Question 1

What is a VPC?

Accepted Answer

A Virtual Private Cloud is a logically isolated virtual network in an AWS region where you define your own IP address range, subnets, route tables and gateways. It is regional — a VPC cannot span regions — and it contains subnets that each live in a single Availability Zone. The regional scope is worth stating explicitly because it drives multi-region design: you need a VPC per region plus peering or Transit Gateway to connect them, unlike GCP where the VPC is global. That contrast comes up frequently.

Question 2

How do you plan CIDR ranges for a VPC?

Accepted Answer

Choose a private RFC 1918 range large enough for growth but non-overlapping with on-premises networks, partner networks and other VPCs you may ever peer with — typically a /16. Subnet it by AZ and tier, leaving room to add subnets. Remember AWS reserves five IP addresses in every subnet. Overlapping CIDRs are effectively unfixable without renumbering, since peering and Transit Gateway both require uniqueness. Naming the five reserved addresses — network, VPC router, DNS, future use and broadcast — is the detail that shows you have sized a subnet properly.

Question 3

What is the difference between a public and a private subnet?

Accepted Answer

A public subnet has a route table entry sending 0.0.0.0/0 to an internet gateway, so resources with public IPs are reachable from and can reach the internet. A private subnet has no such route; outbound access goes through a NAT gateway placed in a public subnet. The correction interviewers look for is that a subnet is public because of its *route table*, not a setting on the subnet. Candidates who think it is a checkbox usually cannot explain why the NAT gateway itself must live in the public subnet.

Question 4

What is the difference between a security group and a network ACL?

Accepted Answer

A security group is stateful, attached to an ENI, supports only allow rules, and evaluates all rules together — return traffic is automatically permitted. A network ACL is stateless, applies at the subnet level, supports allow and deny rules evaluated in numbered order, and requires explicit rules in both directions. This is the single most-asked AWS networking question. The practical guidance is to do most work in security groups and use NACLs only for coarse subnet-level denies, because stateless rules require you to remember ephemeral port ranges for return traffic — a classic source of mysterious failures.

Question 5

What is a NAT gateway and how does it differ from a NAT instance?

Accepted Answer

A NAT gateway is a managed, highly available service within one AZ that gives private-subnet resources outbound internet access with no inbound path. A NAT instance is an EC2 instance you configure and operate yourself, which you must scale, patch and make highly available. The two facts to add: a NAT gateway is zonal, so a truly resilient design needs one per AZ with route tables pointing to the local one, and it charges hourly plus per GB processed — often a surprisingly large bill line. VPC endpoints for S3 and DynamoDB remove that data-processing charge for those services.

Question 6

What is an internet gateway and an egress-only internet gateway?

Accepted Answer

An internet gateway is a horizontally-scaled VPC component that allows bidirectional IPv4 and IPv6 internet communication for resources with public addresses. An egress-only internet gateway provides outbound-only IPv6 access, the IPv6 equivalent of a NAT gateway, since IPv6 addresses are globally routable. The reason the egress-only variant exists is that IPv6 has no NAT — every address is public — so a separate construct is needed to allow outbound while blocking inbound. That is a good detail because it shows you understand why IPv6 changes the model.

Question 7

What is a VPC endpoint and what types exist?

Accepted Answer

A gateway endpoint adds a route table entry for S3 or DynamoDB, is free, and keeps traffic on the AWS network. An interface endpoint, powered by PrivateLink, creates an ENI with a private IP in your subnet for a wide range of services, charged hourly plus per GB. The cost angle is a strong practical point: a free S3 gateway endpoint removes NAT gateway data-processing charges for S3 traffic, which can be a large saving as well as a security improvement. Endpoint policies allow further restriction, such as only permitting access to specific buckets.

Question 8

What is AWS PrivateLink?

Accepted Answer

PrivateLink exposes a service — an AWS service, your own service behind a Network Load Balancer, or a SaaS partner — through an interface endpoint with a private IP in the consumer VPC. Traffic never traverses the internet, and there is no route sharing or CIDR overlap concern. The advantage over peering is granularity: peering connects entire networks and requires non-overlapping CIDRs, while PrivateLink exposes exactly one service through one address, unidirectionally. That is how SaaS vendors integrate into customer VPCs without network-level trust.

Question 9

What is VPC peering and what are its limitations?

