design layout, tentukan IP ranges, decide siapa boleh masuk.

VPC vs Tailscale:Tailscale buat private overlay network antara devices yang dah wujud (macam Site-to-Site VPN). VPC adalah “tanah” asas dimana AWS resources kau dilahirkan dan hidup — lebih fundamental, bukan sekadar tunnel.

🏠

VPC

Kawasan perumahan keseluruhan — kau tentukan boundary (CIDR range)

🛤️

Subnets

Jalan-jalan dalam kawasan — public (ada jalan keluar IGW) vs private (lorong dalam je)

🚪

Internet Gateway

Pintu pagar utama — kenderaan masuk DAN keluar, free, satu per VPC

🔁

NAT Gateway

Pintu belakang — orang dalam boleh keluar (outbound), orang luar tak boleh masuk

📋

Route Tables

Papan tanda jalan — arahkan traffic ke mana pergi dalam kawasan

💂

Security Groups

Bodyguard setiap rumah (EC2) — stateful, ingat siapa dia bagi masuk

🚧

NACLs

Checkpoint kat pintu masuk jalan (subnet) — stateless, check semua kenderaan dua arah

🗺️

VPC Components — Subnets & CIDR

↑ Top

Reference diagram dari lecture AWS VPC Overview: Subnets & CIDR. Tunjuk bagaimana VPC, subnets, route tables, IGW, NAT, SG dan NACL berhubung.

AWS VPC diagram: 10.0.0.0/16 VPC with public subnet 10.0.1.0/24, private subnet 10.0.2.0/24, Internet Gateway, NAT Gateway, route tables, security groups, and NACLs — VPC `10.0.0.0/16` · Public subnet `10.0.1.0/24` (route `0.0.0.0/0 → IGW`) · Private subnet `10.0.2.0/24` (route `0.0.0.0/0 → NAT`)

VPC CIDR

10.0.0.0/16 — parent range untuk semua subnets dalam VPC ni

Public subnet

10.0.1.0/24 — public server + NAT Gateway; route table ada 0.0.0.0/0 → IGW

Private subnet

10.0.2.0/24 — private server; outbound internet via NAT dalam public subnet

SG vs NACL

SG = per instance (stateful). NACL = per subnet boundary (stateless, allow + deny)

🔢

CIDR — IP Address Reference

↑ Top

Dari mana datang nombor 10.0.0.0 atau 172.31.0.0?

Masa create VPC, kau pilih sendiri IP range dari RFC 1918 private ranges — ranges ni tidak boleh di-route kat internet public, sebab tu sesuai untuk internal network. Kau tak boleh guna IP public macam 89.x.x.x untuk VPC.

10.0.0.0/8

Terbesar — enterprise, banyak subnets

e.g. 10.0.0.0/16

172.16.0.0/12

Medium — AWS default VPC guna ini

AWS default: 172.31.0.0/16

192.168.0.0/16

Paling biasa — rumah/pejabat kecil

e.g. 192.168.0.0/24

Apa maksud /16 tu? Nombor selepas slash = berapa bits dikunci sebagai network prefix — bukan bilangan IPs. IPv4 ada 32 bits, baki bits lepas prefix = host bits → tentukan berapa IPs dalam range.

/16 → 16 bits kunci, 16 bits bebas

2¹⁶ = 65,536 IPs

/24 → 24 bits kunci, 8 bits bebas

2⁸ = 256 IPs

/25 → 25 bits kunci, 7 bits bebas

2⁷ = 128 IPs

Sebab tu dalam route table kau nampak 172.31.0.0/16 — itu AWS default VPC range yang kau pilih masa setup.

Structure IP Address — Network vs Host

Setiap IPv4 address ada 32 bits, dibahagi kepada 4 kumpulan 8-bit (octet). Subnet mask tentukan mana bahagian Network (prefix) dan mana bahagian Host.

Contoh: 192.168.100.10 dengan /24 (255.255.255.0)

192

11000000

8 bits

168

10101000

8 bits

100

01100100

8 bits

00001010

8 bits

255

11111111

255

11111111

255

11111111

00000000

Network portion— 24 bits (3 octets) dikunci oleh /24Host portion— 8 bits bebas, boleh assign ke devices

Peraturan mudah

192.168.100.10 — bahagian depan (192.168.100) = Network Address, bahagian belakang (10) = Host Address. Semua devices dalam subnet yang sama berkongsi bahagian Network yang sama.

