Networking

Your EC2 instances in a private subnet need to reach S3 and a third-party API, but must never be reachable from the internet. Design the networking.

Outbound-only access comes from a NAT Gateway in a public subnet, but S3 traffic should skip it entirely through a VPC endpoint, which is free and never leaves the AWS network. Nothing can reach in because there's no route for it to take, not because a rule is blocking it, and that distinction is usually the real follow-up question.

Your application needs to feel fast for users spread across multiple continents. What would you put in front of it, and why?

Amazon CloudFront is a CDN that terminates connections and caches content at edge locations close to the user, so most requests never travel back to the origin region at all. It helps static content the most, but modern CloudFront also improves dynamic requests through TCP/TLS termination at the edge and origin connection reuse.

Design the subnets and routing for a standard three-tier web application: a public web layer, a private application layer, and a private database layer.

Three tiers, three subnet groups, each with a route table that only grants the access that tier actually needs. The database subnet shouldn't be able to reach the internet at all, the app subnet gets outbound-only through NAT, and only the web subnet has a real route to the internet gateway. Everything else follows from that one rule.

You have a dozen VPCs that all need to reach each other and a shared-services VPC. Would you use VPC Peering or Transit Gateway, and why?

Peering connects two VPCs directly and doesn't scale past a handful of them, since connections grow quadratically and traffic can't transit through a peered VPC to reach a third. Transit Gateway is a central routing hub that turns the same problem into one connection per VPC, and it's the right call anywhere past three or four VPCs.

How would you securely connect an on-premises data center to a VPC, and when would you reach for Direct Connect instead of a Site-to-Site VPN?

A Site-to-Site VPN is fast to set up, encrypted by default, and runs over the public internet, which is also its ceiling: bandwidth and latency aren't guaranteed. Direct Connect is a dedicated physical link with predictable performance, but it takes weeks to provision and isn't encrypted on its own. Most serious hybrid setups end up running both.

A subnet holds your most sensitive data. Design the Network ACL rules around it as a second layer of defense behind Security Groups.

A NACL earns its place by doing the one thing a Security Group can't: an explicit, subnet-wide deny that survives a misconfigured Security Group rule. The design is a default-deny rule set with narrow, numbered exceptions, remembering that NACLs are stateless, so return traffic on ephemeral ports needs its own explicit allow.

Two EC2 instances in the same VPC can't reach each other over a port that should be open. Walk through how you'd find out why.

Work outward from the instance rather than guessing at the network: confirm the app is actually listening, then check Security Groups, then NACLs, then the route table, then Flow Logs to see what AWS's own network actually did with the packet. Each layer either clears itself or points straight at the next thing to check.

Design layered protection for a public-facing web application against DDoS attacks and common web exploits.

No single AWS service handles both problems, since a volumetric DDoS attack and a targeted web exploit look nothing alike at the network layer. CloudFront and Shield absorb and dilute volume before it reaches your origin, and WAF inspects individual requests for exploit patterns. Both sit in front of the origin, stacked, not swapped for each other.

Amazon EC2 instances in a private subnet upload large volumes of processed data to an Amazon S3 bucket in the same AWS Region. The traffic currently routes through a NAT gateway. A solutions architect must keep the traffic off the public internet and reduce data transfer charges. What should the architect do?

S3 and DynamoDB are the two services with gateway VPC endpoints, and gateway endpoints cost nothing. Adding one gives private subnets a route to S3 that skips the NAT gateway entirely, which removes both the internet path and the per-GB NAT processing charge.

A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?

These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.

Pods on a new cluster stay in ContainerCreating and the kubelet logs mention that the network plugin is not ready. Which extension interface is involved?

CNI is the container network interface, and Kubernetes ships no default implementation. Until a CNI plugin is installed and healthy, Pods cannot be given network namespaces and stay in ContainerCreating.

A multiplayer game server runs on Amazon EC2 instances behind Network Load Balancers in three AWS Regions. Players connect over UDP. The company needs to route each player to the lowest-latency healthy Region, to fail over within seconds if a Region becomes unhealthy, and to publish a fixed set of IP addresses that players' firewalls can allow. Which solution meets these requirements?

UDP, static IP addresses and fast regional failover all point at AWS Global Accelerator rather than CloudFront. Global Accelerator gives you anycast static IPs, carries traffic over the AWS backbone, and reroutes without waiting for DNS to expire anywhere.

A company must copy 40 TB of files from an on-premises NFS server into Amazon S3, and then keep the S3 copy synchronised with nightly changes. The company has a 1 Gbps AWS Direct Connect connection with spare capacity overnight. Which solution requires the LEAST ongoing operational effort?

There is enough bandwidth to transfer online, and the requirement continues after the initial copy. AWS DataSync handles both halves: it moves the bulk data quickly over the existing link and then runs on a schedule to keep the destination in sync.

An internal API must be reachable by other Pods in the cluster but must not be exposed outside it. Which Service type meets that, and how do the other types relate to it?

ClusterIP is the default and is reachable only from inside the cluster. NodePort and LoadBalancer build on top of it by adding external entry points.

A container listens on 8080. Clients inside the cluster must reach the Service on 80. Which combination of port and targetPort is correct?

port is the port clients use on the Service. targetPort is the port on the Pod that traffic is forwarded to. Here that means port 80 and targetPort 8080.

