Step 2 — Compute & Networking

The compute and networking domains account for roughly 26% of the SAA-C03 exam. EC2 and VPC knowledge is foundational — nearly every architecture question assumes you can reason about instance placement, network routing, and traffic distribution.

EC2 — Elastic Compute Cloud

EC2 gives you virtual servers (instances) on demand. The exam tests your ability to choose the right instance type, the right purchasing model, and the right storage configuration for a scenario.

Instance Type Families (2026)

General Purpose    (M, T series) — Balanced CPU/memory. T-series has burstable CPU.
Compute Optimized  (C series)    — High CPU:memory ratio. Batch processing, HPC.
Memory Optimized   (R, X, z)     — Large in-memory workloads. Databases, SAP HANA.
Storage Optimized  (I, D, H)     — High I/O throughput. NoSQL, data warehousing.
Accelerated        (P, G, Inf2)  — GPU/Inferentia. ML training/inference.

Latest generation names end in a number (e.g., m7g, c7i). The suffix letter matters:

g = AWS Graviton (ARM, best price-performance in 2026)
i = Intel
a = AMD
n = Enhanced networking
d = NVMe local storage

EC2 Lifecycle

Pending ──► Running ──► Stopping ──► Stopped
                 │                       │
                 ▼                       ▼ (restart)
           Shutting-Down            (back to Pending)
                 │
                 ▼
           Terminated (permanent — data on EBS persists if DeleteOnTermination=false)

Stopped vs Terminated: A stopped instance retains its EBS root volume. A terminated instance deletes it (unless you changed the setting). Public IP changes on every stop/start — use an Elastic IP if you need a persistent address.

Security Groups vs NACLs

This comparison is tested constantly:

Security Groups                    │  Network ACLs (NACLs)
───────────────────────────────────┼────────────────────────────────────
Instance/ENI level                 │  Subnet level
Stateful (return traffic auto OK)  │  Stateless (must allow inbound + outbound)
Allow rules only                   │  Allow and Deny rules
Evaluated as a whole               │  Rules evaluated in number order (lowest first)
Default: deny all inbound          │  Default: allow all (VPC default NACL)

A common exam pattern: “You want to block a specific IP from reaching any instance in a subnet.” → NACL (can Deny). Security Groups cannot Deny.

VPC — Virtual Private Cloud

Every AWS account gets a default VPC. For production, you design your own. The VPC is your isolated network in the cloud.

VPC Architecture for High Availability

VPC: 10.0.0.0/16
├── Public Subnet A (10.0.1.0/24)   AZ us-east-1a
│     ├── EC2 Web Server
│     └── NAT Gateway (for private subnet outbound)
├── Public Subnet B (10.0.2.0/24)   AZ us-east-1b
│     └── EC2 Web Server
├── Private Subnet A (10.0.3.0/24)  AZ us-east-1a
│     └── RDS Primary
├── Private Subnet B (10.0.4.0/24)  AZ us-east-1b
│     └── RDS Standby (Multi-AZ)
│
Route Table (Public):  0.0.0.0/0 → Internet Gateway
Route Table (Private): 0.0.0.0/0 → NAT Gateway

Internet Gateway (IGW): Allows public subnets to send/receive traffic from the internet. Horizontally scaled, HA by default. One per VPC.

NAT Gateway: Lets private subnet resources (like your database server) initiate outbound internet connections (e.g., to download OS patches) without being directly reachable from the internet. Deployed in a public subnet, referenced from private subnet route tables. Managed, HA within AZ — deploy one per AZ for full HA.

Bastion Host (Jump Server): An EC2 instance in the public subnet used as a secure SSH gateway into private subnet instances. Modern alternative: AWS Systems Manager Session Manager (no bastion, no open port 22 needed).

VPC Connectivity Options

Scenario	Solution
Two VPCs in same account/region need to talk	VPC Peering
Many VPCs across accounts/regions	AWS Transit Gateway
On-premises to AWS (encrypted over internet)	Site-to-Site VPN
On-premises to AWS (dedicated private connection)	AWS Direct Connect
Access AWS services without public internet	VPC Endpoints (Interface or Gateway)

Gateway Endpoints (free) work for S3 and DynamoDB. Interface Endpoints (PrivateLink, paid per hour) work for all other services.

Elastic Load Balancing

ELB automatically distributes traffic across targets and is the key component for achieving high availability and horizontal scaling.

Three Load Balancer Types

Application Load Balancer (ALB)
  ├── Layer 7 (HTTP/HTTPS/WebSocket)
  ├── Content-based routing (URL path, hostname, headers, query strings)
  ├── Native support for containers (ECS/EKS)
  └── Best for: microservices, web apps, APIs

Network Load Balancer (NLB)
  ├── Layer 4 (TCP/UDP/TLS)
  ├── Millions of requests per second, ultra-low latency
  ├── Static IP per AZ (or Elastic IP) ← exam favorite
  └── Best for: real-time gaming, IoT, financial apps

Gateway Load Balancer (GWLB)
  ├── Layer 3 (IP packet level)
  ├── Deploys third-party virtual appliances (firewalls, IDS/IPS)
  └── Best for: network security inspection

Target Groups — The destination for load balancer traffic. Targets can be EC2 instances, IP addresses, Lambda functions (ALB only), or other ALBs. Health checks run against each target.

ALB Path-Based Routing Example:

ALB (my-app.com)
  ├── /api/*  ──► Target Group: API Servers (EC2 fleet)
  ├── /images/* ─► Target Group: Image Service (Lambda)
  └── /*       ──► Target Group: Web Servers (EC2 fleet)

Sticky Sessions: ALB can route a user’s requests to the same target using cookies. Useful for session-based apps, but creates uneven load — prefer stateless apps with ElastiCache for sessions instead.

Auto Scaling Groups

ASGs automatically add or remove EC2 instances based on demand. Combined with ELB, they form the backbone of elastic architectures.

ASG Configuration

Launch Template (defines what to launch)
  ├── AMI ID
  ├── Instance type (+ optional weighted mix)
  ├── Key pair
  ├── Security groups
  ├── User data script
  └── IAM instance profile

Auto Scaling Group
  ├── Min: 2 instances  (never go below this)
  ├── Desired: 4        (start here)
  ├── Max: 10           (never exceed this)
  ├── VPC + subnets     (launch across these AZs)
  └── ELB Target Group  (register new instances here)

Scaling Policies

Target Tracking (simplest) — “Keep average CPU at 60%.” ASG adds/removes instances automatically. This is the exam-recommended default.

Step Scaling — “When CPU > 70%, add 2 instances. When CPU > 90%, add 4.” More granular.

Scheduled Scaling — “Every Monday at 8 AM, set desired to 8.” For predictable load spikes.

Predictive Scaling — ML-based forecast using historical data. Pre-warms capacity before demand hits. Available as of 2021 and increasingly tested.

Warm Pools (2026 Trend)

Pre-initialized instances sitting in a stopped state. When ASG needs to scale out, warm pool instances start faster than launching from scratch — reduces scale-out latency from minutes to seconds for apps with long bootstrap times.

Exam Patterns to Recognise

“Instances need to span multiple AZs and traffic should be distributed” → ALB + ASG across multiple subnets
“Application needs a static IP for whitelisting by clients” → NLB (not ALB)
“Private EC2 needs to download updates from internet” → NAT Gateway in public subnet
“VPC to VPC in same region, lowest latency” → VPC Peering (not VPN, not Direct Connect)
“Block specific IP from all resources in a subnet” → NACL Deny rule
“Cheapest way to add fault tolerance to a single EC2” → Multi-AZ + ASG with min=2