We use analytics and advertising cookies to understand how the site is used and whether our ads on Facebook and Instagram work. They are set only if you accept. See our Privacy Policy for details.
AWS networking interviews start from a VPC diagram and ask what breaks: a private subnet that cannot reach the internet, two VPCs that will not route through a third, an on-premises link with no failover, a DNS failover that never fires. Knowing which component owns each hop is the whole job.
Each question below is a scenario with four plausible answers and an explanation.
Answer a real AWS interview question before you browse the Networking & VPC list. No signup needed.
A content management application runs on EC2 instances in an Auto Scaling group across three Availability Zones. Every instance must read and write the same set of user-uploaded files through a standard file system interface (POSIX), and files must remain available if an AZ fails. Which storage solution should a solutions architect choose?
Practice in a session
10 questions from AWS, one after another, then your score and streak.
VPC and CIDR planning, public vs private subnets, route tables, internet and NAT gateways, security groups vs network ACLs, gateway and interface VPC endpoints (PrivateLink), VPC peering vs Transit Gateway, Site-to-Site VPN and Direct Connect, Route 53 routing policies and health checks, and load balancers and CloudFront in front of it all.
A security group is stateful, attaches to an ENI or instance, and has allow rules only - return traffic is allowed automatically. A network ACL is stateless, applies to a whole subnet, has numbered allow and deny rules evaluated in order, and must allow return traffic explicitly, usually on the ephemeral port range.
Peering is a one-to-one connection, is not transitive and cannot join overlapping CIDRs; it is simple and cheap for a few VPCs. Transit Gateway is a regional hub with transitive routing, per-attachment route tables and VPN or Direct Connect attachments, and it scales to many VPCs and accounts, at a per-attachment and per-GB cost.
Gateway endpoints exist only for S3 and DynamoDB, are added as a route table target, and have no charge. Interface endpoints (PrivateLink) put an ENI with a private IP in your subnet for most other AWS services and for endpoint services, and are billed per hour and per GB processed.