Contoh soalan exam: Cari Network Address

PC diberi IP 192.168.50.191/26. Apa Network Address-nya?

/26 → 26 bits network, 6 bits host. Subnet mask octet terakhir: 256 − 2⁶ = 256 − 64 = 192 → mask = 255.255.255.192

Octet terakhir IP = 191 (10111111). AND dengan mask 192 (11000000) = 10000000 = 128

Network Address = 192.168.50.128

Shortcut: /26 = blok saiz 64 (2⁶). Cari gandaan 64 yang ≤ 191 → 0, 64, 128, 192... → 128 ✓

Formula

Usable IPs = 2^(32 − prefix) − 5

AWS reserve 5 IPs setiap subnet: .0 network · .1 VPC router · .2 DNS · .3 future · .255 broadcast

Prefix	Total IPs	Usable IPs	Common Use
/16	65,536	65,531	VPC range
/20	4,096	4,091	Large subnet
/24	256	251	Standard subnet ⭐
/26	64	59	Small subnet ⭐
/27	32	27	Exam favourite ⭐
/28	16	11	AWS minimum

Shortcut exam: Hafal /24=251, /26=59, /27=27. Kalau lupa, guna formula: tolak prefix dari 32 → hasilkan 2^x → tolak 5.

📐 Cara Kira — Step by Step

1Cari host bits

32 − prefix

32 − 26 = 6 bits

2Kira total IPs

2 ^ host bits

2⁶ = 64 IPs

3Tolak 5 reserved

total − 5

64 − 5 = 59 usable

Contoh pengiraan

/24

32−24 = 8→ 2⁸ = 256→ 256−5 = 251

10.0.1.0 – 10.0.1.255Standard subnet, exam kerap guna

/26

32−26 = 6→ 2⁶ = 64→ 64−5 = 59

10.0.1.0 – 10.0.1.63Small subnet, boleh buat 4 subnet dalam /24

/27

32−27 = 5→ 2⁵ = 32→ 32−5 = 27

10.0.1.0 – 10.0.1.31Exam favourite — hafal 27 usable IPs

/28

32−28 = 4→ 2⁴ = 16→ 16−5 = 11

10.0.1.0 – 10.0.1.15AWS minimum subnet size

5 IPs yang AWS reserve setiap subnet (official docs ↗)

IP Address	Reserved For
10.0.0.0	Network address
10.0.0.1	VPC router— AWS reserved
10.0.0.2	DNS server— Base of VPC CIDR + 2
10.0.0.3	Future use— AWS reserved
10.0.0.255	Broadcast address— Broadcast not supported in VPC

Contoh di atas untuk subnet 10.0.0.0/24. IP values berubah mengikut CIDR kau, tapi sentiasa 5 IPs dikira dari mana-mana subnet. Sumber: AWS Subnet Sizing docs

🔀

Public vs Private Subnet

↑ Top

🟢

Public Subnet

✓ Route table ada 0.0.0.0/0 → IGW
✓ EC2 mesti ada Public atau Elastic IP
✓ Internet BOLEH initiate connection masuk
✓ Guna untuk: web servers, ALB, NAT GW

🔒

Private Subnet

✓ Tiada route ke IGW dalam route table
✓ EC2 tiada public IP
✓ Internet TIDAK boleh initiate connection masuk
✓ Outbound via NAT GW (berbayar, optional)
✓ Guna untuk: databases, app servers, Lambda

Ingat: Subnet jadi “public” kerana ada route ke IGW — bukan kerana namanya “public”. Kau boleh namakan apa je, yang penting route table kena ada 0.0.0.0/0 → IGW.

🔐

Security Groups vs NACLs — Yang Paling Selalu Confused

↑ Top

Feature	Security Group (SG)	Network ACL (NACL)
Applied at	EC2 / ENI (instance level)	Subnet boundary
Stateful?	✅ YES — reply auto allowed	❌ NO — check EVERY packet both ways
Rule types	Allow only (no deny)	Allow AND Deny
Can block IPs?	❌ Cannot deny specific IPs	✅ Yes, explicit DENY rules
Default (new)	Deny all inbound, allow all out	Default NACL = allow all
Rule evaluation	All rules evaluated together	Lowest number first (first match wins)
Scope	Only instances SG is attached to	All instances in that subnet

🧠 Cara Mudah Ingat

SG = Smart/Stateful. Instance level. Allow only. Guna untuk “allow app A talk to app B”.

