VPC security layers: security groups vs network ACLs, public and private subnets, NAT gateways, bastion hosts vs Session Manager

A virtual private cloud (VPC) is your own isolated network in an AWS Region, defined by an IPv4 CIDR (Classless Inter-Domain Routing) block such as 10.0.0.0/16. You divide it into subnets, and each subnet lives in exactly one Availability Zone (AZ). Security in a VPC comes in layers: where a subnet can route, which firewalls sit in front of each resource, and how administrators reach machines. The exam expects you to design all three so that only the load balancer faces the internet and everything else stays private.