</>SkillByAI
🇬🇧 English
Test our app

Cloud Networking interview questions

33 questions from the Cloud Networking: VPCs, Subnets & Peering course, each with the correct answer and an explanation. Try to answer before you open the answer.

Prerequisites and the Cloud Network Mental Model

1. How many IPv4 addresses does the block 10.0.0.0/20 contain?

  1. 4,096
  2. 1,024
  3. 65,536
  4. 256
Show answer

Answer: 4,096

32 - 20 = 12 free host bits, and 2^12 = 4,096 addresses.

Lesson: IPv4 Addresses and CIDR Notation

2. Which address is NOT in an RFC 1918 private range?

  1. 10.255.0.1
  2. 172.20.5.5
  3. 172.40.0.1
  4. 192.168.0.1
Show answer

Answer: 172.40.0.1

172.16.0.0/12 covers 172.16.0.0 to 172.31.255.255. 172.40.0.1 is outside it and is a public address.

Lesson: Private Address Ranges and NAT

3. Which of these is still the customer's responsibility in a cloud VPC?

  1. Replacing failed physical switches
  2. Running spanning tree on the provider's network
  3. Cabling hypervisor hosts together
  4. Choosing address ranges and firewall rules
Show answer

Answer: Choosing address ranges and firewall rules

The provider owns the physical network. You still decide address space, routing, reachability and firewall policy.

Lesson: What the Cloud Virtualises

VPC Foundations

4. Two VPCs in the same AWS account and region are created with no extra configuration. Can an instance in one reach an instance in the other by private IP?

  1. Yes, because they share an account
  2. No, VPCs are isolated until you connect them
  3. Only over IPv6
  4. Yes, if both use 10.x ranges
Show answer

Answer: No, VPCs are isolated until you connect them

VPC isolation is the default. You must add peering, a transit gateway or another connection, plus routes and firewall rules.

Lesson: What a VPC Is

5. In AWS, what is the scope of a single subnet?

  1. One Availability Zone
  2. The whole region
  3. All regions in the account
  4. One EC2 instance
Show answer

Answer: One Availability Zone

An AWS subnet lives in exactly one AZ. For high availability you create matching subnets in several AZs.

Lesson: Regions, Availability Zones and Subnet Scope

6. Why is reusing 10.0.0.0/16 for every VPC a problem?

  1. AWS charges more for duplicate ranges
  2. Instances cannot get DNS names
  3. Security groups stop working
  4. Networks with overlapping ranges cannot be routed to each other
Show answer

Answer: Networks with overlapping ranges cannot be routed to each other

Routing needs each destination range to be unique. Overlapping VPCs cannot be peered or joined through a transit gateway without workarounds.

Lesson: Planning Address Space

Subnets and Route Tables

7. What makes an AWS subnet 'public'?

  1. A route to an internet gateway in its route table
  2. A tag named Public=true
  3. A /24 prefix length
  4. Being in the first Availability Zone
Show answer

Answer: A route to an internet gateway in its route table

Public versus private is a routing property. A subnet whose route table sends internet-bound traffic to an internet gateway is public.

Lesson: Public and Private Subnets

8. How many usable IP addresses does an AWS subnet with a /27 prefix provide?

  1. 32
  2. 30
  3. 27
  4. 16
Show answer

Answer: 27

A /27 has 32 addresses. AWS reserves 5, leaving 27 usable.

Lesson: Carving and Sizing Subnets

9. A route table has 10.0.0.0/16 -> local, 10.2.0.0/16 -> pcx-1, 10.2.4.0/22 -> tgw-1 and 0.0.0.0/0 -> igw. Where does traffic to 10.2.6.4 go?

  1. pcx-1
  2. tgw-1
  3. igw
  4. local
Show answer

Answer: tgw-1

10.2.4.0/22 covers 10.2.4.0 to 10.2.7.255, so both pcx-1 (/16) and tgw-1 (/22) match. The longer prefix, /22, wins.

