Networking on the CLF-C02 is shallow but precise. Six questions on subnets, gateways and firewalls, with the reasoning attached — 2026 edition.
Here are 6 typical VPC and networking questions in the exam's own style — free, with the answer explained, no sign-up.
Straight to the 6 free questions ↓Networking is the part of the Cloud Technology and Services domain that looks intimidating and turns out to be shallow. The CLF-C02 does not ask you to design a network or work with address ranges. It asks whether you know what the pieces are and what each one is for. A handful of terms, cleanly separated, cover almost every question.
An Amazon VPC is your own isolated virtual network inside AWS. Everything else here lives in it. A VPC belongs to one Region, and inside it you create subnets, each of which sits in one Availability Zone. That scoping matters: because a subnet is tied to a single AZ, spreading your subnets across multiple AZs is how you make an application survive the loss of one.
A subnet is public or private based on one thing only: whether it has a route to an internet gateway. A public subnet has that route; a private subnet does not. Nothing about pricing, size or contents changes that definition — it is entirely about the route.
There are two ways to filter traffic in a VPC, and the exam tests the difference constantly:
Instance and stateful, or subnet and stateless. If you can say that sentence, you own this pairing.
Two gateways come up:
Answer each one before opening the explanation, then read past the correct letter to why the other three fail. VPC distractors are all plausible network components dropped into the wrong role — an internet gateway where a NAT gateway belongs, a network ACL described as stateful. The exam is checking whether you can keep the pieces straight, and that is exactly what the reasoning below drills.
What is an Amazon VPC?
A VPC is your own private, isolated network inside AWS, in which you place subnets and launch resources such as EC2 instances. Why not the others: a virtual server you control is EC2. A bucket is S3. A managed database is RDS. The VPC is the network those things live in, not the things themselves.
What is the defining difference between a public and a private subnet?
What makes a subnet public is a route to an internet gateway; without that route it is private, whatever else you configure. Why not the others: the public/private distinction is about routing, not pricing, not Region span, and not what runs inside. A subnet lives in a single Availability Zone regardless of its public or private status.
Which statement about security groups is correct?
A security group is a stateful, instance-level firewall: allow an inbound request and its response is allowed back automatically. Why not the others: the subnet-level, stateless firewall is the network ACL — that is the exam's favourite contrast. Security groups work by allowing traffic (there are no deny rules). And a security group is a control *inside* a VPC, not a replacement for one.
What does an internet gateway provide for a VPC?
An internet gateway is what connects a VPC to the public internet, so resources in a public subnet can reach it and be reached. Why not the others: it does not encrypt traffic — that is up to TLS or a VPN. DNS is handled by Route 53 and the VPC resolver. Flow logs are stored in CloudWatch Logs or S3, not by the gateway itself.
What is the scope of a VPC and a subnet?
A VPC is a Regional construct, and each subnet within it sits in exactly one Availability Zone — which is why spreading subnets across AZs is how you build for resilience. Why not the others: neither a VPC nor a subnet is global (IAM is the global one candidates confuse this with). And the scopes are not reversed: the VPC is the wider, Region-level boundary; the subnet is the narrower, AZ-level one.
A company runs instances in a private subnet that must download software updates from the internet, but must not be reachable from the internet. What enables this?
A NAT gateway lets instances in a private subnet make outbound connections to the internet while blocking unsolicited inbound connections — exactly the 'updates out, nobody in' requirement. Why not the others: giving the subnet a direct internet gateway route would make it public and reachable. A security group controls allowed traffic but cannot by itself provide outbound internet for a private subnet. A second VPC solves nothing here.
That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.
Continue with the 10 free questions →The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 390 more questions built exactly like them.
Collecting questions yourself
Practising with a system
Straight into the player. No account, no email.
Updated for CLF-C02 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.