Accepted Answer

Peering connects two VPCs so resources communicate using private IPs over the AWS network. Limitations: CIDRs must not overlap; peering is not transitive, so if A peers with B and B peers with C, A cannot reach C; and there is a limit on peering connections per VPC. Routes must be added on both sides. Non-transitivity is the constraint that forces architectural decisions — a full mesh of N VPCs needs N(N-1)/2 connections, which becomes unmanageable quickly. That is exactly the problem Transit Gateway was built to solve.

Question 10

What is AWS Transit Gateway?

Accepted Answer

Transit Gateway is a regional hub that connects VPCs, VPN connections and Direct Connect gateways in a hub-and-spoke topology with transitive routing, replacing a mesh of peering connections. It supports multiple route tables for segmentation and can peer across regions. The segmentation capability is the feature worth naming: separate route tables let you isolate production from development while both attach to the same gateway, which peering cannot express. The cost model — per attachment hour plus per GB — is the trade-off against peering, which has no hourly charge.

Question 11

How do you connect an on-premises data centre to AWS?

Accepted Answer

Site-to-Site VPN creates IPsec tunnels over the internet, quick to set up and cheap but bounded by internet quality; each connection has two tunnels for redundancy. Direct Connect provides a dedicated private physical link with consistent latency and lower data transfer cost. Many designs use Direct Connect with a VPN as backup. The resilience detail is that a single Direct Connect connection is a single point of failure, so a proper design uses two connections at different locations, or Direct Connect plus VPN failover. Naming the SLA implications of each configuration is the senior touch.

Question 12

What is a Direct Connect gateway and a virtual interface?

Accepted Answer

A virtual interface is the logical connection over Direct Connect: private VIFs reach VPCs, public VIFs reach AWS public endpoints, and transit VIFs reach a Transit Gateway. A Direct Connect gateway lets one connection reach VPCs in multiple regions and accounts without a separate circuit each. The Direct Connect gateway is what makes a single physical circuit economical for a multi-region, multi-account estate. Knowing the three VIF types and what each reaches is the concrete knowledge that distinguishes someone who has provisioned one.

Question 13

How does DNS work inside a VPC?

Accepted Answer

The VPC provides a DNS resolver at the base of the VPC CIDR plus two, and at 169.254.169.253. enableDnsSupport and enableDnsHostnames control resolution and public hostname assignment. Route 53 private hosted zones provide internal names, and Route 53 Resolver endpoints forward queries to and from on-premises resolvers. Resolver endpoints are the hybrid piece: inbound endpoints let on-premises systems resolve AWS private names, and outbound endpoints with forwarding rules let AWS resources resolve on-premises names. Every hybrid design needs both, and forgetting them is a common cause of "the VPN works but nothing resolves".

Question 14

What are VPC Flow Logs and what do they capture?

Accepted Answer

Flow Logs record metadata about IP traffic to and from network interfaces — source and destination address and port, protocol, packet and byte counts, and whether the flow was accepted or rejected — delivered to CloudWatch Logs, S3 or Kinesis Data Firehose. They capture metadata, not packet contents. They are the primary tool for answering "is the security group or the NACL blocking this" because a REJECT record tells you traffic reached the interface and was denied, while no record at all means it never arrived. That diagnostic distinction is the practical value.

Question 15

How would you troubleshoot connectivity between two EC2 instances?

Accepted Answer

Check they are in the same VPC or connected VPCs with routes in both directions; check the security groups allow the traffic in the relevant direction; check NACLs on both subnets allow both request and return traffic; check the OS firewall inside the guest; then use VPC Reachability Analyzer, which traces the path and names the blocking component. Reachability Analyzer is the strongest move because it evaluates the configuration and identifies the exact rule that blocks the path, turning a guessing game into a definitive answer. The OS firewall is the second half people forget — AWS configuration can be perfect while iptables drops the packet.

Question 16

What is the difference between an Elastic IP, a public IP and a private IP?

Accepted Answer

A private IP comes from the subnet range and is used inside the VPC. A public IP is assigned automatically from AWS's pool, changes when the instance stops and starts, and is not held by your account. An Elastic IP is a static public address allocated to your account that you can remap between resources. The current cost detail matters: since 2024 all public IPv4 addresses are charged hourly whether attached or not, which changed the economics of assigning public IPs to every instance. Preferring load balancers and NAT gateways is now a cost decision as well as a security one.