Lesson: Route Tables and Longest-Prefix Match

Getting In and Out: Internet and NAT Gateways

10. An instance has a public IPv4 address, but its subnet's route table has only the local route. What happens to inbound traffic from the internet?

  1. It reaches the instance normally
  2. It is routed through the NAT gateway
  3. The instance is unreachable from the internet
  4. It is redirected to the default VPC
Show answer

Answer: The instance is unreachable from the internet

Without a route to an internet gateway there is no path between the internet and the subnet, so the public address is useless.

Lesson: Internet Gateways and Public IPs

11. Where must an AWS NAT gateway for IPv4 internet egress be placed?

  1. In a public subnet with a route to an internet gateway
  2. In the private subnet it serves
  3. Outside the VPC, attached to the region
  4. On every EC2 instance as an agent
Show answer

Answer: In a public subnet with a route to an internet gateway

A public NAT gateway sits in a public subnet so its own traffic can reach the internet gateway. Private subnets then route 0.0.0.0/0 to it.

Lesson: NAT Gateways for Private Subnets

12. Which component gives IPv6-only instances outbound internet access while blocking inbound connections started from the internet?

  1. NAT gateway
  2. Elastic IP
  3. Transit gateway
  4. Egress-only internet gateway
Show answer

Answer: Egress-only internet gateway

IPv6 does not use NAT for this. The egress-only internet gateway is stateful and only allows connections initiated from inside the VPC.

Lesson: IPv6 in the VPC

Filtering Traffic: Security Groups and Network ACLs

13. An SG allows inbound TCP 443 from 0.0.0.0/0 and has no outbound rules at all. Does the HTTPS response reach the client?

  1. No, an outbound rule for 443 is required
  2. Yes, security groups are stateful, so the response is allowed
  3. Only if the NACL also allows it inbound
  4. Only for IPv6 clients
Show answer

Answer: Yes, security groups are stateful, so the response is allowed

Return traffic for an allowed connection is tracked and permitted automatically. (Subnet NACLs, being stateless, are evaluated separately.)

Lesson: Security Groups

14. A custom NACL allows inbound TCP 443 from anywhere and outbound TCP 443 to anywhere. HTTPS clients time out. What is the most likely cause?

  1. Responses to client ephemeral ports are blocked outbound
  2. Security groups override NACLs
  3. NACLs cannot filter port 443
  4. The internet gateway is stateless
Show answer

Answer: Responses to client ephemeral ports are blocked outbound

NACLs are stateless. The server's replies go to the client's ephemeral port, not 443, so an outbound rule for 1024-65535 is needed.

Lesson: Network ACLs

15. Which rule best follows least privilege for the database tier?

  1. Allow 5432 from 10.0.0.0/16
  2. Allow all TCP from sg-app
  3. Allow 5432 from 0.0.0.0/0 with a strong password
  4. Allow 5432 from sg-app
Show answer

Answer: Allow 5432 from sg-app

Only the app tier needs the database, and only on its port. Referencing sg-app on 5432 is the narrowest rule.

Lesson: Designing Rules for a Three-Tier App

Connecting VPCs: Peering, Transit and Shared VPCs

16. VPC A is peered with B, and B is peered with C. What is needed for A to reach C?

  1. Nothing; traffic passes through B automatically
  2. A route in B's table pointing to C
  3. A direct A-C peering (or a transit hub) with routes on both sides
  4. An internet gateway in B
Show answer

Answer: A direct A-C peering (or a transit hub) with routes on both sides

Peering is non-transitive. A needs its own connection to C, either a direct peering or a hub such as a transit gateway.

Lesson: VPC Peering

17. How many peering connections does a full mesh of 8 VPCs require?

  1. 8
  2. 28
  3. 16
  4. 64
Show answer

Answer: 28

n(n-1)/2 = 8 x 7 / 2 = 28. A transit gateway would need 8 attachments instead.

