Which components define network boundaries within a VPC?

Which components define network boundaries within a VPC?

• A. Subnets, route tables, internet gateways, NAT gateways, security groups, and network ACLs.
• B. Security groups, firewalls, and load balancers.
• C. Physical routers and switches in on-premises data centers.
• D. DNS records and VPN concentrators.

Answer: (A)

Defining a VPC’s network boundary comes from how its IP space is partitioned and controlled at multiple levels. Subnets carve the VPC into isolated segments, so resources in different subnets are separated. Route tables decide how traffic moves between those subnets and toward gateways, enforcing paths within the VPC. An Internet gateway provides a path to the outside Internet, anchoring the boundary for resources that are publicly reachable. A NAT gateway lets private subnets access the Internet without exposing them directly, preserving a boundary between private resources and external networks. Security groups act as stateful firewalls at the instance level, controlling what can reach each resource, while network ACLs provide an additional subnet-level firewall to regulate traffic entering and leaving subnets. Together, these components define how traffic is allowed to flow and where it can go, which is what establishes the network boundary inside a VPC. Other elements like general firewalls, load balancers, DNS records, or VPN concentrators play important roles in security, availability, or connectivity, but they don’t by themselves define the fundamental boundary structure of a VPC in the way subnets, routing, gateways, and the two firewall layers do. Physical on-prem routers and switches are outside the VPC, and DNS or VPN devices relate to naming and external connections rather than shaping the VPC’s internal network boundary.

Defining a VPC’s network boundary comes from how its IP space is partitioned and controlled at multiple levels. Subnets carve the VPC into isolated segments, so resources in different subnets are separated. Route tables decide how traffic moves between those subnets and toward gateways, enforcing paths within the VPC. An Internet gateway provides a path to the outside Internet, anchoring the boundary for resources that are publicly reachable. A NAT gateway lets private subnets access the Internet without exposing them directly, preserving a boundary between private resources and external networks. Security groups act as stateful firewalls at the instance level, controlling what can reach each resource, while network ACLs provide an additional subnet-level firewall to regulate traffic entering and leaving subnets. Together, these components define how traffic is allowed to flow and where it can go, which is what establishes the network boundary inside a VPC.

Other elements like general firewalls, load balancers, DNS records, or VPN concentrators play important roles in security, availability, or connectivity, but they don’t by themselves define the fundamental boundary structure of a VPC in the way subnets, routing, gateways, and the two firewall layers do. Physical on-prem routers and switches are outside the VPC, and DNS or VPN devices relate to naming and external connections rather than shaping the VPC’s internal network boundary.