Networking is the connective tissue of every AWS architecture, and the CLF-C02 exam expects you to recognize the handful of services that make it work — even though, as a Cloud Practitioner, you will never be asked to configure a route table by hand. The test is about recognition and purpose: given a scenario — “isolate resources in a private network,” “route users to the nearest healthy endpoint,” “cache content close to viewers,” “connect a data center to AWS over a dedicated line” — you need to name the right service. Each phrase maps to exactly one answer, and the exam is checking whether you can translate a networking need into the AWS service built for it.
This guide covers the networking and content-delivery services you must tell apart for the CLF-C02: Amazon VPC and its building blocks, Route 53 for DNS, CloudFront and edge locations for content delivery, and Direct Connect and Site-to-Site VPN for hybrid connectivity. We finish with a decision table, a comparison of the hybrid options, and an FAQ. If you are mapping out your preparation, start with the AWS Cloud Practitioner study plan and the exam guide for 2026.
Why Networking Shows Up Across the CLF-C02 Domains
The CLF-C02 blueprint splits into four domains — Cloud Concepts, Security and Compliance, Cloud Technology and Services, and Billing, Pricing and Support. Networking lives primarily in the Cloud Technology and Services domain, the largest at roughly a third of the exam, but it also threads through Security (network isolation) and Cloud Concepts (global reach and low latency). That cross-cutting nature is why a few networking services appear again and again in scenario questions.
The good news is that at the Cloud Practitioner level, the depth is shallow and the breadth is manageable. You need the what and why of each service, not the how. This pairs naturally with the AWS global infrastructure foundations — Regions, Availability Zones, and edge locations — because networking services are how you actually use that infrastructure. A VPC lives in a Region and spans Availability Zones; CloudFront runs at edge locations. Understanding the geography makes the services click.
Amazon VPC: Your Private Network in the Cloud
Amazon Virtual Private Cloud (VPC) is a logically isolated section of the AWS cloud where you launch resources into a virtual network that you define. Think of it as your own private data-center network, running on AWS infrastructure, that no other customer can see into. A VPC is Region-scoped — it exists in one Region and can span all the Availability Zones in that Region.
For the CLF-C02 you do not build a VPC, but you should recognize its core building blocks and what each is for.
| Component | What it does |
|---|---|
| VPC | The isolated virtual network boundary, defined by an IP address range |
| Subnet | A subdivision of the VPC’s IP range, living in a single Availability Zone |
| Public subnet | A subnet with a route to the internet (via an internet gateway) |
| Private subnet | A subnet with no direct route to the internet |
| Internet Gateway (IGW) | Allows resources in public subnets to reach the internet |
| NAT Gateway | Lets private-subnet resources reach the internet outbound without being reachable inbound |
| Route table | Rules that direct network traffic between subnets and gateways |
The exam-relevant idea is isolation and control. Resources in a private subnet — a database, for example — have no direct path from the internet, which is a foundational security pattern. A web server in a public subnet faces the internet; the database it talks to sits in a private subnet, reachable only from inside the VPC. That two-tier layout is the canonical answer to “how do you keep a database from being exposed to the internet?”
Two more terms the CLF-C02 may surface:
- Security groups — virtual firewalls attached to individual resources (like EC2 instances) that control inbound and outbound traffic. They are stateful: if you allow inbound traffic, the response is automatically allowed out.
- Network ACLs (NACLs) — an optional firewall layer at the subnet level. They are stateless: rules must be defined for both directions.
You do not need to write rules for either, but recognizing that a security group protects a resource and a NACL protects a subnet is fair game.
Route 53: DNS and Traffic Routing
Amazon Route 53 is AWS’s highly available and scalable Domain Name System (DNS) web service. Its job is to translate human-friendly names like www.example.com into the IP addresses computers use, and to route end users to the right endpoint. The name is a nod to port 53, the standard DNS port.
Route 53 does three things the CLF-C02 cares about:
- Domain registration — you can buy and manage domain names directly in Route 53.
- DNS routing — it answers DNS queries, directing traffic to AWS resources (like an Elastic Load Balancer or CloudFront distribution) or to external endpoints.
- Health checks — it monitors endpoint health and can route traffic away from unhealthy ones.
Where Route 53 goes beyond a plain DNS service is its routing policies, which decide which endpoint a query resolves to:
- Simple — one record, one answer.