NACL = Naive/Needs-both-ways. Subnet level. Can deny. Guna untuk “block this IP range”.

🎥

VPC Flow Logs — CCTV Network Kau

↑ Top

Mental Model

Flow Logs = CCTV network VPC. Dia rakam SIAPA cakap dengan SIAPA (source IP, destination IP, port, ACCEPT/REJECT) — bukan APA dia cakap (bukan packet payload/content). Nak tengok isi packet sebenar? Itu kerja Traffic Mirroring, bukan Flow Logs.

Data dikumpul di luar laluan traffic kau — jadi zero impact pada throughput/latency. Tapi bukan real-time: ambil beberapa minit untuk mula keluar log.

Anatomy — Dari Mana ke Mana

1. Capture Level (pilih satu)

VPC

Monitor SEMUA ENI dalam VPC

Subnet

Monitor SEMUA ENI dalam subnet itu

ENI

Monitor satu network interface je

2. Flow Log (filter traffic)

Traffic yang SG/NACL benarkan

REJECT

Traffic yang SG/NACL block

ALL

Kedua-duanya sekali

3. Destination (hantar ke mana)

CloudWatch Logs

Search/alarm cepat, real-ish-time monitoring

Amazon S3

Simpan murah + query guna Athena

Data Firehose

Stream ke analytics/3rd-party (dulu Kinesis Firehose)

Anatomy Satu Flow Log Record (default format)

2 123456789010 eni-1235b8ca 172.31.16.139 172.31.16.21 20641 22 6 20 4249 1418530010 1418530070 REJECT OK

srcaddr

IP yang HANTAR

dstaddr

IP yang TERIMA

srcport / dstport

Port (22 = SSH)

protocol

6 = TCP, 17 = UDP

action

ACCEPT / REJECT ← verdict SG+NACL

log-status

OK / NODATA / SKIPDATA

Record atas: ada orang cuba SSH (port 22) masuk tapi kena REJECT — maknanya SG atau NACL kau block. Inilah cara No.1 guna Flow Logs: diagnose SG/NACL terlalu ketat.

🔍 Baca REJECT macam mana?

REJECT pada INBOUND → request masuk kena block. Suspect: SG inbound rule tak allow, atau NACL inbound DENY.

Request OK tapi REJECT pada return → NACL stateless punya pasal! Tambah NACL outbound rule untuk ephemeral ports (1024–65535). SG takkan jadi macam ni (stateful).

⛔ Yang TAK Di-log (exam suka tanya)

Traffic ke Amazon DNS server (kalau guna DNS sendiri → di-log)

Windows license activation traffic

169.254.169.254 — instance metadata

169.254.169.123 — Amazon Time Sync Service

DHCP traffic

Traffic ke reserved IP default VPC router

Traffic antara ENI endpoint ↔ Network Load Balancer

ARP (Address Resolution Protocol)

🧠 Cara Mudah Ingat + Gotchas

→INGAT "CCTV": rakam metadata SIAPA→SIAPA, bukan content. Content = Traffic Mirroring.
→Tak boleh EDIT flow log lepas create — nak tukar format/IAM role/filter? Delete & buat baru.
→Tak boleh enable untuk VPC peered melainkan peer VPC dalam account kau sendiri.
→Nitro-based instance: aggregation interval SENTIASA ≤ 1 minit, walaupun kau set max 10 min.
→Boleh enable untuk ENI service lain juga: ELB, RDS, ElastiCache, Redshift, WorkSpaces, NAT GW, TGW.
→Flow Logs = sumber untuk GuardDuty & VPC Reachability/Detective. S3 + Athena = query SQL murah.

Sumber: VPC Flow Logs docs · Flow Log Records · Limitations

🗺️

Route Tables — Papan Tanda Dalam VPC

↑ Top

Route Table bukan DNS Records

Route Table bukan macam DNS records. DNS = buku telefon(“nama ini → alamat IP ini”). Route Table = Waze / Google Maps(“nak pergi rangkaian ini → ikut jalan ini”).

