Common Interview and Exam Questions

Questions you should be able to answer in two minutes

'Design a VPC for a three-tier web app.' State the CIDR, three tiers across at least two AZs, public subnets for the load balancer, private subnets for app and database, one NAT gateway per AZ, and chained security groups. 'Public versus private subnet?' It is about the route to an internet gateway, not a setting. 'Why can't my peered VPCs talk?' Check overlapping CIDRs, routes on both sides, security groups and non-transitivity. 'Security group versus NACL?' Stateful versus stateless, interface versus subnet, allow-only versus allow and deny. 'How do private instances reach S3 without the internet?' Gateway endpoint. 'How would you connect fifty VPCs and an office?' Transit gateway with VPN or dedicated link, using route tables for segmentation. 'How do you troubleshoot a timeout?' Walk DNS, routes both ways, NACLs, security groups, then the host, using flow logs and reachability tools. Interviewers reward reasoning about failure and trade-offs over memorised names.

Say the trade-off out loud

For every choice, add one sentence of cost: 'one NAT gateway per AZ costs more but removes a single point of failure'. That sentence is often what separates a pass from a strong pass.

Explaining directions to a visitor

Good directions name landmarks in order and mention where people usually go wrong. A good interview answer does the same: the path of a packet, in order, plus the classic mistakes along it.

त्वरित जाँच: An interviewer asks how a private EC2 instance can download OS updates from the internet without being reachable from it. What is the best answer?

• Give it an Elastic IP and close all security group rules
• Peer its VPC with a public VPC
• Route 0.0.0.0/0 from its private subnet to a NAT gateway in a public subnet
• Attach an interface endpoint for the internet