Lesson: Transit Gateways and Hub-and-Spoke

18. In Google Cloud Shared VPC, which project owns the VPC network and its subnets?

  1. Every service project owns a copy
  2. The billing project
  3. The organisation node itself
  4. The host project
Show answer

Answer: The host project

The host project owns the network. Service projects are attached and deploy resources into the host project's subnets.

Lesson: Shared VPCs Across Accounts and Projects

Private Service Access and Hybrid Connectivity

19. Which services can use an AWS gateway VPC endpoint?

  1. S3 and DynamoDB
  2. Any AWS service
  3. Only services running in your own VPC
  4. EC2 and RDS
Show answer

Answer: S3 and DynamoDB

Gateway endpoints are limited to S3 and DynamoDB. Other services use interface endpoints (PrivateLink).

Lesson: VPC Endpoints for Provider Services

20. Why do SaaS vendors often prefer PrivateLink over VPC peering with customers?

  1. It is the only option that encrypts traffic
  2. It works even when customer and vendor CIDRs overlap and exposes only one service
  3. It lets customers use the vendor's NAT gateway
  4. It removes the need for any load balancer
Show answer

Answer: It works even when customer and vendor CIDRs overlap and exposes only one service

The consumer reaches the service via an IP in its own subnet, so overlap is irrelevant, and only that service is exposed.

Lesson: Publishing Services with PrivateLink

21. What does BGP do in a hybrid cloud connection?

  1. Encrypts packets inside the tunnel
  2. Assigns IP addresses to instances
  3. Exchanges reachable network prefixes between the two sides
  4. Translates private addresses to public ones
Show answer

Answer: Exchanges reachable network prefixes between the two sides

BGP is a routing protocol. Each side advertises its prefixes so routes are learned dynamically instead of typed by hand.

Lesson: Hybrid Connectivity: VPN and Dedicated Links

DNS, Load Balancers and Container Networking

22. In a VPC with CIDR 10.30.0.0/16, at which address is the AWS-provided DNS resolver reachable (besides 169.254.169.253)?

  1. 10.30.0.1
  2. 10.30.255.255
  3. 10.30.0.53
  4. 10.30.0.2
Show answer

Answer: 10.30.0.2

The resolver is at the VPC's primary CIDR base plus two. The base plus one is the VPC router.

Lesson: DNS Inside a VPC

23. You need to route /api/* and /images/* on the same hostname to different backend services. Which load balancer type fits?

  1. A layer-4 network load balancer
  2. A layer-7 application load balancer
  3. A NAT gateway
  4. A gateway VPC endpoint
Show answer

Answer: A layer-7 application load balancer

Path-based routing requires reading the HTTP request, which only a layer-7 load balancer does.

Lesson: Load Balancers in the VPC

24. Pods on an EKS cluster using the Amazon VPC CNI are stuck in ContainerCreating with IP allocation errors. What is the most likely cause?

  1. The cluster has no internet gateway
  2. The VPC DNS resolver is disabled
  3. The node subnets have run out of free IP addresses
  4. The load balancer is layer 4
Show answer

Answer: The node subnets have run out of free IP addresses

With the VPC CNI each pod consumes a subnet IP. Exhausted subnets prevent new pods from getting addresses.

Lesson: Kubernetes and IP Address Consumption

Infrastructure as Code and Troubleshooting

25. In the Terraform example, what makes public_a a public subnet?

  1. map_public_ip_on_launch = true on its own
  2. The aws_route_table_association linking it to a table with 0.0.0.0/0 -> IGW
  3. The CIDR block 10.42.0.0/20
  4. enable_dns_hostnames on the VPC
Show answer

Answer: The aws_route_table_association linking it to a table with 0.0.0.0/0 -> IGW

Public IPs alone do not make a subnet public. The association to a route table with an internet gateway default route does.

Lesson: Defining a VPC in Terraform

26. What do VPC flow logs NOT contain?

  1. Source and destination ports
  2. Whether traffic was accepted or rejected
  3. Byte and packet counts
  4. The packet payload, such as HTTP bodies
Show answer

Answer: The packet payload, such as HTTP bodies

Flow logs record connection metadata only. For payloads you need traffic mirroring or application-level logging.

