A VPC is not a single small box but an ensemble of route tables + gateways + firewalls + endpoints. When a problem of the "what's the most appropriate network design for this scenario?" type shows up on the exam, you have to be able to draw in your head where a packet starts, where it gets blocked, and where it slips out — then the answer becomes visible. Every service we covered over the week — IGW, NAT GW, Bastion/SSM, SG, NACL, Flow Logs, Peering, TGW, Endpoint, VPN, DX — is ultimately just a different facet of how the flow of packets is controlled.