DNS Records

api.example.com → 10.0.1.20

“Rumah Ali berada di alamat Jalan Mawar No. 10”

Route Table

10.0.2.0/24 → NAT Gateway

“Nak pergi ke Jalan Mawar? Keluar simpang A”

Anatomy Route Table

Setiap route ada dua bahagian: Destination (CIDR — ke mana nak pergi) dan Target (through mana — gateway/connection mana). AWS auto-buat local route untuk semua traffic dalam VPC — tak boleh delete.

Contoh: Public Subnet Route Table

Destination	Target	Maksud
10.0.0.0/16	local	Traffic dalam VPC → hantar terus (auto, tak boleh delete)
0.0.0.0/0	igw-abc123	Semua destination lain → keluar melalui Internet Gateway

Contoh: Private Subnet Route Table

Destination	Target	Maksud
10.0.0.0/16	local	Traffic dalam VPC → hantar terus
0.0.0.0/0	nat-xyz789	Outbound internet → melalui NAT Gateway (private IP ditranslate)
pl-s3xxxxx	vpce-s3abc	S3 traffic → Gateway Endpoint (shortcut, free, tak perlu NAT)

📋

Main Route Table

Auto-cipta bila buat VPC. Control routing untuk subnet yang tak explicitly associate dengan route table lain.

✏️

Custom Route Table

Kau buat sendiri untuk granular control. Contoh: satu untuk public subnets, satu lagi untuk private subnets.

🏠

Local Route

Sentiasa ada: VPC CIDR → local. Membolehkan semua resources dalam VPC communicate antara satu sama lain. Tak boleh delete.

🎯

Most Specific Route Wins

10.0.1.0/24 lebih specific dari 0.0.0.0/0. AWS pilih route paling specific yang match destination IP.

Apa yang jadikan subnet “Public”?

Satu je syarat: Route table ada entry 0.0.0.0/0 → igw-id. Tanpa route ini, walaupun kau namakan “public-subnet”, ia tetap private — tak ada jalan ke internet. EC2 juga mesti ada Public IP atau Elastic IP untuk internet boleh reply balik.

Sumber: AWS Route Tables docs · Route Table Concepts

📡

Traffic Flow — Journey Request melalui VPC

↑ Top

User dari internet buat HTTP request ke EC2 web server dalam public subnet:

Internet

User hantar request dari browser

Internet Gateway (IGW)

AWS entry point — check VPC route table ada route ke subnet

NACL — Inbound Check

Subnet checkpoint (stateless). Rules diproses ikut nombor. Ada DENY rule? Stop. Allow? Teruskan.

Subnet

Traffic masuk ke public subnet

Security Group — Inbound Check

Instance bodyguard (stateful). Allow port 80/443? Kalau tak ada rule, BLOCK.

EC2 Instance

Request sampai ke application! 🎉

↩ Reply / Response Path

EC2 → SG outbound (stateful: auto allow reply — no rule needed) → NACL outbound (stateless: kena ada explicit rule untuk ephemeral ports 1024–65535!) → IGW → Internet

⚠ NACL stateless = kena explicit outbound rule. SG stateful = auto allow reply. Ini selalu keluar dalam exam!

🔁

NAT Gateway — Private Subnet Outbound Flow

↑ Top

EC2 dalam private subnet nak download patches atau call external API:

EC2 Instance (Private Subnet)

Initiate outbound request — ada Private IP sahaja, internet tak kenal IP ni

Private Route Table

0.0.0.0/0 → nat-gateway-id — traffic keluar dihalakan ke NAT Gateway dalam public subnet

NAT Gateway (Public Subnet)

Translate Private IP → Elastic IP. Internet nampak Elastic IP sahaja, bukan IP EC2 sebenar.

Public Route Table

0.0.0.0/0 → igw-id — traffic dari NAT GW keluar ke internet melalui Internet Gateway

Internet Gateway → Internet

Request sampai ke internet. Reply balik melalui path yang sama (EC2 ← NAT ← IGW ← Internet).

Public Subnet Route Table

Destination	Target
172.31.0.0/16	local
0.0.0.0/0	igw-id

Private Subnet Route Table

Destination	Target
172.31.0.0/16	local
0.0.0.0/0	nat-gateway-id

⛔ Tiada Inbound

Internet TIDAK BOLEH initiate connection ke private subnet — tiada route dari IGW ke private subnet. NAT GW = outbound only.

