Cloud Networking Interview Questions Hindi mein

जवाब: 4,096

32 - 20 = 12 free host bits, and 2^12 = 4,096 addresses.

जवाब: 172.40.0.1

172.16.0.0/12 covers 172.16.0.0 to 172.31.255.255. 172.40.0.1 is outside it and is a public address.

जवाब: Choosing address ranges and firewall rules

The provider owns the physical network. You still decide address space, routing, reachability and firewall policy.

जवाब: No, VPCs are isolated until you connect them

VPC isolation is the default. You must add peering, a transit gateway or another connection, plus routes and firewall rules.

जवाब: One Availability Zone

An AWS subnet lives in exactly one AZ. For high availability you create matching subnets in several AZs.

जवाब: Networks with overlapping ranges cannot be routed to each other

Routing needs each destination range to be unique. Overlapping VPCs cannot be peered or joined through a transit gateway without workarounds.

जवाब: A route to an internet gateway in its route table

Public versus private is a routing property. A subnet whose route table sends internet-bound traffic to an internet gateway is public.

जवाब: 27

A /27 has 32 addresses. AWS reserves 5, leaving 27 usable.

जवाब: tgw-1

10.2.4.0/22 covers 10.2.4.0 to 10.2.7.255, so both pcx-1 (/16) and tgw-1 (/22) match. The longer prefix, /22, wins.

जवाब: The instance is unreachable from the internet

Without a route to an internet gateway there is no path between the internet and the subnet, so the public address is useless.

जवाब: In a public subnet with a route to an internet gateway

A public NAT gateway sits in a public subnet so its own traffic can reach the internet gateway. Private subnets then route 0.0.0.0/0 to it.

जवाब: Egress-only internet gateway

IPv6 does not use NAT for this. The egress-only internet gateway is stateful and only allows connections initiated from inside the VPC.

जवाब: Yes, security groups are stateful, so the response is allowed

Return traffic for an allowed connection is tracked and permitted automatically. (Subnet NACLs, being stateless, are evaluated separately.)

जवाब: Responses to client ephemeral ports are blocked outbound

NACLs are stateless. The server's replies go to the client's ephemeral port, not 443, so an outbound rule for 1024-65535 is needed.

जवाब: Allow 5432 from sg-app

Only the app tier needs the database, and only on its port. Referencing sg-app on 5432 is the narrowest rule.

जवाब: A direct A-C peering (or a transit hub) with routes on both sides

Peering is non-transitive. A needs its own connection to C, either a direct peering or a hub such as a transit gateway.

जवाब: 28

n(n-1)/2 = 8 x 7 / 2 = 28. A transit gateway would need 8 attachments instead.

जवाब: The host project

The host project owns the network. Service projects are attached and deploy resources into the host project's subnets.

जवाब: S3 and DynamoDB

Gateway endpoints are limited to S3 and DynamoDB. Other services use interface endpoints (PrivateLink).

जवाब: It works even when customer and vendor CIDRs overlap and exposes only one service

The consumer reaches the service via an IP in its own subnet, so overlap is irrelevant, and only that service is exposed.

जवाब: Exchanges reachable network prefixes between the two sides

BGP is a routing protocol. Each side advertises its prefixes so routes are learned dynamically instead of typed by hand.

जवाब: 10.30.0.2

The resolver is at the VPC's primary CIDR base plus two. The base plus one is the VPC router.

जवाब: A layer-7 application load balancer

Path-based routing requires reading the HTTP request, which only a layer-7 load balancer does.

जवाब: The node subnets have run out of free IP addresses

With the VPC CNI each pod consumes a subnet IP. Exhausted subnets prevent new pods from getting addresses.

जवाब: The aws_route_table_association linking it to a table with 0.0.0.0/0 -> IGW

Public IPs alone do not make a subnet public. The association to a route table with an internet gateway default route does.

जवाब: The packet payload, such as HTTP bodies

Flow logs record connection metadata only. For payloads you need traffic mirroring or application-level logging.

जवाब: Whether the service is listening on that port on the server

A fast refusal means the packet reached the host, which replied with a reset. The path is fine; the service or host firewall is the problem.

जवाब: It limits data exfiltration and tool downloads after a compromise

A compromised host typically reaches out to an attacker. Tight egress limits what it can send and fetch.

जवाब: Add an S3 gateway VPC endpoint to the private route tables

The gateway endpoint routes S3 traffic privately with no NAT processing charge and no hourly endpoint fee.

जवाब: All private subnets route through one NAT gateway in the failed AZ

NAT gateways are zonal. A single NAT gateway is a single point of failure for every subnet that routes through it.

जवाब: SGs are stateful and allow-only; NACLs are stateless with allow and deny rules

Security groups track connections and only allow. NACLs evaluate each packet independently and support explicit denies.

जवाब: Route 0.0.0.0/0 from its private subnet to a NAT gateway in a public subnet

A NAT gateway provides outbound-only internet access for private subnets; it does not accept inbound-initiated connections.

जवाब: The subnet's NACL, including outbound ephemeral ports

Routing, the public IP and the SG are fine. The remaining network layer is the stateless NACL, which must allow both the inbound request and the outbound reply.