SOA-C03 · Domain 5 of 5

SOA-C03 Domain 5: Networking and Content Delivery

This domain covers operating AWS networking: configuring and optimizing VPC connectivity, setting up DNS and content delivery with Route 53 and CloudFront, and troubleshooting network connectivity problems.

Exam weight
18%
Official task statements
3
Estimated questions estimate
~9
Suggested study time estimate
15–25 hrs

About 10 min read Reviewed October 2026

Overview

Networking and Content Delivery covers operating and troubleshooting AWS networks. It has three task statements. Networking features and connectivity covers VPC configuration, subnets, route tables, internet and NAT gateways, VPC peering, Transit Gateway, VPC endpoints, and hybrid connectivity with VPN and Direct Connect. DNS and content delivery covers Route 53 routing policies and health checks and CloudFront content delivery. Network troubleshooting covers diagnosing connectivity issues with VPC Flow Logs, Reachability Analyzer, and by reasoning through security groups, network ACLs and routing.

At 18%, this domain is heavily operational and troubleshooting-focused. The exam gives connectivity symptoms and asks why traffic is blocked or how to connect networks. Knowing how security groups, network ACLs and route tables interact, and which diagnostic tool to use, is the central skill. VPNs moved into this domain in SOA-C03.

How it's tested

SOA-C03 questions describe a connectivity problem or a networking need and ask why traffic is blocked or how to connect or deliver it. This domain rewards systematic troubleshooting through the network layers and knowing the right diagnostic tool. Trace the path before choosing an answer.

  • Find what blocks traffic

    A connectivity failure is described, and you check security groups, network ACLs, route tables and gateways in turn.

  • Connect the networks

    A connectivity need is described, and you choose peering, Transit Gateway, VPC endpoints, VPN or Direct Connect.

  • Route and deliver

    A DNS or content-delivery need is described, and you choose the Route 53 routing policy or CloudFront.

Reasoning it through

Instances in a private subnet cannot reach the internet for updates. Checking the path, the security group allows outbound, the network ACL allows it, but the subnet's route table has no route to a NAT gateway. Adding a route to a NAT gateway in a public subnet lets the private instances reach the internet outbound. Systematically tracing the path to the missing route, rather than guessing, finds the cause.

Task statements 3

Official task statements from the Amazon Web Services outline, in outline order.

5.1 Implement and optimize networking features and connectivityVPC configuration, gateways, peering, Transit Gateway, endpoints, VPN and Direct Connect.
What it means
This covers VPC design with subnets and route tables, internet and NAT gateways, VPC peering and Transit Gateway for connecting networks, VPC endpoints for private access to AWS services, and hybrid connectivity with Site-to-Site VPN and Direct Connect. VPNs were moved into this task in SOA-C03.
What to understand
Route tables, gateways and endpoints determine what can reach what. NAT gateways give private subnets outbound internet access. Transit Gateway connects many VPCs and on-premises networks centrally. VPC endpoints reach AWS services privately. VPN is encrypted over the internet, while Direct Connect is a dedicated private link.
How it shows up
A connectivity need is described, and you must choose the gateway, peering, Transit Gateway, endpoint or hybrid connection.
Common confusion
Confusing VPC peering with Transit Gateway; peering connects two VPCs, while Transit Gateway connects many centrally.
5.2 Configure domains, DNS services, and content deliveryRoute 53 routing policies and health checks, and CloudFront.
What it means
This covers Route 53 for domain registration, DNS records and routing policies such as simple, weighted, latency, failover and geolocation, Route 53 health checks, and Amazon CloudFront for caching and delivering content from edge locations.
What to understand
Route 53 routing policies direct users to endpoints by different strategies: latency for the fastest Region, weighted for traffic splitting, failover for availability, and geolocation by user location. CloudFront caches content at the edge to reduce latency. Choosing the routing policy that matches the goal is the key skill.
How it shows up
A DNS routing or content-delivery need is described, and you must choose the Route 53 policy or CloudFront.
Common confusion
Confusing latency-based routing with geolocation routing; latency routing picks the fastest endpoint, while geolocation routes by the user's location.
5.3 Troubleshoot network connectivity issuesVPC Flow Logs, Reachability Analyzer, and reasoning through security groups, ACLs and routing.
What it means
This covers diagnosing connectivity problems with VPC Flow Logs to see accepted and rejected traffic, VPC Reachability Analyzer to test whether a path exists, CloudWatch network monitoring, and systematically checking security groups, network ACLs, route tables and gateways to find what blocks traffic.
What to understand
Connectivity can be blocked at several layers, so troubleshooting is systematic: confirm routing, then security groups (stateful), then network ACLs (stateless), then gateways. Flow Logs show whether traffic was accepted or rejected, and Reachability Analyzer tests a path without sending traffic.
How it shows up
A connectivity failure is described, and you must identify the blocking layer or the right diagnostic tool.
Common confusion
Confusing stateful security groups with stateless network ACLs when diagnosing why return traffic is blocked.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Route tables

