You cannot delete a subnet of a VPC until you terminate all instances inside it.

In this use of the wizard, a NAT gateway and an Elastic IP makes the public subnet Internet accessible.

Encryption and integrity protection is performed thanks to IPsec in this configuration. An Internet gateway is not required in this configuration.

There is a significant difference between the way Classic load balancers support security groups in EC2-Classic and in a VPC. In EC2-Classic, Elastic Load Balancing provides a special source security group that you can use to ensure that instances receive traffic only from your load balancer. You can't modify this source security group. In a VPC, you provide the security group for your load balancer, which enables you to choose the ports and protocols to allow. For example, you can open Internet Control Message Protocol (ICMP) connections for the load balancer to respond to ping requests (however, ping requests are not forwarded to any instances).

Each subnet in your VPC must be associated with a route table; the table controls the routing for the subnet. A subnet can only be associated with one route table at a time, but you can associate multiple subnets with the same route table.