🏰 Bastion / Jump Host

Nak SSH ke private instance? Letak EC2 (bastion host) dalam public subnet. Connect ke bastion dulu, then SSH ke private instance dari dalam.

⚖️

NAT Gateway vs NAT Instance — Comparison Table

↑ Top

AWS recommends NAT Gateway — better availability, bandwidth, dan zero maintenance. NAT Instance masih ada dalam exam sebagai distractor atau untuk edge cases (port forwarding, bastion).

Feature	NAT Gateway	NAT Instance
Managed by	AWS (fully managed)	Kau sendiri (patching, updates, failover)
Availability	HA within AZ (redundant). Buat satu per AZ untuk full HA.	Kena script sendiri untuk failover
Bandwidth	Scale up to 100 Gbps	Bergantung pada instance type
Security Groups	❌ Tak boleh attach SG pada NAT GW	✅ Boleh attach SG
Port Forwarding	❌ Tak support	✅ Boleh configure manually
Bastion Server	❌ Tak support	✅ Boleh guna sebagai bastion
Public IP	Elastic IP (pilih masa create)	Elastic IP atau Public IP
Cost	Per hour + per GB processed	EC2 pricing (instance + EBS)
Timeout	RST packet (clean reset)	FIN packet (graceful close)

Exam Tips

Default answer = NAT Gateway.Kalau soalan mention “managed”, “highly available”, atau “least operational overhead” → NAT Gateway.

NAT Instance bila:soalan mention “port forwarding”, “bastion host”, atau “security group on NAT” — tapi ini jarang keluar.

Sumber: AWS Compare NAT gateways and NAT instances

🔗

VPC Endpoints — Gateway vs Interface

↑ Top

VPC Endpoint = shortcut untuk EC2 access AWS services tanpa keluar ke internet. Traffic stays within AWS network (AWS private backbone) — bukan lalu IGW / NAT / public internet. Sebab tu ia jawapan classic untuk “low latency + high security”: fewer hops = lower latency, tak terdedah ke internet = higher security (bonus: tak perlu NAT = jimat kos). Dua jenis utama — pilih ikut service.

Feature	Gateway Endpoint	Interface Endpoint (PrivateLink)
Services	🟢 S3 dan DynamoDB sahaja	Hampir semua AWS services lain (CloudWatch, SSM, ECR, SQS, dll)
How it works	Entry dalam route table → prefix list	ENI (network interface) dalam subnet kau dengan private IP
Cost	✅ FREE — tiada charges	💰 Berbayar — per hour + per GB processed
Security	Endpoint policy (IAM)	Endpoint policy + Security Groups pada ENI
DNS	Tak perlu — route table handle	Private DNS name resolve ke private IP (enable Private DNS)
Cross-region	❌ Same region sahaja	❌ Same region sahaja
Access from on-prem	❌ Tak boleh	✅ Boleh via VPN/Direct Connect

Cara Mudah Ingat

“GD Free” — Gateway endpoint untuk S3 + DynamoDB = Free. Letak dalam route table, bukan dalam subnet.

Interface = ENI — buat network interface baru dalam subnet kau. Boleh attach Security Group. Berbayar tapi support hampir semua services.

aws:SourceVpc vs aws:SourceVpce (beza satu huruf, dalam bucket/key policy) — Vpc = SELURUH VPC (luas); Vpce= satu VPC Endpoint TERTENTU je (ada “e” hujung = endpoint ID). Soalan sebut “least privilege / restrict to specific endpoint” → aws:SourceVpce. Detail ni jarang keluar SAA-C03 — yang wajib cuma “private access tanpa internet → VPC Endpoint”.

Sumber: AWS PrivateLink Concepts · Gateway Endpoints

🤝

VPC Connectivity — Pilih Yang Mana?

↑ Top

🤝

VPC Peering

Free (standard data transfer rates)

Guna bila: 2 VPCs je — simple, murah, cross-account/cross-region boleh

Tapi: Non-transitive (A↔B, B↔C ≠ A↔C). IP ranges tak boleh overlap.

🌐

Transit Gateway (TGW)

Berbayar — per attachment + data

Guna bila: 3+ VPCs atau on-premises. Transitive routing. Cross-region.

