VPC Networking: 7 Common Mistakes That Fail SAA-C03 Candidates

VPC networking questions account for 15-20% of the SAA-C03 exam. Yet, it's where most candidates lose the most points.

After reviewing thousands of practice test results, I've identified the 7 most common VPC mistakes that prevent candidates from passing. Master these, and you'll ace every VPC question.

Mistake #1: Confusing Security Groups with NACLs

The Problem: Candidates treat Security Groups and Network ACLs as interchangeable. They're not.

What You Need to Know:

Feature	Security Groups	Network ACLs
Level	Instance	Subnet
Rules	Allow only	Allow + Deny
Stateful	Yes (return traffic automatic)	No (must allow both directions)
Default	Deny all inbound, allow all outbound	Allow all
Order	All rules evaluated	Rules evaluated in order

Exam Scenario:

"You need to block traffic from a specific IP address to instances in your VPC. What's the best approach?"

❌ Wrong: Security Group (can't deny) ✅ Right: Network ACL with deny rule

Real Example:

Requirement: Block IP 203.0.113.0/24 from accessing web servers

Security Group attempt (FAILS):
- Can only allow rules
- No way to explicitly deny

NACL solution (WORKS):
Rule #: 100
Type: Custom TCP
Port: 80
Source: 203.0.113.0/24
Action: DENY

Mistake #2: Not Understanding NAT Gateway vs NAT Instance

The Confusion: Both provide internet access for private subnets, but the exam expects you to know when to use each.

Key Differences:

NAT Gateway:

• Managed by AWS
• Highly available within AZ
• Scales to 45 Gbps
• Cost: $0.045/hour + $0.045/GB processed
• No security groups (use NACLs)

NAT Instance:

• EC2 instance you manage
• Single point of failure
• Limited by instance type
• Cost: EC2 instance cost + data transfer
• Can use security groups

Exam Decision Tree:

Need HA and don't want to manage?
  → NAT Gateway

Need to use security groups or save money?
  → NAT Instance

Production workload?
  → NAT Gateway (always)

Cost Example:

Scenario: 1 TB/month of internet traffic

NAT Gateway:
- Gateway fee: $32.85/month (730 hours × $0.045)
- Data processing: $45 (1000 GB × $0.045)
- Total: $77.85/month

NAT Instance (t3.micro):
- Instance cost: $7.59/month
- Data transfer: $90 (1000 GB × $0.09)
- Total: $97.59/month

Verdict: NAT Gateway is cheaper AND managed!

Mistake #3: Wrong CIDR Block Sizing

The Problem: Choosing CIDR blocks that are too small or overlap with other networks.

CIDR Cheat Sheet:

CIDR	Usable IPs	Use Case
/16	65,531	Large production VPC
/20	4,091	Medium VPC
/24	251	Public subnet
/28	11	Small private subnet

AWS Reserves 5 IPs per subnet:

10.0.1.0/24 = 256 addresses
Minus AWS reserved:
- 10.0.1.0: Network address
- 10.0.1.1: VPC router
- 10.0.1.2: DNS
- 10.0.1.3: Future use
- 10.0.1.255: Broadcast

Usable: 251 addresses

Common Exam Trap:

"You need to deploy 50 EC2 instances. What's the smallest subnet?"

❌ Wrong: /26 (64 addresses) Actual usable: 64 - 5 = 59 ✅ But exam wants buffer!

✅ Right: /25 (128 addresses) Actual usable: 128 - 5 = 123 (allows growth)

Mistake #4: Incorrect Route Table Configuration

The Confusion: Not understanding route priority and default routes.

