Skip to content

Cloud networking basics

Routes decide where a packet can go; security groups and network ACLs decide whether it may, and only the security group remembers.

Predict first

Before you read: predict

ExamHall's Postgres runs in the subnet data-a (10.0.20.0/24) with the security group sg-db: one inbound rule, TCP 5432 from sg-api, and no outbound rules. data-a has a custom network ACL whose only numbered rule is inbound 100 ALLOW TCP 5432 from 10.0.10.0/23. An API task in app-a (10.0.10.0/24), in sg-api, which allows all outbound traffic, opens a connection to Postgres; app-a uses the VPC's default network ACL. The request reaches Postgres.

In this lesson's VPC model, what do sg-db and data-a's network ACL each do with Postgres's reply?

Pick one

The 30-second version

A VPC is your own network, cut into subnets; each subnet's route table decides where its traffic goes. A route to an internet gateway makes a subnet public. Security groups guard each resource and are stateful: a reply to allowed traffic passes. Network ACLs guard each subnet and are stateless: a reply needs a rule of its own.

Routes decide where a packet can go; security groups and network ACLs decide whether it may, and only the security group remembers.

How it works

Step 1 of 13

A private address range. A VPC is a CIDR block, such as 10.0.0.0/16, cut into subnets; each subnet sits in one Availability Zone.

Analogy: A shopping centre's mall, its back-of-house corridors and their signs

In the shopping centre In the VPC
shop units open onto the mall, and the mall onto the street a public subnet (step 5)
the cash office opens only onto a service corridor a private subnet (step 5)
of the signs that point to a unit, the one naming the narrower block is followed the most specific route (step 3)
a shop's door attendant lets out again whoever she let in a stateful security group (step 10)
the corridor turnstile checks everyone, each way, against its numbered list a stateless network ACL (steps 11, 12)
the courier desk sends the offices' parcels out and hands back what returns a NAT gateway (step 7)
the safe room has no door onto any public space the database's subnet (step 13)

In real terms: every packet is routed by its subnet's table, checked by the subnet's ACL on the way in and out, and checked by the resource's security group, which remembers the connection.

Breaks down when: a shop's attendant knows faces, while a security group knows only addresses, ports and the groups it names.

Contrasting case: a strong password and TLS guard the database's login; they say nothing about who can open a connection to its port (step 13).

Examples, run for real

4.1 ExamHall EXH-4780 → MR !5080: a load balancer open to everyone

ExamHall's traffic should reach its Application Load Balancer only through Cloudflare, which terminates TLS at the edge and filters bots. The load balancer sits in the public subnets with sg-alb, which allowed TCP 443 from 0.0.0.0/0, so a script that found the load balancer's own address skipped Cloudflare entirely (EXH-4780). MR !5080 allows 443 only from Cloudflare's published ranges (here the stand-in 192.0.2.0/24).

4.1 EXH-4780, sg-alb 443 from 0.0.0.0/0: via Cloudflare (192.0.2.15) connects · direct from 203.0.113.50 connects
4.1 MR !5080, sg-alb 443 from 192.0.2.0/24: via Cloudflare (192.0.2.15) connects · direct from 203.0.113.50 refused at alb's security group

The load balancer's address still answers, but only Cloudflare's ranges get a connection; the hostname's DNS and TLS stay at Cloudflare (step 8).

4.2 Proof domain, payments ledger: a reply with no rule

A ledger's API in ledger-app queries Postgres in ledger-db. A hardening change gave ledger-db a custom network ACL admitting TCP 5432 from the app subnets, with no outbound rule; the database's security group has no outbound rule either. Every query timed out.

4.2 before: API -> Postgres 5432: ledger-db acl in pass · postgres group in pass · reply: postgres group reply out pass · ledger-db acl reply out drop -> query times out
4.2 after, ledger-db outbound 100 ALLOW TCP 1024-65535 to 10.0.10.0/23: reply: postgres group reply out pass · ledger-db acl reply out pass · ledger-app acl reply in pass · api group reply in pass -> query answered

The security group passed the reply; the ACL needed an outbound rule for the API's ephemeral ports (steps 10, 12).