Tapi: Kos per attachment + per GB. Overkill untuk 2 VPCs.

🔗

VPC Endpoints

Gateway = Free. Interface = Berbayar

Guna bila: EC2 nak access S3/DynamoDB (Gateway, free) atau AWS services lain (Interface)

Tapi: Bukan untuk connect VPC-ke-VPC. Untuk EC2-to-AWSservice sahaja.

🔒

Site-to-Site VPN

Per VPN connection + data transfer

Guna bila: On-premises ke VPC — quick setup, guna internet yang dah ada

Tapi: Latency tak konsisten (traverse internet public). Bandwidth terhad.

📡

Direct Connect

Mahal — dedicated physical connection

Guna bila: On-premises ke VPC — consistent latency, high bandwidth, compliance

Tapi: Setup lambat (weeks/months), mahal. Guna untuk serious workloads.

📡

Site-to-Site VPN vs Direct Connect — Detailed Comparison

↑ Top

Feature	Site-to-Site VPN	AWS Direct Connect
Connection type	Encrypted tunnel over public internet	Dedicated private physical connection
Setup time	Minit ke jam — quick	Minggu ke bulan — lambat (physical install)
Bandwidth	Up to 1.25 Gbps per tunnel	1 Gbps, 10 Gbps, atau 100 Gbps
Latency	Tak konsisten (traverse internet)	Konsisten dan rendah (dedicated line)
Encryption	✅ IPsec encrypted by default	❌ Tak encrypted by default (tambah VPN on top untuk encryption)
Cost	Murah — per connection hour + data	Mahal — port hour + data out
Redundancy	2 tunnels per connection (active/passive)	Kena buat 2 connections ke different locations
Use case	Quick setup, backup, testing, small workloads	Production, compliance, large data transfer, hybrid cloud

Exam Pattern

“Consistent latency” / “dedicated” / “compliance” → Direct Connect.

“Quick setup” / “encrypted” / “backup connection” → Site-to-Site VPN.

“Encrypted + consistent latency” → Direct Connect + VPN (DX for private line, VPN on top untuk encryption).

🏗️

Full VPC Anatomy — Semua Components Dalam Satu Gambar

↑ Top

Ni macam “peta sebenar” — semua VPC components dan hubungan antara satu sama lain. Exam suka tanya “mana kena letak apa”.

AWS CloudRegion · ap-southeast-1

Virtual Private Cloud10.0.0.0/16

Availability Zone A

Public Subnet10.0.1.0/240.0.0.0/0 → IGW

Application Load Balancer

NAT Gateway+ Elastic IP

Private Subnet10.0.2.0/240.0.0.0/0 → NAT GW

App ServerEC2

DatabaseRDS

Internet Gateway · 1 per VPC · free

Internet Userspublic

Site-to-Site VPNIPsec tunnel

Direct Connectdedicated line

↑ VPN & Direct Connect link the VPC to your On-Premises Data Center

IGW

1 per VPC, free, bidirectional

NAT GW

Public subnet, outbound only, berbayar

Instance level, stateful, allow only

NACL

Subnet level, stateless, allow + deny

Route Table

Destination → Target per subnet

VPC Endpoint

Shortcut ke S3/DynamoDB (free) atau services lain

Exam Cheat: Apa Letak Mana?

PUBLIC SUBNET

• ALB / NLB
• NAT Gateway
• Bastion Host / Jump Box
• Web servers (with public IP)

PRIVATE SUBNET

• Application servers
• Databases (RDS, Aurora, DynamoDB)
• Lambda functions (VPC-connected)
• ElastiCache clusters

Production best practice:Duplicate structure across 2+ AZs — setiap AZ ada public + private subnet sendiri, dengan NAT Gateway sendiri. Kalau satu AZ down, traffic failover ke AZ lain. Ini yang dimaksudkan “zone-independent architecture”.

🧠

Memory Tricks — Cara Mudah Ingat

↑ Top

→

CIDR — IP Dari Mana?: Kau pilih sendiri dari RFC 1918 private ranges: 10.x, 172.16–31.x, 192.168.x. Bukan public IP. AWS default VPC guna 172.31.0.0/16.

