20 AWS Network Interview Questions for Architects

Start with an IP plan that prevents overlap across every VPC, on-premises network, partner network, and future Region that may need connectivity. Use VPC IPAM or a corporate allocation process before creating subnets. A primary IPv4 VPC CIDR is typically between /16 and /28, and AWS reserves the first four and last IPv4 addresses in every subnet. Spread each application tier across at least two Availability Zones, size subnets for scaling and managed-service ENIs, and plan secondary CIDRs rather than assuming renumbering will be easy. The goal is that losing one Availability Zone does not remove the only ingress, egress, application, or database path.

A subnet is public when its route table sends internet-bound traffic to an Internet Gateway; a workload also needs a public IPv4 address or appropriate IPv6 configuration to communicate directly. A private subnet has no direct Internet Gateway route. For IPv4 outbound access, it normally routes 0.0.0.0/0 to a NAT Gateway in a public subnet. NAT Gateway does not provide unsolicited inbound access. Inbound web traffic commonly terminates on an internet-facing load balancer in public subnets and then reaches targets in private subnets. For resilience, deploy NAT Gateways per Availability Zone and keep each private subnet's egress in-zone.

VPC peering is a direct one-to-one connection with no transitive routing. It is simple and low overhead for a small number of VPC pairs, but every required pair needs its own connection and routes. Transit Gateway is a regional hub that connects VPCs, VPNs, and Direct Connect gateways through attachments and centralized route tables. It is the better fit for multi-account scale, segmentation, centralized inspection, or hybrid aggregation. Neither service solves overlapping CIDRs automatically, so address planning remains a first-order design constraint.

Security Groups are stateful controls attached to supported resources or network interfaces. They contain allow rules, and return traffic for an allowed flow is automatically permitted. Network ACLs are stateless controls applied at the subnet boundary; they support ordered allow and deny rules, so both directions—including return and ephemeral-port traffic—must be allowed. Use Security Groups for workload-level least privilege and service-to-service access. Use NACLs as a coarse subnet guardrail or explicit deny layer, not as a replacement for well-designed Security Groups.

A Security Group rule can reference another Security Group as its source or destination. That expresses identity-like intent—such as “database traffic is allowed only from the application tier”—without tracking instance IP addresses. Auto Scaling can add or remove network interfaces while the rule remains correct. The reference does not create routing and does not copy rules from the referenced group; traffic still needs a valid network path, and the referenced group's membership is what matches the rule.

Security Groups provide distributed stateful L3/L4 access control close to workloads. AWS Network Firewall is a managed stateful firewall and intrusion prevention service placed in the forwarding path through dedicated firewall endpoints and route tables. It supports centralized policy, domain-list filtering, Suricata-compatible stateful rules, and traffic logging. Use Security Groups everywhere for workload segmentation. Add Network Firewall when you need centralized north-south or east-west inspection, consistent multi-VPC controls, or compliance logging. Third-party appliances may use Gateway Load Balancer; AWS Network Firewall itself is routed through its managed firewall endpoints.

Each Transit Gateway attachment is associated with one TGW route table, which decides where traffic arriving from that attachment may go. An attachment can propagate routes into one or more route tables, and static routes can override propagated routes for the same destination. Multiple route tables create routing domains: production, development, shared services, and inspection attachments can have deliberately different reachability. Default association and propagation are convenient for a small environment, but architects usually disable broad defaults and make segmentation explicit.

Attach spoke VPCs and an inspection VPC to Transit Gateway. Spoke-associated TGW route tables send relevant destinations—or a default route—to the inspection attachment. The inspection VPC route tables steer traffic through AWS Network Firewall endpoints or third-party appliances, then back to Transit Gateway for the destination spoke. Return traffic must follow the same stateful path. For virtual appliances behind a Transit Gateway VPC attachment, enable appliance mode so both directions of a flow remain in the same Availability Zone. Test routes in both directions and avoid more-specific routes that bypass inspection.

A private VIF reaches VPC resources through private IP addressing, using a virtual private gateway or a Direct Connect gateway design. A public VIF reaches public AWS service prefixes over the Direct Connect connection. A transit VIF connects to one or more Transit Gateways through a Direct Connect gateway and is the scalable choice for a hub-and-spoke estate. The correct VIF follows the destination and routing model; “always use transit VIF” is too absolute because a simple single-VPC design or public-service access has different requirements.

One Direct Connect connection is one failure domain. High and maximum resiliency use multiple connections terminating on separate AWS devices, with critical designs using more than one Direct Connect location. Build redundant customer routers and provider paths as well. Run BGP on every path, use BFD where supported, and decide whether the routes are active-active or preference-controlled. The AWS Direct Connect Resiliency Toolkit provides models and failover testing. An IPsec Site-to-Site VPN can provide a diverse backup, but the routing policy and failure behavior must be tested rather than assumed.

Site-to-Site VPN encrypts traffic with IPsec and is fast to provision, but its path uses internet connectivity unless it is layered over Direct Connect. Standard tunnels support up to 1.25 Gbps; large-bandwidth tunnels can support up to 5 Gbps on supported Transit Gateway or Cloud WAN designs and Regions. Direct Connect provides a dedicated private link with more predictable path characteristics and higher port-speed options, but it takes more planning and is not encrypted by default. Use VPN for rapid deployment, branch sites, or backup; use Direct Connect when sustained throughput, path consistency, or private connectivity justifies the cost and lead time.

