Explain VPC, subnets, security groups and NACLs.

A VPC is a logically isolated network within AWS, defined by a CIDR block. Inside it you create subnets, each in a single availability zone.

• A public subnet has a route to an Internet Gateway. Resources with public IPs there are internet-reachable.
• A private subnet has no such route. For outbound internet access — downloading patches, calling an API — it routes through a NAT Gateway in a public subnet, which allows outbound but not inbound connections.

Security groups versus NACLs is the classic question:

• Security groups operate at the instance level, are stateful (return traffic is automatically allowed), and support allow rules only — everything not permitted is denied. They can reference other security groups as a source, which is the clean way to express "the application tier may reach the database tier".
• NACLs operate at the subnet level, are stateless (you must explicitly allow return traffic, including ephemeral ports), and support both allow and deny rules, evaluated in numbered order.

In practice security groups do most of the work; NACLs are a coarse secondary layer, most useful for blocking a specific address range.

Note: VPC endpoints are worth mentioning — they let instances in private subnets reach S3 and DynamoDB without traversing the internet or a NAT Gateway, improving security and cutting NAT data processing costs significantly.