→

Slash bukan bilangan IP: /16 bukan 16 IPs — ia 16 bits dikunci. 32−16=16 bits bebas → 2^16 = 65,536 IPs. /24 = 256 IPs, /27 = 32 IPs.

→

Network vs Host: 192.168.100.10/24 → 192.168.100 = Network (3 octets, 24 bits), .10 = Host. Semua devices dalam subnet sama berkongsi network portion yang sama.

→

Cari Network Address: IP/26: blok saiz 64. Cari gandaan 64 ≤ last octet. 191 → 128 ✓. Atau AND binary: 10111111 AND 11000000 = 10000000 = 128.

→

CIDR Formula: 32 − prefix = bits. 2^bits = total. Tolak 5 = usable. Hafal: /24=251, /26=59, /27=27

→

IGW vs NAT: IGW = dua arah (in + out), free. NAT = outbound je, berbayar. NAT DUDUK DALAM PUBLIC SUBNET!

→

SG = Stateful: "SG ingat siapa dia bagi masuk — reply auto OK". NACL = "check tiap packet dua arah, kena ada explicit rules"

→

SG tak boleh deny: SG = allow only. Nak block specific IP address? → Guna NACL Deny rule

→

NACL outbound trap: NACL stateless → kena ada outbound rule untuk ephemeral ports 1024–65535 untuk replies boleh keluar

→

VPC Peering = non-transitive: A↔B dan B↔C, tapi A tak reach C. Macam "kawan kawan bukan kawan aku". Guna TGW kalau 3+ VPCs

→

Gateway Endpoint = Free: "GD Free" — Gateway untuk S3 + DynamoDB = percuma. Interface Endpoint (semua lain) = berbayar

→

Default NACL vs Custom NACL: Default NACL = allow all (generous). Custom NACL = deny all by default (strict — kena add rules sendiri)

→

Route table troubleshoot: No internet? Check: (1) ada 0.0.0.0/0 route ke IGW? (2) subnet associate route table betul? (3) EC2 ada public IP?

→

Peering vs TGW: 2 VPCs = Peering (simpler, cheaper). 3+ VPCs semua nak communicate = Transit Gateway (transitive)

→

VPC macam Tailscale?: Lebih tepat: VPC = "tanah" AWS resources kau wujud. Tailscale/Site-to-Site VPN = tunnel yang connect places yang dah wujud.

🎯

Exam Quick Wins — Scenario → Jawapan

↑ Top

Scenario

Jawapan

Private subnet EC2 perlu download patches dari internet

NAT Gateway (letak dalam public subnet)

Block specific IP address dari masuk ke subnet

NACL — tambah Deny rule (SG tak boleh deny)

Subnet tak dapat access internet walaupun ada IGW

Check route table: ada 0.0.0.0/0 → IGW? Subnet associate?

EC2 private subnet access S3 tanpa NAT (jimat kos)

S3 Gateway VPC Endpoint (percuma)

EC2 private subnet write ke S3 — low latency + high security

S3 Gateway VPC Endpoint — traffic stays dalam AWS backbone, tak lalu internet, free

Connect 10 VPCs dan 3 on-premises data centers

Transit Gateway (TGW)

Connect 2 VPCs dari different accounts

VPC Peering (pastikan IP ranges tak overlap!)

High bandwidth, consistent low latency, on-prem ke AWS

Direct Connect

VPC A boleh reach B, B boleh reach C, tapi A tak boleh reach C

Non-transitive peering — buat A↔C peering atau guna TGW

Berapa usable IPs dalam /27?

2^(32−27) − 5 = 32 − 5 = 27 usable IPs

Access SSM, ECR dari private subnet secara private

Interface VPC Endpoint (PrivateLink) — berbayar

📎

Official Resources

↑ Top

📄 AWS Documentation

→VPC User Guide →VPC CIDR Blocks →Security Groups →Network ACLs →Internet Gateways →NAT Gateways →Route Tables →VPC Peering Guide →VPC Endpoints (PrivateLink)→Transit Gateway

🎓 AWS Official Resources

→VPC FAQs →VPC Pricing →AWS Networking Blog →SAA-C03 Exam Guide (PDF)→NAT Gateway Pricing

Also in this app

→ VPC Subnets & CIDR Diagram (Visual page)→ VPC Deep Notes (Learn page)→ VPC Practice Questions (Practice page)