Real-world scenario
A fintech startup is launching its customer portal. It must survive an AZ failure, serve users in Europe and Asia, never expose database credentials in code, and cache hot data to keep response times low.
By the end you can:
Follow the request/data flow through the architecture.
Work through each concept and mark it understood. This unlocks the knowledge check.
Your logically isolated private network inside AWS.
Why it matters
Everything network-facing lives here; it defines your security perimeter.
When to use it
Always. Design CIDR ranges up front to avoid overlap with on-prem and peers.
Gotcha (exam trap)
CIDR blocks cannot be resized down after creation — plan address space generously.
Finish the walkthrough above to unlock the check.
Use the simulated AWS console below to complete each mission step. No real AWS account is required.
Create a VPC with CIDR 10.0.0.0/16. This is the private network that will host all tiers.
Create an RDS MySQL instance named "prod-db" with Multi-AZ enabled. Place it in the database subnet group.
Create a KMS key named "prod-data-key" to encrypt the database and secrets.
Create a secret in Secrets Manager named "prod/db/password" with any value and rotation disabled for now.
Create an ElastiCache Redis cluster named "prod-cache" to offload reads from RDS.
Create an internet-facing application load balancer named "prod-alb".
Create an ASG named "prod-asg" behind the ALB. Use any launch template and 2 subnets.
Create a CloudWatch alarm named "high-cpu" for CPUUtilization above 80%.
Create a Route 53 hosted zone for "bleepxapp.io" so users can reach the app with a friendly name.
Create a CloudFront distribution with origin domain name "etl-exports-bleepx". This will cache static assets at the edge.
Bleepx skills build on each other. Continue your learning path across Query, Lab, and Cloud.