CLF-C02 Cloud Technology and Services Practice Question
Which AWS service enables you to create a private, isolated network within the AWS Cloud where you can define your own IP address range, subnets, and routing?
⚠ Common exam trap
It's easy for candidates to confuse AWS Transit Gateway with Amazon VPC, thinking Transit Gateway provides the isolated network itself, when in fact Transit Gateway only connects multiple VPCs and does not allow you to define IP ranges or subnets within a single isolated network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon VPC
Amazon VPC (Virtual Private Cloud) enables you to provision a logically isolated section of the AWS Cloud where you can define your own IP address range using CIDR notation (e.g., 10.0.0.0/16), create subnets across Availability Zones, and configure custom route tables to control traffic flow. This service gives you full control over your virtual networking environment, including the selection of private and public IP addresses, network gateways, and security settings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Direct Connect
Why it's wrong here
AWS Direct Connect establishes a dedicated physical network connection between your on-premises data center and AWS. This private, low-latency link is used to attach to a VPC, but it does not itself define the isolated virtual network. The network boundary, IP addressing, and subnet design are properties of the VPC that the Direct Connect connection is attached to.
- ✓
Amazon VPC
Why this is correct
Amazon VPC is the isolated virtual network environment where you provision AWS resources within a defined IP address space. You control subnets, route tables, network gateways, and security settings, giving you complete architectural authority over the network. Because it creates the logical boundary that separates your resources from the rest of the AWS cloud, this service defines the isolated network environment the question asks about.
- ✗
Amazon Route 53
Why it's wrong here
Amazon Route 53 is a scalable domain name system (DNS) web service that translates user-friendly domain names into numerical IP addresses for AWS resources. It resolves requests and routes users to endpoints like EC2 instances or load balancers, but it does not create any private or isolated network space. Instead of defining the network environment itself, Route 53 simply enables traffic to reach resources that are hosted inside a VPC.
- ✗
AWS Transit Gateway
Why it's wrong here
AWS Transit Gateway acts as a central hub that interconnects multiple VPCs and on-premises networks through a single gateway. It simplifies network topology and routing among attached networks, but it is fundamentally a routing service, not the underlying isolated virtual network. The Transit Gateway operates only after VPCs exist, so it cannot be the service that provides the isolated, customer-controlled network environment that defines the VPC.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.