Lesson: VPC Flow Logs

27. nc to 10.0.2.40:5432 returns 'Connection refused' immediately. Where should you look first?

  1. Whether the service is listening on that port on the server
  2. The VPC peering routes
  3. The internet gateway
  4. The NAT gateway's Elastic IP
Show answer

Answer: Whether the service is listening on that port on the server

A fast refusal means the packet reached the host, which replied with a reset. The path is fine; the service or host firewall is the problem.

Lesson: A Connectivity Troubleshooting Checklist

Security, Cost and Common Pitfalls

28. Why restrict outbound (egress) traffic from a database subnet?

  1. It makes queries run faster
  2. Security groups require at least one outbound rule
  3. Outbound traffic is the only traffic billed
  4. It limits data exfiltration and tool downloads after a compromise
Show answer

Answer: It limits data exfiltration and tool downloads after a compromise

A compromised host typically reaches out to an attacker. Tight egress limits what it can send and fetch.

Lesson: Defence in Depth and Egress Control

29. A private service downloads large files from S3 via a NAT gateway. Which change most directly reduces cost?

  1. Add an S3 gateway VPC endpoint to the private route tables
  2. Move the instances to a public subnet with no security group
  3. Enlarge the private subnet's CIDR
  4. Switch the load balancer from layer 7 to layer 4
Show answer

Answer: Add an S3 gateway VPC endpoint to the private route tables

The gateway endpoint routes S3 traffic privately with no NAT processing charge and no hourly endpoint fee.

Lesson: Understanding Network Cost Drivers

30. A team's three-AZ application loses all outbound internet access when one AZ fails. What is the likely cause?

  1. The internet gateway is zonal
  2. Security groups are stateful
  3. All private subnets route through one NAT gateway in the failed AZ
  4. VPC peering is non-transitive
Show answer

Answer: All private subnets route through one NAT gateway in the failed AZ

NAT gateways are zonal. A single NAT gateway is a single point of failure for every subnet that routes through it.

Lesson: Common Cloud Networking Mistakes

Revision and Interview Prep

31. Which pair correctly contrasts security groups and NACLs?

  1. SGs are stateless; NACLs are stateful
  2. SGs are stateful and allow-only; NACLs are stateless with allow and deny rules
  3. Both are stateful and allow-only
  4. SGs apply per subnet; NACLs apply per interface
Show answer

Answer: SGs are stateful and allow-only; NACLs are stateless with allow and deny rules

Security groups track connections and only allow. NACLs evaluate each packet independently and support explicit denies.

Lesson: Cloud Networking Cheat Sheet

32. An interviewer asks how a private EC2 instance can download OS updates from the internet without being reachable from it. What is the best answer?

  1. Give it an Elastic IP and close all security group rules
  2. Peer its VPC with a public VPC
  3. Route 0.0.0.0/0 from its private subnet to a NAT gateway in a public subnet
  4. Attach an interface endpoint for the internet
Show answer

Answer: Route 0.0.0.0/0 from its private subnet to a NAT gateway in a public subnet

A NAT gateway provides outbound-only internet access for private subnets; it does not accept inbound-initiated connections.

Lesson: Common Interview and Exam Questions

33. A web server in a public subnet answers on 443, but users time out. The SG allows 443 from 0.0.0.0/0, the route table has 0.0.0.0/0 -> IGW and the instance has a public IP. What should you check next?

  1. The subnet's NACL, including outbound ephemeral ports
  2. Whether the VPC is peered
  3. Whether a gateway endpoint exists for S3
  4. The transit gateway route table
Show answer

Answer: The subnet's NACL, including outbound ephemeral ports

Routing, the public IP and the SG are fine. The remaining network layer is the stateless NACL, which must allow both the inbound request and the outbound reply.

Lesson: Mixed Self-Check

← Back to the course