A Pod in the frontend namespace must reach a Service named api in the backend namespace. Which name resolves, and what is the fully qualified form?

A Service is reachable as api.backend from another namespace, and the fully qualified name is api.backend.svc.cluster.local. A bare api only resolves inside the Service's own namespace.

Two Pods on different nodes talk to each other directly by Pod IP with no port mapping anywhere. Which rule of the Kubernetes network model makes that work?

Every Pod gets its own cluster-wide IP, and Pods reach each other on that IP without NAT. The network plugin is what has to deliver that, not Kubernetes itself.

A StatefulSet's Pods must each be addressable individually so peers can form a cluster. Which Service configuration provides that, and what does DNS return?

A headless Service, clusterIP: None, allocates no virtual IP. DNS returns the Pod IPs directly, and each StatefulSet Pod also gets its own name under the Service.

A cluster must expose two applications on one external hostname, routed by URL path. Which object does the path-based routing, and what is still required underneath it?

An Ingress routes HTTP by host and path, which a Service cannot do. It still forwards to ClusterIP Services, and it needs an Ingress controller to be running.

Requests to a ClusterIP Service time out. kubectl get endpointslices shows no endpoints for it, though the Pods are Running. What are the TWO most likely causes?

A Service with no endpoints means nothing matched or nothing is ready. Check that the selector matches the Pod labels, and that the Pods pass their readiness probes.

An Ingress rule is written with path /api and no pathType field. The manifest is rejected. What does pathType control, and which value matches /api and /api/v1 alike?

pathType is required on every path. Prefix matches element by element, so /api also matches /api/v1. Exact matches the whole path only, and ImplementationSpecific leaves it to the controller.

A Service of type NodePort is created without specifying a node port. Which port is assigned, and what is the constraint if you want to pick one yourself?

Kubernetes allocates a port from the range set by the API server's --service-node-port-range flag, 30000-32767 by default. A port you choose by hand must be inside that range and free.

After applying a default-deny egress NetworkPolicy, Pods in the namespace cannot reach anything by name, though they can still reach IP addresses you allowed. Why?

A default-deny egress policy also blocks the UDP and TCP port 53 traffic that Pods send to CoreDNS, so every name lookup fails. DNS has to be allowed back explicitly.

An application needs the real client IP address. The Service is type LoadBalancer and currently reports the node IP as the source. Setting externalTrafficPolicy: Local fixes it. What is the cost?

Local preserves the client source IP by refusing to forward between nodes. A node with no local ready endpoint stops serving that Service, so traffic can be dropped and load can spread unevenly.

A Service must send cluster traffic to a database running on a VM outside the cluster, at a fixed IP. Which approach keeps the in-cluster name and works with a raw IP address?

A Service with no selector gets no endpoints automatically, so you create an EndpointSlice yourself pointing at the external address. ExternalName cannot be used with a bare IP.

You are asked what actually makes a ClusterIP reachable from a Pod, given that the cluster IP is not assigned to any network interface. What is the accurate explanation?

A cluster IP is a virtual address. kube-proxy programs packet forwarding rules on every node, in iptables, IPVS or nftables mode, which rewrite traffic for that IP to a chosen endpoint.

You apply a NetworkPolicy that should block all ingress to a namespace, but every Pod stays reachable. kubectl get networkpolicy shows the object exists. What is the most likely explanation?

NetworkPolicies are enforced by the network plugin. If the cluster's CNI plugin does not implement them, the objects are accepted by the API server and have no effect.

Write the smallest NetworkPolicy that denies all ingress traffic to every Pod in a namespace. Which spec achieves it?

An empty podSelector selects every Pod in the namespace, and policyTypes: Ingress with no ingress rules allows nothing. That combination is the documented default-deny policy.

A NetworkPolicy ingress rule has one from entry containing both a namespaceSelector (user=alice) and a podSelector (role=client). Which traffic is allowed?

Selectors inside one from entry are combined with AND. Splitting them into two entries in the from list makes it OR, and that single dash is the whole difference.

An Ingress resource for app.example.com has been applied and the object exists, but nothing responds and the ADDRESS column stays empty. What is missing?

An Ingress is only configuration. An Ingress controller has to be running to satisfy it, and the Ingress usually needs an ingressClassName telling that controller to pick it up.

A platform team owns the cluster's shared entry point and application teams own their own routes. Which Gateway API objects match that split?

GatewayClass describes an implementation, a Gateway is the entry point the platform team runs, and HTTPRoute is the routing an application team attaches to it. The kinds are modelled on those roles.

A shared Gateway lives in the infra namespace. A team applies an HTTPRoute in their own namespace referencing that Gateway, and it is not accepted. What is required?

A Gateway only accepts routes from its own namespace by default. Attaching a route from elsewhere requires the Gateway's listener to permit it through allowedRoutes.

During a rolling update, some requests fail with connection errors even though every Pod eventually becomes healthy. Which mechanism prevents this, and how?

A readiness probe keeps a Pod out of a Service's endpoints until it can serve. Without one, a Pod receives traffic as soon as its container starts.

A Pod cannot resolve any Service name. Other Pods in the cluster resolve names normally. Which check comes first?

With other Pods resolving fine, CoreDNS is healthy, so look at this Pod. Its /etc/resolv.conf and its dnsPolicy decide which resolver it uses at all.