- Weighted — split traffic by percentage across endpoints (useful for gradual rollouts).
- Latency-based — send users to the Region that gives them the lowest latency.
- Failover — route to a primary endpoint, and to a standby if the primary fails a health check.
- Geolocation — route based on where the user is located.
At the Cloud Practitioner level you do not need to configure these, but you should recognize that Route 53 can improve availability (failover) and performance (latency-based routing), not just resolve names. A question that mentions “automatically direct users to a backup site if the main one goes down” is pointing at Route 53 failover.
Amazon CloudFront: Content Delivery at the Edge
Amazon CloudFront is AWS’s Content Delivery Network (CDN). A CDN caches copies of your content — images, videos, web pages, APIs — at locations physically close to your users, so requests are served from nearby instead of traveling all the way to the origin server. Those locations are the edge locations in the AWS global infrastructure, and there are far more of them than there are Regions.
The mechanics the CLF-C02 tests:
- The origin is where the original content lives — an S3 bucket, an EC2-hosted application, or an Elastic Load Balancer.
- When a user requests content, CloudFront serves it from the nearest edge location. If the edge has a cached copy, it responds immediately; if not, it fetches from the origin, caches it, and serves it — so the next nearby user gets it fast.
- The result is lower latency for users and reduced load on the origin.
CloudFront also adds security value: it integrates with AWS Shield for DDoS protection and AWS WAF for web-application filtering, and it terminates HTTPS at the edge. So beyond speed, it is often the answer to “how do you deliver content globally with low latency and protect the origin?”
A classic exam distinction: Route 53 decides where a request goes (DNS resolution); CloudFront changes how fast content is delivered (edge caching). They are complementary, and a well-architected site frequently uses both — Route 53 resolves the domain to a CloudFront distribution, which caches and serves the content. If a question emphasizes caching content near users, the answer is CloudFront; if it emphasizes resolving a domain name or routing traffic between endpoints, the answer is Route 53.
Hybrid Connectivity: Direct Connect and Site-to-Site VPN
Many organizations run partly on-premises and partly in AWS, and they need a secure, reliable link between the two. The CLF-C02 expects you to know the two main options and, critically, when to choose each.
AWS Site-to-Site VPN
AWS Site-to-Site VPN creates an encrypted tunnel over the public internet between your on-premises network and your VPC. It is fast to set up, relatively inexpensive, and secure because traffic is encrypted end to end. Its limitation is that it rides the public internet, so bandwidth and latency depend on internet conditions and can vary.
AWS Direct Connect
AWS Direct Connect provides a dedicated, private physical network connection between your data center and AWS, bypassing the public internet entirely. Because it is a private line, it offers consistent, low latency, higher and more predictable bandwidth, and can reduce data-transfer costs at scale. The trade-offs are cost and lead time — provisioning a physical connection takes longer and costs more than standing up a VPN.
| Factor | Site-to-Site VPN | Direct Connect |
|---|---|---|
| Path | Encrypted tunnel over public internet | Dedicated private physical line |
| Setup speed | Fast (minutes to hours) | Slower (weeks — physical provisioning) |
| Cost | Lower | Higher |
| Performance | Variable (internet-dependent) | Consistent, low latency |
| Best for | Quick, secure, budget-friendly links | Steady high-bandwidth, latency-sensitive workloads |
The exam framing is a straight trade-off. If a scenario stresses consistent performance, high bandwidth, or latency-sensitive hybrid workloads, the answer is Direct Connect. If it stresses quick setup, lower cost, or encryption over the internet, the answer is Site-to-Site VPN. Some organizations use a VPN as a backup for a Direct Connect link, combining reliability with a cost-effective failover.
A Note on Global Reach and Low Latency
Networking is where two of AWS’s headline benefits — global reach and low latency — become concrete, and the CLF-C02 rewards connecting the service to the benefit:
- VPC delivers isolation and security within a Region.
- Route 53 delivers availability and routing globally.
- CloudFront delivers low latency by caching at edge locations worldwide.
- Direct Connect / VPN delivers hybrid connectivity between on-premises and AWS.
This maps back to the value proposition covered in cloud concepts, value, and the Well-Architected Framework: networking services are how AWS turns a global data-center footprint into fast, reliable experiences for end users.
