Case studies

Real infrastructure, studied on its own terms. Company cases describe only publicly documented architecture and cite every source; pattern studies teach the designs the exam expects you to reach for.

A global network backbone with AWS Cloud WANTrade a hand-stitched Transit Gateway mesh for one declarative policy that AWS turns into a segmented global backbone.1.5 1.6 2.2Centralized egress and traffic inspectionOne inspection VPC behind Transit Gateway steers every spoke's egress and east-west traffic through a firewall before a shared NAT.1.6 4.1 3.3Exposing a service privately with AWS PrivateLinkPublish one service, let hundreds of accounts reach it privately, and never fight a CIDR overlap again.1.6 2.2 4.3Hub-and-spoke connectivity with AWS Transit GatewayOne Regional router replaces a mesh of VPC peerings, and its route tables decide which spokes can talk.1.5 1.6 2.2Hybrid DNS with Route 53 Resolver endpointsOn-prem and AWS resolve each other's names through inbound and outbound Resolver endpoints, not the VPC+2 address alone.1.2 2.3Lyft: Envoy and the service meshOne proxy on every host: how Lyft turned polyglot L7 chaos into a uniform, observable service mesh.1.3 3.2Multi-Region resilience with Route 53 Application Recovery ControllerDNS is the switch that moves traffic between Regions; ARC is what lets you flip it when a Region is on fire.1.1 1.3 3.1Netflix: control plane on AWS, video on its own CDNWhy the biggest streamer runs everything on AWS except the one thing you'd expect: the video bytes.1.1 1.5Resilient hybrid connectivity: Direct Connect with VPN backupOne dedicated fiber is a single point of failure; BGP quietly parks a VPN behind it and swaps in when the fiber dies.1.5 2.1 3.1Running out of 10.0.0.0/8: IPv6 adoption patterns on AWSSixteen million private addresses feels infinite until the third acquisition, the second container platform, and the hundredth VPC all want a non-overlapping slice.1.6 2.2Slack's cellular architecture, or how to walk away from an availability zoneOne flaky network link between AZs in us-east-1 convinced Slack that surviving zone failures means being able to drain a zone in minutes, not diagnose it in hours.1.3 3.1The day DNSSEC took Slack down for 24 hoursA FedRAMP requirement, a Route 53 NSEC edge case, and a cached DS record: the most instructive DNSSEC failure ever written up.1.2 2.3What all in on AWS looks like when you are a regulated bankCapital One closed eight data centers and moved a Fortune 500 bank onto AWS, and the network that makes that survivable is a hub-and-spoke landing zone where every route is a governance decision.1.6 2.2 4.1Zoom: scaling real-time video during the 2020 surgeThirty times the daily participants in four months, and the fix was regional entry points plus an EC2 fleet growing by thousands of instances a day.1.1 3.3