Question 17

What is an elastic network interface and why would you attach a second one?

Accepted Answer

An ENI is a virtual network card with a MAC address, private IPs, security groups and optionally a public or Elastic IP. A second ENI is used for a management network separate from application traffic, for appliances that need dual-homing, or for a failover pattern where a fixed IP and MAC move to a standby instance. The failover use case is the concrete one: licensing tied to a MAC address, or a fixed management address that must survive instance replacement. Naming the maximum ENIs and IPs per instance type as a constraint shows you have hit the limit.

Question 18

How do you design a VPC for a three-tier application?

Accepted Answer

Public subnets in at least two AZs for the load balancer and NAT gateways; private application subnets for the compute tier; private data subnets for RDS and ElastiCache with no route to the internet. Security groups reference each other — the app group allows the ALB group, the database group allows the app group — rather than using CIDR ranges. Security-group referencing is the idiomatic AWS pattern and is what makes the design survive scaling and IP changes. Placing databases in subnets with no internet route at all, rather than relying only on security groups, is the defence-in-depth element.

Question 19

What is a NAT gateway's availability model and how do you make it resilient?

Accepted Answer

A NAT gateway lives in a single Availability Zone and is redundant within it, but if that AZ fails, private subnets routing through it lose outbound access. Resilience requires one NAT gateway per AZ with each private subnet's route table pointing to the gateway in its own AZ. This is a very common real-world gap: a single NAT gateway is cheaper and works fine until an AZ event, at which point two-thirds of the fleet loses internet access. The cost trade-off is real, so the answer should acknowledge it rather than treating the choice as obvious.

Question 20

How does data transfer pricing work inside a VPC?

Accepted Answer

Traffic within the same AZ using private IPs is free. Traffic between AZs in the same region is charged in both directions. Traffic between regions is charged. Traffic out to the internet is charged. Traffic through a NAT gateway carries a per-GB processing charge on top of transfer. Cross-AZ charges are the invisible cost in multi-AZ architectures — a chatty service calling a database in another AZ pays continuously in both directions. Naming that, and the NAT processing charge, covers the two costs people most often miss.

Question 21

What is a Gateway Load Balancer and what is it for?

Accepted Answer

Gateway Load Balancer distributes traffic to a fleet of third-party virtual network appliances — firewalls, intrusion detection, deep packet inspection — using the GENEVE protocol on port 6081, preserving the original packet so appliances see unmodified traffic, with health checking and scaling. It exists because inserting a security appliance into the traffic path previously required awkward routing and manual scaling. Naming the GENEVE encapsulation and that it operates transparently at layer 3 is what shows genuine familiarity rather than a product-page summary.

Question 22

What is AWS Network Firewall?

Accepted Answer

A managed stateful network firewall and intrusion detection service for VPCs, supporting Suricata-compatible rules, domain filtering, protocol detection and stateless rules, deployed in dedicated subnets with traffic routed through firewall endpoints. The distinction from security groups and NACLs is depth: it inspects at the application protocol level and supports egress domain filtering, which security groups cannot express since they only understand IPs and ports. Egress filtering is the common driver.

Question 23

How do you restrict outbound internet access from a VPC?

Accepted Answer

Remove the default route where possible and route egress through a controlled path: a NAT gateway with Network Firewall applying domain allow-lists, or an outbound proxy. Use VPC endpoints so AWS service traffic never leaves the VPC. Security group egress rules can restrict destinations by IP but not by domain. The reason security groups are insufficient is that modern endpoints are behind CDNs with rotating IPs, so IP-based egress rules are unmaintainable. Domain-based filtering with Network Firewall or a proxy is the workable control, and saying so shows practical experience.

Question 24

What is the default VPC and should you use it?

Accepted Answer

AWS creates a default VPC in each region with a /16 CIDR, a public subnet in each AZ, an internet gateway and a permissive default security group, so instances launch with internet access immediately. It is convenient for experimentation and unsuitable for production because everything is public by default. The governance recommendation is to delete default VPCs in production accounts, or at least prevent their use, so nobody accidentally launches a database into a public subnet. Control Tower and Config rules can enforce that.

Question 25

What happens if a security group rule and a NACL rule conflict?