Enable private DNS on the interface endpoint and ensure VPC DNS resolution and hostnames are enabled. AWS creates a hidden managed private hosted zone so the service's standard regional hostname resolves to endpoint ENI addresses inside the VPC. For on-premises resolvers, create Route 53 Resolver inbound endpoints in reachable subnets and configure conditional forwarding to those endpoint IPs. The private hosted zone must be associated with the VPC that hosts the inbound endpoint. Use redundant endpoint IPs across Availability Zones and permit DNS traffic through the relevant Security Groups and network paths.

Gateway endpoints add routes for Amazon S3 or DynamoDB service prefix lists and do not create endpoint ENIs. They have no additional endpoint hourly charge and are ideal for private access from workloads whose route tables use them. Interface endpoints use AWS PrivateLink, create private endpoint ENIs in selected subnets, support private DNS for compatible services, and incur hourly and data-processing charges. They cover many AWS and partner services and can be reached from connected networks when routing, DNS, and policy allow it. Choose by service support, access path, DNS requirements, cost, and policy—not a blanket rule.

Private hosted zones return private records only to associated VPCs and hybrid clients querying through an inbound Resolver endpoint. Public hosted zones can hold a different answer for the same name, creating split-view DNS. Outbound Resolver endpoints and forwarding rules send selected corporate domains from VPCs to on-premises resolvers. Inbound endpoints do the reverse. Centralize endpoints per Region when appropriate, share Resolver rules across accounts, use at least two endpoint IPs in different Availability Zones, and document which resolver is authoritative for every namespace to avoid forwarding loops.

Application Load Balancer is the L7 choice for HTTP and HTTPS features such as host, path, header, and method-based routing plus WAF integration. Network Load Balancer handles TCP, UDP, and TLS at very high scale and provides static IP addresses per enabled Availability Zone; internet-facing NLBs can use Elastic IPs. Gateway Load Balancer uses GENEVE to insert compatible virtual appliances transparently into the forwarding path. Choose ALB for web application semantics, NLB for transport-level performance or fixed allow-listable addresses, and GWLB for scalable third-party firewall or inspection fleets.

VPC Flow Logs record metadata about IP flows at a VPC, subnet, or network-interface scope. Fields can include source and destination addresses, ports, protocol, byte and packet counts, time window, and accept or reject action. They do not contain application payloads and are aggregated telemetry, not packet capture; delivery is best effort and delayed. Some platform traffic is excluded or represented differently. Use Flow Logs for reachability, security, and traffic-pattern analysis; use Route 53 Resolver query logging for DNS questions and Traffic Mirroring or host tooling when packet-level evidence is required.

Start at the source and trace both directions. Confirm source and destination CIDRs do not overlap, then check the source subnet route table, TGW attachment state, associated TGW route table, propagation or static routes, destination subnet route table, Security Groups, and NACLs. Verify return routes separately because a forward route alone is insufficient. If inspection is present, confirm appliance mode, firewall policy, and path symmetry. VPC Reachability Analyzer can identify configuration blockers without sending packets; Flow Logs then show whether live traffic is accepted or rejected at relevant interfaces.

A standard AWS Global Accelerator provides static anycast IP addresses and carries TCP or UDP traffic over the AWS global network to healthy regional endpoints such as ALBs, NLBs, EC2 instances, or Elastic IPs. It is useful for dynamic applications, rapid regional failover, non-HTTP protocols, and stable client allow lists. CloudFront is an HTTP/HTTPS content delivery network that can cache objects and execute edge delivery behaviors. Choose Global Accelerator when transport optimization and fixed entry IPs matter; choose CloudFront when caching, edge HTTP features, and origin offload are the primary goals. Some architectures use both for different traffic paths.

A service provider publishes an endpoint service, commonly backed by a Network Load Balancer. A consumer creates an interface endpoint, which places private ENIs in the consumer VPC. Traffic reaches only the published service through the AWS network; the consumer does not receive general routes into the provider VPC, and overlapping VPC CIDRs are not a peering problem. PrivateLink is therefore strong for SaaS, shared platform APIs, and cross-account services that need narrow connectivity. Architects still need endpoint policies, provider acceptance rules, DNS, Security Groups, zonal resilience, and cost planning.

Create a dedicated network-services account and use AWS Organizations with AWS RAM to share a Transit Gateway in each Region. Allocate every VPC from centrally governed non-overlapping IPAM pools. Give each business unit a separate TGW route table with no route to other business-unit attachments; add only approved shared-services and inspection routes. Use inter-Region TGW peering where required and remember that peering routes are static.

Deploy a highly available inspection and egress VPC per Region so traffic is not unnecessarily hairpinned across Regions. Route spoke egress through AWS Network Firewall endpoints, then zonal NAT Gateways and an Internet Gateway. For hybrid access, use redundant Direct Connect connections in separate locations, transit VIFs, a Direct Connect gateway, and a tested Site-to-Site VPN backup. Centralize Route 53 Resolver inbound and outbound endpoints per Region, share forwarding rules, log flows and firewall events centrally, and validate segmentation with automated reachability tests.