    Determine where subnet traffic is directed.

    Remember
    A missing route is a common block.
    Tested as
    Troubleshooting questions.
    Trap
    Overlooking the route table.

  • NAT gateway

    Gives private subnets outbound internet access.

    Remember
    Needed for private instances to reach the internet.
    Tested as
    Connectivity questions.
    Trap
    Expecting outbound without it.

  • VPC peering vs. Transit Gateway

    Peering connects two VPCs; Transit Gateway connects many centrally.

    Remember
    Transit Gateway scales to many networks.
    Tested as
    Connectivity questions.
    Trap
    Using peering for a large mesh.

  • VPC endpoints

    Private access to AWS services without the internet.

    Remember
    They avoid internet and NAT for AWS services.
    Tested as
    Connectivity and cost questions.
    Trap
    Routing AWS-service traffic through NAT.

  • VPN vs. Direct Connect

    VPN is encrypted over the internet; Direct Connect is a dedicated link.

    Remember
    Direct Connect gives consistent performance.
    Tested as
    Hybrid questions.
    Trap
    Confusing the two.

  • Security group vs. network ACL

    Security groups are stateful and instance-level; network ACLs are stateless and subnet-level.

    Remember
    ACLs need explicit return rules.
    Tested as
    Troubleshooting questions.
    Trap
    Forgetting ACL return traffic rules.

  • Route 53 routing policies

    Simple, weighted, latency, failover and geolocation.

    Remember
    Choose by the routing goal.
    Tested as
    DNS questions.
    Trap
    Confusing latency with geolocation.

  • CloudFront

    Caches content at edge locations.

    Remember
    It reduces latency for users.
    Tested as
    Content-delivery questions.
    Trap
    Confusing it with Route 53.

  • VPC Flow Logs

    Record accepted and rejected traffic.

    Remember
    They show whether traffic was blocked.
    Tested as
    Troubleshooting questions.
    Trap
    Overlooking rejected entries.

  • Reachability Analyzer

    Tests whether a network path exists without sending traffic.

    Remember
    It pinpoints the blocking component.
    Tested as
    Troubleshooting questions.
    Trap
    Guessing instead of analyzing the path.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

VPC peering vs. Transit Gateway vs. VPC endpoints

ConceptMeaningKey differenceCommon trap
VPC peering Connects two VPCs Point-to-point Using it for a large mesh
Transit Gateway Connects many VPCs and on-premises Central hub Overbuilding for two VPCs
VPC endpoints Private access to AWS services Avoids internet and NAT Routing AWS traffic via NAT

Security group vs. network ACL

ConceptMeaningKey differenceCommon trap
Security group Instance-level, stateful Return traffic allowed automatically Expecting it to deny
Network ACL Subnet-level, stateless Needs explicit return rules Forgetting return traffic rules

Route 53 routing policies

ConceptMeaningKey differenceCommon trap
Latency Fastest endpoint by latency Performance Confusing with geolocation
Geolocation By user location Compliance or localization Confusing with latency
Failover Healthy endpoint on failure Availability Ignoring health checks

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Blame the security group only

    What candidates pick
    Assume a blocked connection is always a security group issue.
    Why it looks right
    Security groups are the common culprit.
    Why it's wrong
    Traffic can be blocked by route tables, network ACLs or missing gateways too; troubleshoot systematically.

    Clue to watch for The security group looks correct but traffic still fails.

  2. ACL return traffic

    What candidates pick
    Allow inbound on a network ACL but forget the outbound return rule.
    Why it looks right
    The inbound rule seems sufficient.
    Why it's wrong
    Network ACLs are stateless, so return traffic needs an explicit rule, unlike stateful security groups.