Route Table Rules:

1. Most specific route wins (/32 beats /24 beats /16)
2. Local route always wins (can't override)
3. No route = drop traffic

Exam Scenario:

VPC CIDR: 10.0.0.0/16

Route Table:
Destination        Target
10.0.0.0/16       local
0.0.0.0/0         igw-123
10.0.1.0/24       nat-456

Traffic from 10.0.2.5 to 10.0.1.10:
❌ Goes through NAT (10.0.1.0/24 is more specific)
✅ WRONG! Local route (10.0.0.0/16) always wins

Public Subnet Route Table:

Destination        Target
10.0.0.0/16       local
0.0.0.0/0         igw-abc123

Private Subnet Route Table:

Destination        Target
10.0.0.0/16       local
0.0.0.0/0         nat-abc123

Mistake #5: VPC Peering Misconceptions

Wrong Assumptions:

• Peering is transitive (it's NOT)
• Peered VPCs can have overlapping CIDRs (they CAN'T)
• Route tables update automatically (they DON'T)

VPC Peering Facts:

Non-Transitive:

VPC-A <-peering-> VPC-B <-peering-> VPC-C

VPC-A CAN talk to VPC-B ✅
VPC-B CAN talk to VPC-C ✅
VPC-A CANNOT talk to VPC-C ❌

Solution: Create direct peering A↔C

CIDR Requirements:

❌ INVALID Peering:
VPC-A: 10.0.0.0/16
VPC-B: 10.0.1.0/24  (overlaps!)

✅ VALID Peering:
VPC-A: 10.0.0.0/16
VPC-B: 172.16.0.0/16  (no overlap)

Route Table Updates:

After creating VPC peering connection:

VPC-A Route Table:
Destination        Target
10.0.0.0/16       local
172.16.0.0/16     pcx-123456  ← ADD THIS MANUALLY

VPC-B Route Table:
Destination        Target
172.16.0.0/16     local
10.0.0.0/16       pcx-123456  ← ADD THIS MANUALLY

Mistake #6: Internet Gateway vs Virtual Private Gateway

The Confusion: Both provide connectivity, but for different purposes.

Internet Gateway (IGW):

• Connects VPC to the internet
• One per VPC
• Horizontally scaled, HA
• No bandwidth constraints
• Use case: Public internet access

Virtual Private Gateway (VGW):

• VPN endpoint on AWS side
• Connects VPC to on-premises network
• Supports VPN and Direct Connect
• Use case: Hybrid connectivity

Exam Keywords:

• "Internet access" → IGW
• "On-premises" or "datacenter" → VGW
• "Site-to-Site VPN" → VGW
• "Direct Connect" → VGW

Mistake #7: Subnet Public vs Private Confusion

The Truth: Subnets aren't inherently "public" or "private". It's all about the route table.

What Makes a Subnet Public:

1. Route table with route to IGW (0.0.0.0/0 → igw-xxx)
2. Instances have public IP addresses
3. NACL allows inbound traffic

Common Trap:

Subnet has route to IGW but instances unreachable

Checklist:
☐ Route table has 0.0.0.0/0 → igw?
☐ Instance has public IP?
☐ Security group allows inbound?
☐ NACL allows inbound AND outbound?

Missing any? Traffic fails.

Quick Reference: VPC Exam Checklist

✅ Security Groups:

• Instance-level
• Stateful (return traffic automatic)
• Allow rules only
• All rules evaluated

✅ NACLs:

• Subnet-level
• Stateless (must allow both directions)
• Allow + deny rules
• Evaluated in order

✅ NAT Gateway:

• For private instances to access internet
• Place in public subnet
• Update private subnet route table (0.0.0.0/0 → nat)
• One per AZ for HA

✅ Internet Gateway:

• One per VPC
• Attach to VPC
• Update route table (0.0.0.0/0 → igw)
• Instances need public IP

✅ VPC Peering:

• Not transitive
• No overlapping CIDRs
• Update both route tables manually

Practice Scenario

Question: You have a VPC (10.0.0.0/16) with public subnet (10.0.1.0/24) and private subnet (10.0.2.0/24). Web servers in the private subnet need to download updates from the internet but shouldn't be directly accessible. What's required?

Answer:

1. Create NAT Gateway in public subnet (10.0.1.0/24)
2. Allocate Elastic IP for NAT Gateway
3. Update private subnet route table:
   • 10.0.0.0/16 → local
   • 0.0.0.0/0 → nat-gateway-id
4. Security group on private instances allows outbound HTTPS (443)
5. NACL on private subnet allows:
   • Outbound: 443 to 0.0.0.0/0
   • Inbound: Ephemeral ports (1024-65535) from 0.0.0.0/0

---

Practice VPC questions →