Try it

Answer first, then check. Nothing is saved.

Question 1 of 6

A payments ledger's reconciliation worker runs in the subnet ledger-app of a VPC whose range is 10.0.0.0/16. The subnet's route table, as the console lists it:

10.0.0.0/16      local
10.1.0.0/16      pcx-ledger-archive
10.1.4.0/22      tgw-core
10.1.4.128/25    vgw-bank
0.0.0.0/0        nat-ledger

The worker opens a connection to the settlement service at 10.1.4.25.

In this lesson's VPC model, which target fills the slot: its packets leave the subnet through ____?

Pick one

Question 2 of 6

A payments ledger's subnet ledger-app sends 0.0.0.0/0 to a NAT gateway in the public subnet ledger-web, whose Elastic IP is 198.51.100.20; ledger-web sends 0.0.0.0/0 to the internet gateway. A settlement worker in ledger-app (private address 10.0.10.7, no public address) has a security group that allows inbound TCP 8443 from 0.0.0.0/0 and all outbound traffic; both subnets use the default network ACL. First the worker calls the bank's API at 203.0.113.10 on 443. Then the bank's server sends a webhook to 198.51.100.20 on 8443.

In this lesson's VPC model, which connections succeed?

Pick one

Question 3 of 6

A review finds three ExamHall Postgres instances. A mistaken change has opened each one's security group to TCP 5432 from 0.0.0.0/0, and every subnet uses the default network ACL. exam-db sits in data-a, whose route table has only the local route, and has only its private address, 10.0.20.10. archive-db sits in public-a, whose route table sends 0.0.0.0/0 to the internet gateway, and has only its private address, 10.0.0.41. reports-db also sits in public-a and has the public address 198.51.100.40. A laptop on the internet (203.0.113.60) tries each database's address on 5432.

In this lesson's VPC model, how many of the three accept the connection?

Pick one

Question 4 of 6

ExamHall's Redis runs in data-a with the security group sg-redis, whose one inbound rule reads TCP 6379 from ____. Four clients may try it, each with a security group that allows all outbound traffic: two API tasks in sg-api, one in app-a (10.0.10.0/24) and one in app-b (10.0.11.0/24); the BullMQ worker in app-a, in sg-worker; and the load balancer's node in public-a (10.0.0.0/24), in sg-alb. Every subnet uses the default network ACL, and the VPC's address range is 10.0.0.0/16. Both API tasks must connect, and neither the worker nor the load balancer.

In this lesson's VPC model, which source fills the slot?

Pick one

Question 5 of 6

A payments ledger's load balancer sits in the public subnet ledger-web at 198.51.100.30, and its security group allows TCP 443 from 0.0.0.0/0. ledger-web has a custom network ACL whose only numbered inbound rule is 100 ALLOW TCP 443 from 0.0.0.0/0; its outbound rules allow all traffic. The team must stop clients in 203.0.113.0/24 from reaching the load balancer on 443 and keep it open to everyone else.

In this lesson's VPC model, which change fills the gap?

Pick one

Question 6 of 6

ExamHall's proctoring relay runs in the subnet app-b, whose route table holds the local route and 0.0.0.0/0 to a NAT gateway in public-a. The relay was launched with a public address, 198.51.100.60. Its security group allows inbound TCP 443 from 0.0.0.0/0 and all outbound traffic, and every subnet uses the default network ACL. A candidate's browser (203.0.113.80) opens a connection to 198.51.100.60 on 443, and the relay calls a vendor's API at 203.0.113.90 on 443.

In this lesson's VPC model, which connections succeed?

Pick one

Go deeper

Pro tip
  1. Draw the request path hop by hop with the security-group rule that allows each hop; if you cannot name the rule, the hop is either blocked or too open. When: the interviewer asks you to walk a request from the browser to the database, hop by hop (one of the row's typical questions). Status: SELF; the curriculum row's tip, not run.
Source

Valid as of 2026-10-17. Every rule of the model is quoted from these pages in lib/vpc.mjs.

Related lessons

Checked against the tools and docs as of 2026-10-17.