    Clue to watch for Requests arrive but responses are blocked.

  3. Peering for many VPCs

    What candidates pick
    Build a full mesh of VPC peering connections for many VPCs.
    Why it looks right
    Peering connects VPCs.
    Why it's wrong
    A full peering mesh does not scale; Transit Gateway connects many networks centrally.

    Clue to watch for Many VPCs and on-premises networks must interconnect.

  4. NAT for AWS services

    What candidates pick
    Route private-subnet traffic to AWS services through a NAT gateway.
    Why it looks right
    NAT provides outbound access.
    Why it's wrong
    A VPC endpoint reaches AWS services privately and avoids NAT and internet charges.

    Clue to watch for Private resources access AWS services.

  5. Latency is geolocation

    What candidates pick
    Use latency routing to send users to a Region required by their country.
    Why it looks right
    Both route by location-related factors.
    Why it's wrong
    Latency routing picks the fastest endpoint; geolocation routes by the user's location, which compliance needs.

    Clue to watch for Routing must follow the user's country, not speed.

Answer framework

For any Domain 5 scenario, use these steps to find the answer SOA-C03 expects.

  1. For connectivity failures, trace the path systematically: route table, then security group, then network ACL, then gateway or endpoint.
  2. Use VPC Flow Logs to see whether traffic was accepted or rejected and Reachability Analyzer to test whether a path exists.
  3. Remember security groups are stateful while network ACLs are stateless and need explicit return rules.
  4. For connecting networks, choose peering for two VPCs, Transit Gateway for many, VPC endpoints for AWS services, and VPN or Direct Connect for hybrid.
  5. For DNS and delivery, choose the Route 53 routing policy that matches the goal and CloudFront for edge caching, and document the fix.

Practice question

Instances in a private subnet cannot download operating-system updates from the internet. The security group allows outbound traffic and the network ACL allows it, but the connection still fails. What is the MOST likely cause?

Want more like this? The SOA-C03 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain is dominated by troubleshooting, so study a systematic method rather than isolated facts. Learn the ordered path that traffic takes, route table, security group, network ACL, gateway, and practice tracing where it breaks. Fix firmly the stateful security group versus stateless network ACL distinction, since forgetting ACL return rules is a classic cause of one-way connectivity failures.

Next, learn the connectivity options and when each applies: peering for two VPCs, Transit Gateway for many, VPC endpoints for AWS services, and VPN versus Direct Connect for hybrid. Then learn the Route 53 routing policies by goal and CloudFront for edge delivery.

Finally, learn the diagnostic tools: VPC Flow Logs for accepted and rejected traffic and Reachability Analyzer for path testing. Hands-on practice building a VPC and deliberately breaking connectivity to diagnose it is the best preparation. This is the final domain, so finish with full practice tests spanning all five.

FAQ

How much of SOA-C03 is Domain 5?

Networking and Content Delivery is 18% of the scored content, and it is heavily focused on troubleshooting.

How should I troubleshoot a blocked connection?

Trace the path systematically: check the route table, then the security group, then the network ACL, then gateways and endpoints, using Flow Logs and Reachability Analyzer to pinpoint the block.

What is the difference between a security group and a network ACL?

A security group is stateful and instance-level, so return traffic is allowed automatically. A network ACL is stateless and subnet-level, so return traffic needs an explicit rule.

When do I use Transit Gateway instead of VPC peering?

Use peering to connect two VPCs. Use Transit Gateway to connect many VPCs and on-premises networks through a central hub, since a full peering mesh does not scale.

What is the difference between latency and geolocation routing?

Latency-based routing sends users to the endpoint with the lowest latency. Geolocation routing sends them to an endpoint based on their geographic location, which suits compliance or localization.

Why can't my private instances reach the internet?

Private subnets need a route to a NAT gateway for outbound internet access. A missing route is a common cause even when security groups and ACLs allow the traffic.

How does Domain 5 connect to the rest of the exam?

Networking underpins every workload, so connectivity and its troubleshooting support the monitoring, reliability, deployment and security operations in the other domains.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered VPC connectivity, DNS, content delivery and network troubleshooting. Test whether you can trace a blocked path and choose the right networking option under exam conditions.

Take the SOA-C03 practice test Check your SOA-C03 readiness

Keep going