Putting It Together: A Decision Table
| The scenario asks for… | Service |
|---|---|
| An isolated private network for your resources | Amazon VPC |
| Keeping a database off the public internet | Private subnet within a VPC |
| A resource-level virtual firewall | Security group |
| Translating a domain name to an IP address | Route 53 |
| Routing users to a backup site if the primary fails | Route 53 failover |
| Caching content close to users for low latency | CloudFront |
| Global content delivery with DDoS protection at the edge | CloudFront (with Shield/WAF) |
| A quick, encrypted link to AWS over the internet | Site-to-Site VPN |
| A dedicated, consistent, high-bandwidth link to AWS | Direct Connect |
Practicing Under Exam Conditions
The CLF-C02’s networking questions are recognition puzzles wrapped in plausible distractors — a scenario that mentions “low latency for global users” alongside options for Route 53, CloudFront, and Direct Connect, where only one fits the emphasis. Reading about the services builds understanding; answering timed scenario questions builds the reflex to spot the keyword that reveals the answer.
Sailor.sh’s AWS Cloud Practitioner mock exam bundle is built for exactly that. Each mock mirrors the real exam’s style and difficulty across all four domains, with detailed explanations for every option — so when you see “dedicated private connection” you immediately reach for Direct Connect, and when you see “cache near viewers” you reach for CloudFront. Combine it with the free AWS Cloud Practitioner practice questions and the core services overview to cover the rest of the service catalog.
Frequently Asked Questions
What is the difference between Route 53 and CloudFront?
Route 53 is a DNS service — it translates domain names into IP addresses and decides which endpoint a request should go to, using routing policies like latency-based and failover. CloudFront is a content delivery network — it caches content at edge locations near users so it is delivered faster. They are complementary: Route 53 often resolves a domain to a CloudFront distribution, which then serves cached content.
Do I need to configure a VPC for the CLF-C02 exam?
No. The Cloud Practitioner exam tests recognition and purpose, not configuration. You should know what a VPC is (an isolated virtual network in a Region), the difference between public and private subnets, and that security groups and NACLs control traffic — but you will not be asked to write route tables or firewall rules.
When should I choose Direct Connect over a VPN?
Choose Direct Connect when you need consistent, low-latency performance and high, predictable bandwidth for a hybrid workload, and can accept higher cost and longer setup time. Choose Site-to-Site VPN when you need a quick, lower-cost, encrypted connection over the public internet and can tolerate variable internet-dependent performance. Some organizations run a VPN as a backup to Direct Connect.
What are edge locations and how do they relate to CloudFront?
Edge locations are AWS sites, distinct from and far more numerous than Regions, positioned close to end users. CloudFront caches your content at these edge locations, so when a user requests it, the response comes from a nearby edge rather than the distant origin server. This lowers latency for users and reduces load on the origin.
What is the difference between a public and a private subnet?
A public subnet has a route to the internet through an internet gateway, so resources in it (like a web server) can be reached from and reach the internet. A private subnet has no direct internet route, so resources in it (like a database) are shielded from inbound internet traffic — a NAT gateway can still let them make outbound requests. Placing sensitive resources in private subnets is a core AWS security pattern.
Are security groups and network ACLs the same thing?
No. A security group is a stateful firewall attached to individual resources such as EC2 instances — allow inbound traffic and the response is automatically permitted out. A network ACL (NACL) is a stateless firewall at the subnet level, where you must define rules for both directions. Security groups protect resources; NACLs protect subnets.
Conclusion
AWS networking at the Cloud Practitioner level is about matching a need to a service, not configuring infrastructure. Anchor the four pillars: VPC for an isolated private network with public and private subnets; Route 53 for DNS resolution and traffic routing with availability-boosting policies; CloudFront for low-latency content delivery cached at edge locations; and Direct Connect versus Site-to-Site VPN for the dedicated-line-versus-encrypted-tunnel hybrid trade-off. Keep the Route 53–CloudFront distinction sharp — where a request goes versus how fast content arrives — and the Direct Connect–VPN trade-off crisp — consistent private performance versus quick, cheap, internet-based encryption — and the exam’s networking questions resolve to a single obvious answer.
When you are ready to pressure-test that recognition, work through the AWS Cloud Practitioner mock exam bundle and revisit the study plan to keep the remaining domains on track.