The Network Layer

🌐

Networking on AWS

Never the headline on DOP-C02 — always the hidden third requirement. Connectivity, endpoints, DNS, and the debugging toolkit behind every deployment scenario.

~48 min total8 modules8 quiz questionsThe hidden layer in Domains 2, 3 & 5

DOP-C02 will not quiz you on subnet math. Instead it hides networking inside other scenarios: the pipeline that can’t pull images, the Lambda that times out, the two accounts that must share a filesystem. Every one of those puzzles decomposes into the same three layers.

The Three-Layer Triage — Click Each

💡A fix lives in exactly one layer. The question’s phrasing tells you which layers already pass: “DNS resolves but the connection times out” rules out layer 3 — jump straight to routes and security groups. “Name doesn’t resolve” — skip everything and go to layer 3.

Where Networking Hides on the Exam

Private pipeline can’t pull from ECRRoute — missing S3 gateway endpoint

Two accounts share an EFS filesystemRoute — peering/TGW between the VPCs

SSM can’t see private instancesRoute — the three SSM interface endpoints

Blue/green flips traffic between fleetsALB target groups (the deployment machinery)

Multi-region failoverResolution — Route 53 health checks + failover records

🎯Pattern for “choose three” questions: if two picks are IAM/permissions, the third is almost always the network layer — an endpoint, a peering connection, or a security group.