Accepted Answer

Both must permit the traffic. NACLs are evaluated at the subnet boundary and security groups at the interface, so a deny in either blocks the packet. Because NACLs are stateless, an inbound allow without a matching outbound rule for ephemeral ports blocks the response even though the request arrived. The ephemeral-port trap is the specific failure this question is testing — a rule set that looks correct blocks return traffic. Knowing the ephemeral range differs by operating system is the detail that separates people who have debugged it.

Question 26

What is VPC Reachability Analyzer?

Accepted Answer

A configuration analysis tool that traces the network path between two resources — instances, interfaces, gateways — and reports whether it is reachable, and if not, exactly which component blocks it: a route table, security group, NACL or missing gateway. It analyses configuration without sending packets. Because it is static analysis, it works even when the resources are stopped, which is useful for validating a design before deploying. Naming it as the first tool for any connectivity question is a strong practical answer.

Question 27

How do you share a VPC across accounts?

Accepted Answer

With AWS Resource Access Manager, a central networking account shares specific subnets with participant accounts, which then launch resources into them while the owner retains control of the VPC, route tables and gateways. It avoids VPC sprawl and duplicated NAT gateways and endpoints. The cost benefit is substantial — one set of NAT gateways and interface endpoints serving many accounts rather than duplicating them per account. The governance benefit is that a central team owns the network while application teams keep their own accounts.

Question 28

What is an IPv6 deployment on AWS like?

Accepted Answer

You associate an IPv6 CIDR with the VPC and subnets, assign addresses to instances, use an internet gateway for bidirectional traffic and an egress-only internet gateway for outbound-only. There is no NAT for IPv6, and security groups and NACLs need explicit IPv6 rules alongside IPv4 ones. The security consequence of no NAT is the point: every IPv6 address is globally routable, so the accidental protection that NAT provided for IPv4 is gone and security groups become the only barrier. Forgetting IPv6 rules while adding IPv6 addresses is a real exposure.

Question 29

What is the difference between an ALB, NLB and CLB?

Accepted Answer

The Application Load Balancer operates at layer 7 with host and path routing, header conditions, HTTP/2 and WebSocket support, and native integration with Cognito and WAF. The Network Load Balancer operates at layer 4 with very high throughput, ultra-low latency, static IPs per AZ and source IP preservation. The Classic Load Balancer is the deprecated original. The selection rule is whether you need HTTP-aware routing. NLB is also the answer when you need a static IP, a non-HTTP protocol, or extreme throughput — and it is what PrivateLink service endpoints require.

Question 30

How does a load balancer preserve the client IP address?

Accepted Answer

An ALB terminates the connection so the backend sees the load balancer's IP, with the real client in the X-Forwarded-For header. An NLB in default mode preserves the source IP directly at the network level. Proxy protocol can be enabled on NLB for targets that need the original address for TCP. The failure this causes is IP-based rate limiting or geo-blocking behind an ALB blocking everyone, because every request appears to come from the load balancer. Parsing X-Forwarded-For correctly — the client is not simply the first entry, since clients can spoof it — is the security-relevant detail.

Question 31

What is cross-zone load balancing?

Accepted Answer

With cross-zone load balancing enabled, each load balancer node distributes traffic across targets in all enabled AZs rather than only its own. It is always on and free for ALB; for NLB it is off by default and enabling it incurs cross-AZ data transfer charges. Without it, uneven target counts per AZ produce uneven load — three targets in one AZ and one in another means the single target receives four times the traffic per target. That distribution problem is the reason to enable it despite the transfer cost.

Question 32

What is connection draining / deregistration delay?

Accepted Answer

When a target is deregistered or fails health checks, the load balancer stops sending new requests but allows in-flight ones to complete for a configurable period, defaulting to 300 seconds. It makes scale-in and deployments invisible to users. It must be paired with the application handling SIGTERM: the load balancer stops sending traffic, but if the process exits immediately it still drops in-flight requests. Setting the delay longer than the slowest normal request is the sizing rule.

Question 33

How do health checks work on an AWS load balancer?

Accepted Answer

The load balancer probes each target on a configured protocol, port and path at an interval, marking it healthy or unhealthy after threshold counts. Unhealthy targets stop receiving traffic. Auto Scaling groups can use ELB health checks so an unhealthy target is also replaced. The trap is a health check that returns 200 unconditionally, which hides real failures, or one that checks a database and causes every target to fail simultaneously during a database blip — turning a degradation into a total outage. Checking the process, not its dependencies, is the correct design.

