Networking interview question · Most asked
Design a VPC for a three-tier web application on AWS.
Summary
A /16 from the central address plan, spread over three availability zones. Public subnets hold the load balancer and NAT gateways (one per zone); private app subnets hold compute; private data subnets hold databases. Security groups chain ALB -> app -> database by group reference. Add gateway endpoints for S3/DynamoDB, interface endpoints for other AWS APIs, and flow logs.
Longer Answer
Size app subnets for growth (/20 or larger for containers). Route tables: public subnets default to the internet gateway, private ones to the NAT gateway in the same zone. No public IPs on instances; administrative access through Session Manager rather than SSH bastions. Azure: VNet with subnets, NSGs, NAT gateway and Application Gateway; GCP: VPC with regional subnets, firewall rules, Cloud NAT and an Application Load Balancer.
Key Points
- Three AZs, public/app/data tiers.
- NAT per zone; IGW for public subnets.
- Security groups by reference.
- Endpoints and flow logs.
Explanation
What interviewers look for
Availability across zones, least-privilege rules and room to grow.
Follow-up questions
- How would you give the app fixed outbound IPs for partners?
More most-asked Networking questions
- How does NAT work, and what are its limits?
- What's the difference between TCP and UDP, and when would you choose UDP?
- What do 502, 503 and 504 errors from a load balancer usually mean?
- What is CIDR notation? How many usable addresses are in a /26, and in an AWS /26 subnet?
- How does DNS resolution work, and what does a record's TTL control?
- What does TLS provide, and how does certificate validation work?
- What happens, at the network level, when you type a URL into a browser and press Enter?
- What's the difference between stateful and stateless firewalls? Give cloud examples.