The OSI Model
| Layer | Name | Examples | AWS Service |
|---|---|---|---|
| 7 | Application | HTTP, HTTPS, FTP, DNS | API Gateway, CloudFront |
| 6 | Presentation | SSL/TLS, JPEG | ACM (TLS certs) |
| 5 | Session | NetBIOS, RPC | — |
| 4 | Transport | TCP, UDP | NLB (Layer 4) |
| 3 | Network | IP, ICMP | VPC, Route Tables |
| 2 | Data Link | Ethernet, MAC | Direct Connect (physical) |
| 1 | Physical | Cables, fiber | Direct Connect |
⚠ AWS Exam Tip
ALB = Layer 7. NLB = Layer 4. GLB = Layer 3. Frequently tested!
TCP vs UDP
TCP
- Connection-oriented (3-way handshake)
- Reliable, ordered delivery
- Flow control & congestion control
- Use for: HTTP, SSH, FTP, SMTP
UDP
- Connectionless — fire and forget
- No guarantee of delivery or order
- Very low latency overhead
- Use for: DNS, VoIP, video streaming, gaming
IP Addressing
32-bit IPv4 address in 4 octets: 192.168.1.100
Private IP Ranges (RFC 1918)
10.0.0.0/8 → AWS VPC default range
172.16.0.0/12 → AWS default VPC (172.31.0.0/16)
192.168.0.0/16 → Home networks☁️ AWS Context
AWS VPCs must use private IP ranges. The default VPC uses 172.31.0.0/16.
CIDR & Subnetting
CIDR notation combines an IP with a prefix length: 10.0.0.0/16
| CIDR | Total IPs | AWS Usable |
|---|---|---|
| /16 | 65,536 | 65,531 |
| /24 | 256 | 251 |
| /25 | 128 | 123 |
| /26 | 64 | 59 |
| /27 | 32 | 27 |
| /28 | 16 | 11 |
⚠ AWS Reserves 5 IPs Per Subnet
Network address, VPC router, DNS, future use, and broadcast. A /24 gives 251 usable IPs, not 254. Frequently tested!
# Quick formula: Total IPs = 2^(32 - prefix)
/24 = 2^8 = 256 IPs
/16 = 2^16 = 65,536 IPsKey Protocols & Ports
| Protocol | Port | Transport |
|---|---|---|
| HTTP | 80 | TCP |
| HTTPS | 443 | TCP |
| SSH | 22 | TCP |
| RDP | 3389 | TCP |
| DNS | 53 | UDP/TCP |
| DHCP | 67/68 | UDP |
| SMTP | 25/587 | TCP |
| MySQL/Aurora | 3306 | TCP |
| PostgreSQL | 5432 | TCP |
| Redis (ElastiCache) | 6379 | TCP |
| NFS (EFS) | 2049 | TCP |
DNS Record Types
| Record | Purpose | Example |
|---|---|---|
| A | Domain → IPv4 | example.com → 93.184.216.34 |
| CNAME | Alias to another domain | www → example.com |
| MX | Mail server | mail.example.com |
| TXT | Text info (SPF, verification) | "v=spf1..." |
| NS | Name servers for zone | ns1.aws.com |
| Alias (Route 53) | AWS-specific; map to AWS resource | apex.com → ALB DNS |
⚠ CNAME vs Alias
You cannot use CNAME at the zone apex (naked domain like example.com). Use Route 53 Alias records instead — they point to AWS resources and are free of charge.
NAT Gateway vs NAT Instance
NAT Gateway (Managed)
- Fully managed, highly available per AZ
- Private subnet → internet outbound only
- Requires Elastic IP in public subnet
- Scales to 45 Gbps automatically
NAT Instance (Legacy)
- EC2 instance doing NAT manually
- Must disable Source/Destination Check
- You manage patching and HA
- Can double as a bastion host
Load Balancers
| Type | OSI Layer | Protocol | Best For |
|---|---|---|---|
| ALB | 7 | HTTP, HTTPS, gRPC | Web apps, microservices, path-based routing |
| NLB | 4 | TCP, UDP, TLS | Ultra-low latency, static IP, gaming, IoT |
| GLB | 3 | IP | Inline virtual appliances (firewalls, IDS) |
Security Groups vs Network ACLs
Security Groups
- Instance level (ENI)
- Stateful — return traffic auto-allowed
- ALLOW rules only
- Default: deny all inbound, allow all outbound
Network ACLs
- Subnet level
- Stateless — must allow both directions
- ALLOW and DENY rules
- Rules evaluated lowest number first
AWS VPC Overview
A VPC (Virtual Private Cloud) is your isolated network in AWS.
- VPC — logical isolation; CIDR block (e.g., 10.0.0.0/16)
- Subnets — subdivide VPC; tied to one AZ
- Internet Gateway (IGW) — enables internet access for public subnets
- Route Tables — control where traffic goes
- NAT Gateway — outbound internet for private subnets
- VPC Peering — connect two VPCs (no transitive routing)
- Transit Gateway — hub-and-spoke for many VPCs (transitive)
- VPC Endpoints — private access to AWS services (no internet)
💡 Public vs Private Subnet
A public subnet has a route to an Internet Gateway (0.0.0.0/0 → igw-xxx). A private subnet has no such route. It's all in the route table!
📋 Study Checklist
Progress0%
- Name all 7 OSI layers and their functions
- Explain the difference between TCP and UDP
- Calculate the number of IPs in a CIDR block
- Identify private IP ranges (RFC 1918)
- Know why AWS reserves 5 IPs per subnet
- Explain DNS record types: A, CNAME, MX, TXT, Alias
- Know common ports: 22, 80, 443, 3306, 5432, 3389
- Explain NAT Gateway vs NAT Instance
- Explain ALB vs NLB vs GLB differences
- Explain Security Groups vs Network ACLs (stateful vs stateless)
- Understand VPC components: IGW, Route Tables, Subnets
- Explain VPC Peering vs Transit Gateway
- Understand VPC Endpoints (Gateway vs Interface)
- Explain Site-to-Site VPN vs Direct Connect
- Know what makes a subnet public vs private