The VPC console is overwhelming at first glance. CIDR blocks, subnets, route tables, IGW, NAT, Security Groups, NACLs, Egress-Only IGW. Familiarity makes it seem like simple clicks, but in operations, the same people repeat the same mistakes. "Private subnet but external API calls fail", "NACL set to all ALLOW but responses cut off", "thought I'd fit 16 instances in /28 but ran out of IPs at 11." Daily, someone falls into the same trap.
This section isn't about memorizing VPC components but understanding why they're designed this way. Why AWS layered a virtual network on top of EC2, why both stateful and stateless firewalls exist, why IPv6 has no NAT, why 5 IPs disappear from every subnet