Question 34

What is a target group and what target types exist?

Accepted Answer

A target group is the set of destinations a listener rule forwards to, with its own health check and settings. Target types are instance, IP address — used for on-premises targets or across peered VPCs — Lambda functions, and Application Load Balancer for NLB-to-ALB chaining. The IP target type is what enables hybrid routing to on-premises endpoints through a load balancer, and the Lambda target type lets an ALB invoke a function directly without API Gateway. Both are useful and frequently forgotten.

Question 35

What is Route 53 and what routing policies does it support?

Accepted Answer

Route 53 is AWS's managed DNS with a 100% availability SLA. Routing policies include simple, weighted for traffic splitting, latency-based for the lowest-latency region, failover for active-passive, geolocation and geoproximity for location-based routing, multivalue answer for basic load spreading, and IP-based routing. The health-check integration is what makes failover and latency policies useful, since Route 53 removes unhealthy endpoints from responses. The caveat is DNS caching: clients honour TTL, so DNS failover is slower and less reliable than in-network failover with an ALB or Global Accelerator.

Question 36

What is a Route 53 alias record and why use it over a CNAME?

Accepted Answer

An alias record points at an AWS resource — ALB, CloudFront, S3 website, another Route 53 record — and resolves at query time. Unlike a CNAME it can be used at the zone apex, it is free to query, and it automatically tracks the target's changing IP addresses. The zone apex capability is the practical driver: DNS standards forbid a CNAME at the apex, so example.com pointing at an ALB requires an alias. Free queries versus charged CNAME queries is a small but real cost benefit at scale.

Question 37

What is CloudFront and how does it fit into a VPC design?

Accepted Answer

CloudFront is AWS's CDN, caching content at hundreds of edge locations and terminating TLS close to users, with origins in S3, an ALB, or any HTTP endpoint. It also provides WAF integration, DDoS absorption, signed URLs and cookies, and Lambda@Edge or CloudFront Functions for request manipulation. The architectural point is that CloudFront should be the only public entry point, with the origin locked to accept traffic only from CloudFront using Origin Access Control for S3 or a custom header check plus the CloudFront prefix list for an ALB. Otherwise attackers bypass the CDN, WAF and caching.

Question 38

How do you protect against DDoS on AWS?

Accepted Answer

AWS Shield Standard is automatic and free, absorbing common layer 3 and 4 attacks at the edge. Shield Advanced adds detection, 24/7 response team access, cost protection and WAF integration. Architecturally, put CloudFront and Global Accelerator in front, use WAF rate limiting, keep origins private, and scale elastically. The architectural half matters more than the product: an EC2 instance with a public IP receives attack traffic directly with no edge protection. Naming that "everything behind CloudFront or a load balancer, no public instance IPs" is the design principle behind DDoS resilience.

Question 39

What is an AWS WAF and what would you configure?

Accepted Answer

WAF is a web application firewall attached to CloudFront, ALB, API Gateway or AppSync, with managed rule groups for the OWASP Top 10, bot control, IP reputation and account takeover prevention, plus custom rules and rate-based rules. It operates on layer 7 request content. The deployment discipline is count mode first: managed rule groups produce false positives on real application traffic, so you run them in count mode, review what would have been blocked, then switch to block. Enabling them straight into block mode on launch day is how you break production.

Question 40

Design the network for a regulated multi-account AWS environment.

Accepted Answer

A central networking account owning a Transit Gateway and, where appropriate, shared VPCs via RAM, with a documented non-overlapping CIDR plan. Workload accounts attach spoke VPCs with private subnets only, egress through inspection — a NAT gateway behind AWS Network Firewall with domain allow-lists — and no default routes to the internet from workload subnets. Interface and gateway endpoints for AWS services with restrictive endpoint policies. Transit Gateway route tables segmenting production from non-production. Direct Connect with VPN backup, Route 53 Resolver endpoints in both directions, VPC Flow Logs to a central logging account, and CloudFront with WAF as the only public ingress. The closing scenario. The senior markers are centralising egress inspection rather than per-VPC NAT, segmenting with Transit Gateway route tables rather than relying on security groups alone, and treating the CIDR plan as the first and least reversible decision.

AWS VPC & Networking Interview Questions and Answers

How to use this set